1407 files changed, 63178 insertions, 19039 deletions

diff --git a/WebCore/Android.derived.jscbindings.mk b/WebCore/Android.derived.jscbindings.mk
index 2eb19f5..a589bba 100644
--- a/WebCore/Android.derived.jscbindings.mk
+++ b/WebCore/Android.derived.jscbindings.mk
@@ -49,7 +49,11 @@ js_binding_scripts := $(addprefix $(LOCAL_PATH)/,\
 			bindings/scripts/generate-bindings.pl \
 		)
 
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
 FEATURE_DEFINES := ENABLE_ORIENTATION_EVENTS=1 ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1 ENABLE_CHANNEL_MESSAGING=1
+=======
+FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1 ENABLE_CHANNEL_MESSAGING=1
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
 
 # CSS
 GEN := \
@@ -132,9 +136,12 @@ GEN := \
     $(intermediates)/dom/JSRangeException.h \
     $(intermediates)/dom/JSText.h \
     $(intermediates)/dom/JSTextEvent.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/dom/JSTouch.h \
     $(intermediates)/dom/JSTouchEvent.h \
     $(intermediates)/dom/JSTouchList.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/dom/JSTreeWalker.h \
     $(intermediates)/dom/JSUIEvent.h \
     $(intermediates)/dom/JSWebKitAnimationEvent.h \
@@ -245,6 +252,7 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/html/%.cpp : $(intermediates)/htm
 
 # Canvas
 GEN := \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasActiveInfo.h \
     $(intermediates)/html/canvas/JSCanvasArray.h \
     $(intermediates)/html/canvas/JSCanvasArrayBuffer.h \
@@ -252,13 +260,22 @@ GEN := \
     $(intermediates)/html/canvas/JSCanvasByteArray.h \
     $(intermediates)/html/canvas/JSCanvasFloatArray.h \
     $(intermediates)/html/canvas/JSCanvasFramebuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasGradient.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasIntArray.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasNumberArray.h \
     $(intermediates)/html/canvas/JSCanvasPattern.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasProgram.h \
     $(intermediates)/html/canvas/JSCanvasRenderbuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasRenderingContext.h \
+<<<<<<< HEAD:WebCore/Android.derived.jscbindings.mk
     $(intermediates)/html/canvas/JSCanvasRenderingContext2D.h \
     $(intermediates)/html/canvas/JSCanvasRenderingContext3D.h \
     $(intermediates)/html/canvas/JSCanvasShader.h \
@@ -267,6 +284,9 @@ GEN := \
     $(intermediates)/html/canvas/JSCanvasUnsignedByteArray.h \
     $(intermediates)/html/canvas/JSCanvasUnsignedIntArray.h \
     $(intermediates)/html/canvas/JSCanvasUnsignedShortArray.h
+=======
+    $(intermediates)/html/canvas/JSCanvasRenderingContext2D.h
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.jscbindings.mk
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS --include dom --include html --outputdir $(dir $@) $<
diff --git a/WebCore/Android.derived.v8bindings.mk b/WebCore/Android.derived.v8bindings.mk
index e0b5d98..8b2ca0c 100644
--- a/WebCore/Android.derived.v8bindings.mk
+++ b/WebCore/Android.derived.v8bindings.mk
@@ -30,7 +30,11 @@ js_binding_scripts := \
 	$(LOCAL_PATH)/bindings/scripts/IDLStructure.pm \
 	$(LOCAL_PATH)/bindings/scripts/generate-bindings.pl
 
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
 FEATURE_DEFINES := ENABLE_ORIENTATION_EVENTS=1 ENABLE_TOUCH_EVENTS=1 V8_BINDING ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1
+=======
+FEATURE_DEFINES := ANDROID_ORIENTATION_SUPPORT ENABLE_TOUCH_EVENTS=1 V8_BINDING ENABLE_DATABASE=1 ENABLE_OFFLINE_WEB_APPLICATIONS=1 ENABLE_DOM_STORAGE=1 ENABLE_VIDEO=1 ENABLE_WORKERS=1 ENABLE_GEOLOCATION=1
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
 
 # CSS
 GEN := \
@@ -114,9 +118,12 @@ GEN := \
     $(intermediates)/bindings/V8RangeException.h \
     $(intermediates)/bindings/V8Text.h \
     $(intermediates)/bindings/V8TextEvent.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8Touch.h \
     $(intermediates)/bindings/V8TouchEvent.h \
     $(intermediates)/bindings/V8TouchList.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8TreeWalker.h \
     $(intermediates)/bindings/V8UIEvent.h \
     $(intermediates)/bindings/V8WebKitAnimationEvent.h \
@@ -228,6 +235,7 @@ $(patsubst %.h,%.cpp,$(GEN)): $(intermediates)/bindings/%.cpp : $(intermediates)
 
 # Canvas
 GEN := \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasActiveInfo.h \
     $(intermediates)/bindings/V8CanvasArray.h \
     $(intermediates)/bindings/V8CanvasArrayBuffer.h \
@@ -235,14 +243,23 @@ GEN := \
     $(intermediates)/bindings/V8CanvasByteArray.h \
     $(intermediates)/bindings/V8CanvasFloatArray.h \
     $(intermediates)/bindings/V8CanvasFramebuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasGradient.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasIntArray.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasNumberArray.h \
     $(intermediates)/bindings/V8CanvasPattern.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasPixelArray.h \
     $(intermediates)/bindings/V8CanvasProgram.h \
     $(intermediates)/bindings/V8CanvasRenderbuffer.h \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasRenderingContext.h \
+<<<<<<< HEAD:WebCore/Android.derived.v8bindings.mk
     $(intermediates)/bindings/V8CanvasRenderingContext2D.h \
     $(intermediates)/bindings/V8CanvasRenderingContext3D.h \
     $(intermediates)/bindings/V8CanvasShader.h \
@@ -251,6 +268,9 @@ GEN := \
     $(intermediates)/bindings/V8CanvasUnsignedByteArray.h \
     $(intermediates)/bindings/V8CanvasUnsignedIntArray.h \
     $(intermediates)/bindings/V8CanvasUnsignedShortArray.h
+=======
+    $(intermediates)/bindings/V8CanvasRenderingContext2D.h
+>>>>>>> webkit.org at r51976:WebCore/Android.derived.v8bindings.mk
 
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
 $(GEN): PRIVATE_CUSTOM_TOOL = SOURCE_ROOT=$(PRIVATE_PATH) perl -I$(PRIVATE_PATH)/bindings/scripts $(PRIVATE_PATH)/bindings/scripts/generate-bindings.pl --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator V8 --include dom --include html --include html/canvas --outputdir $(dir $@) $<
diff --git a/WebCore/Android.jscbindings.mk b/WebCore/Android.jscbindings.mk
index 0eaff05..981894c 100644
--- a/WebCore/Android.jscbindings.mk
+++ b/WebCore/Android.jscbindings.mk
@@ -66,6 +66,7 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCSSStyleDeclarationCustom.cpp \
 	bindings/js/JSCSSValueCustom.cpp \
 	bindings/js/JSCallbackData.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasArrayBufferConstructor.cpp \
 	bindings/js/JSCanvasArrayCustom.cpp \
 	bindings/js/JSCanvasByteArrayConstructor.cpp \
@@ -74,10 +75,16 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCanvasFloatArrayCustom.cpp \
 	bindings/js/JSCanvasIntArrayConstructor.cpp \
 	bindings/js/JSCanvasIntArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasNumberArrayCustom.cpp \
 	bindings/js/JSCanvasRenderingContext2DCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasRenderingContext3DCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasRenderingContextCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/JSCanvasShortArrayConstructor.cpp \
 	bindings/js/JSCanvasShortArrayCustom.cpp \
 	bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp \
@@ -86,6 +93,8 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSCanvasUnsignedIntArrayCustom.cpp \
 	bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp \
 	bindings/js/JSCanvasUnsignedShortArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/JSClipboardCustom.cpp \
 	bindings/js/JSConsoleCustom.cpp \
 	bindings/js/JSCoordinatesCustom.cpp \
@@ -186,7 +195,10 @@ LOCAL_SRC_FILES += \
 	bindings/js/ScriptCallFrame.cpp \
 	bindings/js/ScriptCallStack.cpp \
 	bindings/js/ScriptController.cpp \
+<<<<<<< HEAD:WebCore/Android.jscbindings.mk
 	bindings/js/ScriptControllerAndroid.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.jscbindings.mk
 	bindings/js/ScriptEventListener.cpp \
 	bindings/js/ScriptFunctionCall.cpp \
 	bindings/js/ScriptObject.cpp \
diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index 880b4c3..5b2de3d 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -104,7 +104,10 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/CharacterData.cpp \
 	dom/CheckedRadioButtons.cpp \
 	dom/ChildNodeList.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	dom/ClassNames.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/ClassNodeList.cpp \
 	dom/ClientRect.cpp \
 	dom/ClientRectList.cpp \
@@ -160,15 +163,22 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ScriptExecutionContext.cpp \
 	dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
+=======
+	dom/SpaceSplitString.cpp \
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/StaticNodeList.cpp \
 	dom/StyleElement.cpp \
 	dom/StyledElement.cpp \
 	dom/TagNodeList.cpp \
 	dom/Text.cpp \
 	dom/TextEvent.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	dom/Touch.cpp \
 	dom/TouchEvent.cpp \
 	dom/TouchList.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	dom/Traversal.cpp \
 	dom/TreeWalker.cpp \
 	dom/UIEvent.cpp \
@@ -260,30 +270,45 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	html/TimeRanges.cpp \
 	html/ValidityState.cpp \
 	\
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasArray.cpp \
 	html/canvas/CanvasArrayBuffer.cpp \
 	html/canvas/CanvasBuffer.cpp \
 	html/canvas/CanvasByteArray.cpp \
 	html/canvas/CanvasFloatArray.cpp \
 	html/canvas/CanvasFramebuffer.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasGradient.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasIntArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasNumberArray.cpp \
 	html/canvas/CanvasObject.cpp \
 	html/canvas/CanvasPattern.cpp \
 	html/canvas/CanvasPixelArray.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasProgram.cpp \
 	html/canvas/CanvasRenderbuffer.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasRenderingContext.cpp \
 	html/canvas/CanvasRenderingContext2D.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasRenderingContext3D.cpp \
 	html/canvas/CanvasShader.cpp \
 	html/canvas/CanvasShortArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	html/canvas/CanvasStyle.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	html/canvas/CanvasTexture.cpp \
 	html/canvas/CanvasUnsignedByteArray.cpp \
 	html/canvas/CanvasUnsignedIntArray.cpp \
 	html/canvas/CanvasUnsignedShortArray.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	\
 	loader/Cache.cpp \
 	loader/CachedCSSStyleSheet.cpp \
@@ -460,6 +485,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/graphics/SegmentedFontData.cpp \
 	platform/graphics/SimpleFontData.cpp \
 	platform/graphics/StringTruncator.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	platform/graphics/WidthIterator.cpp \
 	\
 	platform/graphics/android/BitmapAllocatorAndroid.cpp \
@@ -479,6 +505,9 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/graphics/android/PlatformGraphicsContext.cpp \
 	platform/graphics/android/SharedBufferStream.cpp \
 	platform/graphics/android/android_graphics.cpp \
+=======
+	platform/graphics/WidthIterator.cpp
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 
 ifeq ($(ENABLE_SVG), true)
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
@@ -526,11 +555,15 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/network/ResourceHandle.cpp \
 	platform/network/ResourceRequestBase.cpp \
 	platform/network/ResourceResponseBase.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	\
 	platform/network/android/Cookie.cpp \
 	platform/network/android/NetworkStateNotifierAndroid.cpp \
 	platform/network/android/ResourceHandleAndroid.cpp \
 	platform/network/android/ResourceRequestAndroid.cpp \
+=======
+	platform/network/SocketStreamHandleBase.cpp \
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	\
 	platform/posix/FileSystemPOSIX.cpp \
 	\
@@ -550,7 +583,10 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/text/String.cpp \
 	platform/text/StringBuilder.cpp \
 	platform/text/StringImpl.cpp \
+<<<<<<< HEAD:WebCore/Android.mk
 	platform/text/TextBoundariesICU.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	platform/text/TextBreakIteratorICU.cpp \
 	platform/text/TextCodec.cpp \
 	platform/text/TextCodecICU.cpp \
@@ -578,10 +614,13 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	plugins/PluginView.cpp \
 	plugins/npapi.cpp \
 	\
+<<<<<<< HEAD:WebCore/Android.mk
 	plugins/android/PluginDataAndroid.cpp \
 	plugins/android/PluginPackageAndroid.cpp \
 	plugins/android/PluginViewAndroid.cpp \
 	\
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.mk
 	rendering/AutoTableLayout.cpp \
 	rendering/CounterNode.cpp \
 	rendering/EllipsisBox.cpp \
diff --git a/WebCore/Android.v8bindings.mk b/WebCore/Android.v8bindings.mk
index f683fca..7d028ea 100644
--- a/WebCore/Android.v8bindings.mk
+++ b/WebCore/Android.v8bindings.mk
@@ -88,17 +88,23 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8AbstractWorkerCustom.cpp \
 	bindings/v8/custom/V8AttrCustom.cpp \
 	bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasArrayBufferCustom.cpp \
 	bindings/v8/custom/V8CanvasByteArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasFloatArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasIntArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasPixelArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp \
 	bindings/v8/custom/V8CanvasShortArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp \
 	bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8ClientRectListCustom.cpp \
 	bindings/v8/custom/V8ClipboardCustom.cpp \
 	bindings/v8/custom/V8CoordinatesCustom.cpp \
@@ -166,7 +172,10 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8SharedWorkerCustom.cpp \
 	bindings/v8/custom/V8StorageCustom.cpp \
 	bindings/v8/custom/V8StyleSheetListCustom.cpp \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8TouchListCustom.cpp \
+=======
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
 	bindings/v8/custom/V8TreeWalkerCustom.cpp \
 	bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
 	bindings/v8/custom/V8WebKitPointConstructor.cpp \
@@ -178,5 +187,9 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8XMLSerializerConstructor.cpp
 
 LOCAL_SRC_FILES += \
+<<<<<<< HEAD:WebCore/Android.v8bindings.mk
 	bridge/jni/jni_utility.cpp \
 	bridge/jni/v8/jni_utility_private.cpp
+=======
+	bridge/jni/jni_utility.cpp
+>>>>>>> webkit.org at r51976:WebCore/Android.v8bindings.mk
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 1727089..67567ab 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16674 @@
+2009-12-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32140
+        REGRESSION(r50072): Mailman administrative functionality is broken
+
+        Test: http/tests/misc/percent-sign-in-form-field-name.html
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::appendQuotedString): Don't encode percent
+        sign, we never had a good reason to do that.
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove getPropertyAttributes() from JavaScript bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        The functionality is provided by getOwnPropertyDescriptor().
+
+        * WebCore.order:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Changed WebGLRenderingContext to synthesize GL errors rather than
+        raising JavaScript exceptions. Removed internal getError() calls
+        after each graphics call. The GraphicsContext3D maintains the
+        synthetic exceptions because only it has complete information
+        about certain conditions requiring them to be raised.
+
+        Based on idea from Ilmari Heikkinen, added create3DDebugContext()
+        to webgl-test.js and changed the WebGL layout tests expecting
+        error conditions to use it. Updated expected.txt files, which now
+        implicitly test the OpenGL error as it is part of the exception's
+        message.
+
+        Added new targeted test covering aspects of synthetic errors as
+        well as regression tests for bugs uncovered during its development.
+
+        Test: fast/canvas/webgl/error-reporting.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::attachShader):
+        (WebCore::WebGLRenderingContext::bindAttribLocation):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::compileShader):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::detachShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::framebufferRenderbuffer):
+        (WebCore::WebGLRenderingContext::framebufferTexture2D):
+        (WebCore::WebGLRenderingContext::getActiveAttrib):
+        (WebCore::WebGLRenderingContext::getActiveUniform):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::shaderSource):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for assert on Chrome/skia with SVG Filters enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32394
+
+        Covered by LayoutTests/svg/W3C-SVG-1.1/filters-tile-01-b.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): With 2 highlighted lines of text in gmail/hotmail selecting Bold selects other 2 edit buttons automatically.
+        <rdar://problem/7442065>
+        https://bugs.webkit.org/show_bug.cgi?id=32285
+
+        When examining the styles of the nodes after the first in a range selection, we take into
+        cosideration differences in style of txt nodes only.
+        
+        Test: editing/execCommand/queryCommandState-02.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionHasStyle):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: debugger shortcuts don't work when
+        Search field or Console drawer has focus.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32392
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.documentKeyUp):
+        (WebInspector.searchKeyDown):
+
+2009-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Events created in isolated worlds may fire in main world.
+        https://bugs.webkit.org/show_bug.cgi?id=32386
+
+        Test: http/tests/security/isolatedWorld/events.html
+
+        * WebCore.gypi: Added WorldContextHandle.
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Added WorldContextHandle params.
+        * bindings/v8/SharedPersistent.h: Fixed a few style/include issues.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Added WorldContextHandle params.
+        (WebCore::V8AbstractEventListener::handleEvent): Adjusted context retrieval to use WorldContextHandle.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::worldContext): Added WorldContextHandle params.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Ditto.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Ditto.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Adjusted context retrieval to use WorldContextHandle.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::context): Refactored to use mainWorldContext();
+        (WebCore::V8Proxy::mainWorldContext): Added.
+        (WebCore::toV8Context): Changed to use WorldContextHandle.
+        * bindings/v8/V8Proxy.h: Added mainWorldContext decl.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException): Added an extra check to avoid crashes during frame teardown.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Added WorldContextHandle params.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Added WorldContextHandle params.
+        * bindings/v8/WorldContextHandle.cpp: Added.
+        * bindings/v8/WorldContextHandle.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Added WorldContextHandle params.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Added WorldContextHandle params.
+
+2009-12-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Pass more information about a plug-in to the PluginHalterDelegate
+
+        Reviewed by Adam Roben.
+
+        * loader/EmptyClients.h:
+        Remove this unused class.
+
+        * page/HaltablePlugin.h:
+        Add new functions to return the plug-in's name and whether it is
+        windowed.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::timerFired):
+        Pass new arguments to the client.
+
+        * page/PluginHalterClient.h:
+        Add new parameters.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::pluginName):
+        Return the name from the PluginPackage.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isWindowed):
+
+2009-12-09  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31738>.
+        Web Inspector: Console Scope Bar should be on top of console when Console is a Panel.
+        
+        When the console is set to be shown as a full panel, move the scope bar to the top
+        where it looks best. When it is only shown as a drawer, move it to the bottom, where
+        it originally was. This takes up less space as a drawer, and makes it more discoverable
+        and usable when it is the full panel.
+
+        * inspector/front-end/ConsolePanel.js:
+        (WebInspector.ConsolePanel.prototype.show): Move filter bar to top.
+        (WebInspector.ConsolePanel.prototype.hide): Move filter bar back to bottom.
+        * inspector/front-end/inspector.css:
+
+2009-12-10  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Fix for alpha blending in SVG Filters on Chromium/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=32378
+
+        Covered by LayoutTests/svg/filters/feGaussianBlur.svg and others.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+
+2009-12-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add context menu actions for DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32348
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextMenu):
+        (WebInspector.ContextMenu.prototype.show):
+        (WebInspector.ContextMenu.prototype.appendItem):
+        (WebInspector.ContextMenu.prototype.appendSeparator):
+        (WebInspector.ContextMenu.prototype._itemSelected):
+        (WebInspector.contextMenuItemSelected):
+        (WebInspector.contextMenuCleared):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateTextContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector.contextMenuEventFired):
+        * inspector/front-end/treeoutline.js:
+        (TreeElement.treeElementDoubleClicked):
+
+2009-12-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filters contain some leaks in untested code
+        https://bugs.webkit.org/show_bug.cgi?id=32325
+
+        Fix obvious leak in SVGFE*Lighting classes. Implement the create() idiom for 
+        all classes in svg/graphics, that were missing it. The lighting filters aren't
+        implemented so far, but the associated FilterEffect objects are build, which created
+        these leaks.
+
+        This removes the SVG related failures in the leaks bot.
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::findLights):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDistantLightElement.cpp:
+        (WebCore::SVGFEDistantLightElement::lightSource):
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEPointLightElement.cpp:
+        (WebCore::SVGFEPointLightElement::lightSource):
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::findLights):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpotLightElement.cpp:
+        (WebCore::SVGFESpotLightElement::lightSource):
+        * svg/SVGFESpotLightElement.h:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        (WebCore::DistantLightSource::create):
+        (WebCore::DistantLightSource::DistantLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::FEDiffuseLighting):
+        (WebCore::FEDiffuseLighting::create):
+        (WebCore::FEDiffuseLighting::setLightSource):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::FESpecularLighting):
+        (WebCore::FESpecularLighting::create):
+        (WebCore::FESpecularLighting::setLightSource):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        (WebCore::PointLightSource::create):
+        (WebCore::PointLightSource::PointLightSource):
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        (WebCore::SpotLightSource::create):
+        (WebCore::SpotLightSource::SpotLightSource):
+
+2009-12-10  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Chromium] SporeViewer demo doesn't work in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32364
+
+        Test: fast/canvas/webgl/bug-32364.html
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+
+2009-12-09  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32346 SVG property 
+        -webkit-shadow should apply shadow on the result after compositing
+        -and corresponding-
+        <rdar://problem/7389404>
+
+        Set a transparency layer when setting a shadow to apply the shadow 
+        to the composite.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32332
+        WebSocket events should be dispatched synchronously
+
+        Updated websocket/tests/simple to test for the new behavior.
+
+        When Web Sockets API says that events should be queued for async dispatch, it means something
+        different. We should keep this in mind when dealing with other HTML5-related specs.
+
+        The model for HTML5 is that code running in response to network events (e.g. WebSocket or
+        XMLHttpRequest algorithms) runs in a separate thread of execution, and thus needs to post
+        async events as its only way to communicate with client code. As long as network events are
+        queued themselves (as they are in WebKit), there is no need to queue JS events for async
+        dispatch.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+
+2009-12-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32355
+        Assertion failure when opening a WebSocket connection
+
+        I couldn't make a reliable test for this. Once the test from bug 32299 is landed, it
+        will provide partial coverage, as I was frequently seeing the assertion failure with it.
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::send):
+        It's not an error if zero is returned from platformSend() - it just means that nothing could
+        be pushed down to the network layer, and all data was queued for later.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): This will no longer happen with SocketStream,
+        but a client can potentially destroy the handle from any callback, so we need to check that
+        this didn't happen.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Ditto.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Roll out 51919 and 51920. They were incorrect and unnecessary right now.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Adds wtf/StdLibExtras.h include for DEFINE_STATIC_LOCAL in V8 ScriptState.
+        https://bugs.webkit.org/show_bug.cgi?id=32330
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptState.cpp: Modified. Adds wtf/StdLibExtras.h include.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ENABLE(INSPECTOR) guards around script binding methods that use types
+        defined only when INSPECTOR is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=32328
+
+        Build fix only, no new tests.
+
+        * bindings/js/ScriptValue.cpp: Modified. Added ENABLE(INSPECTOR) guard to ScriptValue::quarantineValue.
+        * bindings/v8/ScriptObject.cpp: Modified. Added ENABLE(INSPECTOR) guard to some overloads of ScriptGlobalObject::set.
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds Android Makefiles for building with V8.
+        Also updates existing Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        Build fix only, no new tests.
+
+        * Android.derived.jscbindings.mk: Modified.
+        * Android.derived.mk: Modified.
+        * Android.derived.v8bindings.mk: Added.
+        * Android.jscbindings.mk: Modified.
+        * Android.mk: Modified.
+        * Android.v8bindings.mk: Added.
+
+2009-12-09  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32338 - [Chromium] Fix Chromium builder by including missing GeolocationServiceChromium
+        https://bugs.webkit.org/show_bug.cgi?id=32338
+
+        Fix build break: re-include file dropped out by merge in http://trac.webkit.org/changeset/51681/trunk/WebCore/WebCore.gypi
+
+        * WebCore.gypi: Add missing GeolocationServiceChromium.cpp
+
+2009-12-09  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Brady Eidson.
+
+        Fixed a typo in http://trac.webkit.org/changeset/51644 that broke
+        the QWebPage autotest.
+
+        No new test required.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+
+2009-12-09  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed by Eric Seidel.
+
+        Exclude JSSVG*.cpp generated files from --minimal and --no-svg builds.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32286
+
+        * WebCore.pro:
+
+2009-12-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        Ogg mimetypes are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=27113
+
+        The ogg extension is handled by audio/ogg instead of
+        application/ogg. See
+        http://wiki.xiph.org/MIME_Types_and_File_Extensions
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::TypeExtensionPair::):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use the current run loop instead of the main runloop for the NetworkStateNotifier.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Use isMainThread() helper instead of pthread_main_np() != 0.
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCScheduleDeallocateOnMainThread):
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some #ifdefs to allow us to experiment with a single NSView mac WebKit.
+
+        * page/Chrome.h:
+        * page/EventHandler.h:
+        * page/mac/ChromeMac.mm:
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::dragOperation):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::isKeyboardOptionTab):
+        (WebCore::EventHandler::invertSenseOfTabsToLinks):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Widget.cpp:
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+
+2009-12-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        No new tests.
+
+        * bindings/v8/DOMData.cpp
+        * bindings/v8/V8DOMWrapper.cpp
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+
+2009-12-09  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Isolated world reuse failure
+        https://bugs.webkit.org/show_bug.cgi?id=32306
+
+        Fixed bug introduced in r51407: (http://trac.webkit.org/changeset/51407) which caused layout test
+        LayoutTests/http/tests/security/isolatedWorld/world-reuse.html to fail.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-12-09  Patrick Scott  <phanna@email.unc.edu>
+
+        Fix the build with ENABLE_ORIENTATION_EVENTS
+        https://bugs.webkit.org/show_bug.cgi?id=32321
+
+        * page/Frame.cpp:
+        (WebCore::Frame::sendOrientationChangeEvent):
+
+2009-12-09  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium tickmarks in scrollbar now UX approved.
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+
+2009-12-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Delay load DLLs for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        Add logic to turn off accelerated compositing if d3d9 or QuartzCore
+        DLLs are not present.
+        
+        This patch also changes the WKCACFLayerRenderer to be a pointer.
+        This allows me to have a create() method which will not create it when
+        accelerated compositing is disabled because of missing DLLs. It 
+        avoids having to do so many checks. I also made WebViewWndProc 
+        a member function to allow several methods to be made protected, which
+        allows me to avoid doing availability checks there as well.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        * platform/graphics/win/WKCACFLayer.h:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * rendering/RenderLayerBacking.cpp:
+
+2009-12-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Rename dom/ClassNames to SpaceSplitString and update build files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32250
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRules):
+        * dom/ClassNames.cpp: Removed.
+        * dom/ClassNames.h: Removed.
+        * dom/ClassNodeList.h:
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::classNames):
+        * dom/SpaceSplitString.cpp: Copied from WebCore/dom/ClassNames.cpp.
+        (WebCore::SpaceSplitStringData::createVector):
+        (WebCore::SpaceSplitStringData::containsAll):
+        * dom/SpaceSplitString.h: Copied from WebCore/dom/ClassNames.h.
+        (WebCore::SpaceSplitStringData::SpaceSplitStringData):
+        (WebCore::SpaceSplitString::SpaceSplitString):
+        (WebCore::SpaceSplitString::set):
+        (WebCore::SpaceSplitString::containsAll):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::classNames):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setRel):
+
+2009-12-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Enable SVG filters in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=32323
+
+        Covered by SVG filter layout tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::functionForUniform):
+
+2009-12-08  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebSocket allow space (U+0020) in sub protocol name.
+        https://bugs.webkit.org/show_bug.cgi?id=32266
+
+        Test: websocket/tests/sub-protocol-with-space.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::isValidProtocolString):
+
+2009-12-08  Peterson Trethewey  <petersont@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement WebGLUniformLocation and change API to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31173
+
+        Test: fast/canvas/webgl/uniform-location.html
+
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::functionForUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toWebGLUniformLocation):
+        (WebCore::):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::isFunctionToCallForAttribute):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getUniformLocation):
+        (WebCore::WebGLRenderingContext::uniform1f):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1i):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2f):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2i):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3f):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3i):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4f):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4i):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLUniformLocation.cpp: Added.
+        (WebCore::WebGLUniformLocation::create):
+        (WebCore::WebGLUniformLocation::WebGLUniformLocation):
+        * html/canvas/WebGLUniformLocation.h: Added.
+        (WebCore::WebGLUniformLocation::~WebGLUniformLocation):
+        (WebCore::WebGLUniformLocation::program):
+        (WebCore::WebGLUniformLocation::location):
+        * html/canvas/WebGLUniformLocation.idl: Added.
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion failure in WebCore::RenderBlock::startDelayUpdateScrollInfo
+
+        startDelayUpdateScrollInfo calls a function that can end up calling
+        startDelayUpdateScrollInfo again. However, it's static state is
+        inconsistent when this happens leading to an assertion failure (or
+        probably a memory leak if assertions are off).
+
+        Thanks to Robert Swiecki for the test case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32172
+        http://code.google.com/p/chromium/issues/detail?id=28880
+
+        Test: fast/css/recursive-delay-update-scroll.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::finishDelayUpdateScrollInfo):
+
+2009-12-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore source level debugging on Windows not reliable in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=32297
+
+        Customized pdb file name/location for WebCore static library.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add ProgramDataBaseFileName.
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * platform/FileSystem.h:
+        * platform/cf/BinaryPropertyList.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::unloadModule):
+        (WebCore::wxDirTraverserNonRecursive::wxDirTraverserNonRecursive):
+        (WebCore::wxDirTraverserNonRecursive::OnFile):
+        (WebCore::wxDirTraverserNonRecursive::OnDir):
+        (WebCore::listDirectory):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        * plugins/wx/PluginDataWx.cpp: Added.
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * wscript:
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Removed.
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+
+2009-12-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: support custom WebCore context menu items in Chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32277
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/chromium/ContextMenuChromium.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::platformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::checked):
+        (WebCore::ContextMenuItem::enabled):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+
+2009-12-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Linux: set default scrollbar colours.
+
+        This is so that layout tests have sane defaults for the scrollbar
+        colours, even if the API user doesn't set any.
+
+        This is a fix due to r51827.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32287
+
+        This is very well covered by existing layout tests.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+
+2009-12-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/7397808> Crash occurs at 
+        RenderObject::containingBlock() as I type in the Google Search 
+        field (during page load)
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): ownerRenderer() needs to be 
+        null checked.
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::IconRecord): Disable thread verification for this class because of its cross-thread use in IconDatabase.
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::SharedBuffer): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Disable thread verification for this class, add FIXME to enforce proper usage via crossThreadString.
+        * ForwardingHeaders/wtf/ThreadVerifier.h: Added.
+
+2009-12-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Adam Barth.
+
+        Inform the NotificationCenter when its window goes away in the same
+        manner as other DOMWindow fields, and prevent invalid operations on
+        it after that happens.
+
+        As part of this, change the V8 bindings for notifications to call
+        through the NotificationCenter rather than doing those operations
+        itself.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31886
+
+        Test: fast/notifications/notification-after-close.html
+
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed block selection gap repainting in table cells
+
+        Test: fast/repaint/block-selection-gap-in-table-cell.html
+
+        This recently-introduced regression exposed the fact that
+        RenderTableCell did not override offsetFromContainer() to adjust for
+        the fact that table cells’ coordinates are relative to the table
+        section, not the table row. With this fixed, RenderTableCell no longer
+        needs to override mapLocalToContainer() and mapAbsoluteToLocalPoint(),
+        since the base class implementations of those use offsetFromContainer().
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::offsetFromContainer):
+        * rendering/RenderTableCell.h:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sane way to force a rebuild on all win slaves, according to Adam Roben.
+
+        * WebCorePrefix.h:
+
+2009-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * loader/loader.cpp:
+        (WebCore::cachedResourceTypeToTargetType):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in to eventually fix the win debug build.
+
+        * svg/svgtags.in:
+
+2009-12-08  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32167
+        Update the ResourceRequest::RequestType.  This previously
+        was specific to Chromium.  Moved into ResourceRequestBase, enabling
+        more specificity about the type (which is otherwise only known to the
+        loader), and also making this information available to all platforms.
+        Any platform with a network layer which can utilize this information
+        may want to use it for prioritization.
+
+        Note to Chromium glue: TargetIsSubResource renamed to TargetIsSubresource.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::CachedResourceTypeToTargetType):
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::):
+        (WebCore::ResourceRequestBase::targetType):
+        (WebCore::ResourceRequestBase::setTargetType):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        Build system change only. No tests possible.
+
+        * Android.derived.jscbindings.mk: Added.
+        * Android.derived.mk: Added.
+        * Android.jscbindings.mk: Added.
+        * Android.mk: Added.
+        * WebCorePrefix.h: Modified. Sets up some flags and adds a header required for building on Android.
+
+2009-12-08  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Xan Lopez.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS): Conditionalize prefetching on
+        the libSoup version.
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Win.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * bindings/scripts/CodeGeneratorCOM.pm: Touch file to assure a world rebuild. Hopefully.
+
+2009-12-08  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        CSS Counter Nesting still does not work according to the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=31723
+
+        Test: fast/css/counters/nesting.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Replaced the faulty counter insertion algorithm with one that works.
+
+2009-12-08  John Sullivan  <sullivan@apple.com>
+
+        Add isAutofilled getter to match existing setter.
+
+        Reviewed by Ada Chan.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isAutofilled]):
+        Implemented new cover function.
+        
+        * bindings/objc/DOMPrivate.h:
+        Declared new cover function.
+
+2009-12-08  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] Create a TextBreakIterator implementation based on GLib (without ICU)
+        https://bugs.webkit.org/show_bug.cgi?id=31469
+
+        Added a TextBreakIterator implementation based on GLib and pango,
+        which allows compiling WebCore without ICU.
+
+        * GNUmakefile.am:
+        * platform/text/gtk/TextBreakIteratorGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::setUpIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::cursorMovementIterator):
+        (WebCore::wordBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakLast):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPrevious):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+
+2009-12-08  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Change the way cookies are retrieved in the WebInspector frontend.
+
+        Moved the cookie filtering from the native code into the frontend so that
+        all cookies can be retrieved regardless of the associated domain
+        (required for certain audits to run.)
+        https://bugs.webkit.org/show_bug.cgi?id=32160
+
+        Test: inspector/cookie-resource-match.html
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * inspector/InspectorController.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._cookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.get documentURL):
+        (WebInspector.Resource.prototype.set documentURL):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Touch svgtags.in, in order to force SVGNames.* regeneration. Praying for gtk bot to be fixed :-)
+
+        * svg/svgtags.in:
+
+2009-12-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Trying to force a rebuild on the Gtk slave. If that doesn't work, someone must force a rebuild from scratch.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: provide custom context menu in the front-end window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32200
+
+        * English.lproj/localizedStrings.js:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        (WebCore::JSInspectorFrontendHost::showContextMenu):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::contextMenuItemSelected):
+        (WebCore::InspectorFrontend::contextMenuCleared):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::showContextMenu):
+        (WebCore::InspectorFrontendHost::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::contextMenuCleared):
+        * inspector/InspectorFrontendHost.h:
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::create):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::~MenuSelectionHandler):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::disconnect):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuItemSelected):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::contextMenuCleared):
+        (WebCore::InspectorFrontendHost::MenuSelectionHandler::MenuSelectionHandler):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/ContextMenu.js: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.documentContextMenu):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::ContextMenuController):
+        (WebCore::ContextMenuController::clearContextMenu):
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::showContextMenu):
+        (WebCore::ContextMenuController::createContextMenu):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/ContextMenuController.h:
+        * page/ContextMenuSelectionHandler.h: Added.
+        (WebCore::ContextMenuSelectionHandler::ContextMenuSelectionHandler):
+        (WebCore::ContextMenuSelectionHandler::~ContextMenuSelectionHandler):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+
+2009-12-08  Andras Becsi  <abecsi@inf.u-szeged.hu>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        [Qt] Build fix of duplicated platform/graphics/filters/FEGaussianBlur.cpp in WebCore.pro after enabled svg filters.
+
+        No new tests needed.
+        * WebCore.pro:
+
+2009-12-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a function to show render tree for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=31288
+
+        No new tests because this just adds a function for debugging.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRenderObject):
+        (WebCore::RenderObject::showRenderTreeAndMark):
+        (showRenderTree):
+        * rendering/RenderObject.h:
+
+2009-12-07  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement NamedPropertyEnumerator and IndexedPropertyEnumerator for
+        V8 NPObject. This should make the object enumerable and fix the
+        enumeration issue in layout test plugins/netscape-enumerate.html.
+
+        Also fix some existing style issues per webkit style guidelines.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32254
+
+        Test: plugins/netscape-enumerate.html
+
+        * bindings/v8/V8NPObject.cpp:
+        (npObjectInvokeImpl):
+        (npObjectInvokeDefaultHandler):
+        (npObjectGetProperty):
+        (npObjectPropertyEnumerator):
+        (npObjectNamedPropertyEnumerator):
+        (npObjectIndexedPropertyEnumerator):
+        (createV8ObjectForNPObject):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fragments now make WebSocket URL parsing fail.
+        https://bugs.webkit.org/show_bug.cgi?id=32144
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+
+2009-12-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix wrong length parsing in WebSocket.
+        https://bugs.webkit.org/show_bug.cgi?id=32203
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Turn on (SVG) Filters for Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * WebCore.pro:
+
+2009-12-07  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: theme scrollbars to match GTK theme.
+        Add functions to RenderThemeChromiumLinux to change the scrollbar
+        color.
+
+        Since the change is to the Chromium WebKit API layer, testing will
+        be in Chromium's test shell.
+        http://bugs.webkit.org/show_bug.cgi?id=32048
+
+        Patch from Markus Gutschke <markus@chromium.org>.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::saturateAndBrighten):
+        (WebCore::outlineColor):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setScrollbarColors):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::thumbInactiveColor):
+        (WebCore::RenderThemeChromiumLinux::thumbActiveColor):
+        (WebCore::RenderThemeChromiumLinux::trackColor):
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Doesn't respect Content-Disposition for downloads, and provides no way for apps to do that
+        https://bugs.webkit.org/show_bug.cgi?id=32247
+
+        Allow creating a ResourceResponse from a SoupMessage.
+
+        Covered by API test.
+
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        * platform/network/soup/ResourceResponseSoup.cpp:
+        (WebCore::ResourceResponse::updateFromSoupMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Reverting problematic patch, causing errors.
+
+        Revert r51789 (Avoid zero division during SVGPaintServerPattern::setup()). Crashes on all Windows slaves.
+        Reopen bug https://bugs.webkit.org/show_bug.cgi?id=29912.
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for HTMLInputElement::stepUp() and stepDown() for
+        type=number and type=range.
+        https://bugs.webkit.org/show_bug.cgi?id=27451
+
+        Our implementation of stepUp() and stepDown() rounds the resultant
+        value to conform to the step value.
+        Change the number-string conversion method for RenderSlider to be
+        consistent with type=number.
+
+        Tests: fast/forms/input-step-number.html
+               fast/forms/input-step-range.html
+               fast/forms/input-step-unsupported.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::rangeOverflow): Unify the code for NUMBER and RANGE.
+        (WebCore::HTMLInputElement::minimum): Renamed from rangeMinimum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::maximum): Renamed from rangeMaximum(), and support for NUMBER.
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch): Use stepBase().
+        (WebCore::HTMLInputElement::applyStepForNumberOrRange):
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        (WebCore::HTMLInputElement::formStringFromDouble):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::stepUp):
+        (WebCore::HTMLInputElement::stepDown):
+        * html/HTMLInputElement.idl: Add stepUp() and stepDown().
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange): Sync with rangeMinimum()/rangeMaximum() renaming.
+        (WebCore::RenderSlider::updateFromElement): Use formStringFromDouble().
+        (WebCore::RenderSlider::setValueForPosition): Use formStringFromDouble().
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix try 2 (dumb error).
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: Chromium build fix.
+
+        Fix Chromium build break caused by an added dependency from
+        ScriptControllerBase to JSDOMWindowShell, and an API change in
+        ScriptValue.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::getString):
+
+2009-12-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(4.0.4-42a12): Indent does not work for twice modified with background text in gmail.
+        <rdar://problem/7442387>
+        https://bugs.webkit.org/show_bug.cgi?id=32233
+        
+        Fixes problem in re-creating the correct hierarchy under the new block.
+        Added extensive testing to cover all the cases.
+
+        Test: editing/execCommand/indent-with-style2.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Force JS binding regeneration, eventually fixing the broken tests on the bots.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix mac builds by touching svgtags.in - I only tried from-scratch builds.
+
+        * svg/svgtags.in:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        Only enable filters on mac for now, skipped all affected tests on the other platforms.
+        Will enable them one after another, to minimize breakage.
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that KURL rejects a host name which has an IPv4 address
+        inside an IPv6 form like [::127.0.0.1].
+        https://bugs.webkit.org/show_bug.cgi?id=29913
+
+        * platform/KURL.cpp:
+        (WebCore::characterClassTable): Add IPv6Char to '.'.
+
+2009-12-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7443417> - Closing a window opened with "New windows open with: Same Page" results in crash in ::~HistoryItem
+
+        The HistoryItem copy constructor has one very specific use case - to support the feature of a WebView copying another WebView's
+        BackForwardList.  That constructor wasn't initializing its m_document pointer, leading to this crash in the destructor.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::~HistoryItem): Change the setDocument(0) to an ASSERT that the document is already 0. A HistoryItem cannot
+          outlive its Document and Documents will always clear the back-pointer in their ::detach() method.
+        (WebCore::HistoryItem::HistoryItem): Missed the m_document initializer in the copy constructor. Also remove an invalid assertion
+          about the original items m_cachedPage object (which is irrelevant to the copy).
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove partial SharedScript implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=32237
+        The patch was obtained by running "git revert" command and then un-reverting WebCore/ChangeLog.
+
+        * DerivedSources.make:
+        * SharedScript/SharedScriptContext.cpp: Removed.
+        * SharedScript/SharedScriptContext.h: Removed.
+        * SharedScript/SharedScriptContext.idl: Removed.
+        * SharedScript/SharedScriptController.h: Removed.
+        * SharedScript/WebKitSharedScript.cpp: Removed.
+        * SharedScript/WebKitSharedScript.h: Removed.
+        * SharedScript/WebKitSharedScript.idl: Removed.
+        * SharedScript/WebKitSharedScriptRepository.cpp: Removed.
+        * SharedScript/WebKitSharedScriptRepository.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * dom/ScriptExecutionContext.h:
+
+2009-12-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32226
+        Random crashes in WebSocket tests on Leopard Debug builbot
+
+        * platform/network/SocketStreamHandleBase.cpp: (WebCore::SocketStreamHandleBase::close):
+        Make sure the object still exists when setting m_state.
+
+2009-12-07  Shiki Okasaka  <shiki@google.com>
+
+        Reviewed by Dirk Schulze.
+
+        Avoid zero division during SVGPaintServerPattern::setup()
+        https://bugs.webkit.org/show_bug.cgi?id=29912
+
+        Fix zero division bugs in SVGPaintServerPattern::setup() that occurred
+        if the tile of a pattern was bigger than the pattern and the pattern
+        size was < 0.5, and if the attribute overflow was set to visible.
+
+        Test: svg/custom/small-pattern.html
+
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] WebCore::WebGLArrayBufferInternal::byteLengthAttrGetter NULL pointer
+        https://bugs.webkit.org/show_bug.cgi?id=31889
+
+        Fixed bug in handling of zero-argument constructor call.
+
+        Test: fast/canvas/webgl/bug-31889.html
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-12-07  Gyuyoung Kim  <gyuyoung@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32024
+        [GTK] WebKit does not compile without JAVASCRIPT_DEBUGGER
+
+        Fix build errors when javascript-debugger is disabled on GTK
+
+        * GNUmakefile.am:
+
+2009-12-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7437820> Weird selection artifacts
+
+        Tests: fast/repaint/block-selection-gap-stale-cache-2.html
+               fast/repaint/block-selection-gap-stale-cache.html
+
+        Instead of caching the block selection gaps’ bounds in the RenderView at setSelection()
+        time, cache them in each RenderLayer at paint time. This prevents the cache from getting
+        stale due to layout changes and overflow scrolling.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Account for overflow scroll.
+        (WebCore::RenderBlock::paintSelection): Update the enclosing layer’s selection gaps bounds.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::addBlockSelectionGapsBounds): Added. Updates the selection gaps
+        bounds to include the given rect.
+        (WebCore::RenderLayer::clearBlockSelectionGapsBounds): Added. Recursively clears the cached
+        selection gaps bounds.
+        (WebCore::RenderLayer::repaintBlockSelectionGaps): Added. Recursively invalidates the
+        selection gaps bounds.
+        * rendering/RenderLayer.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Clear the layer-level selection gaps bounds instead
+        of the view-level cache.
+        (WebCore::RenderView::clearSelection): Changed to call repaintBlockSelectionGaps().
+        * rendering/RenderView.h:
+
+2009-12-07  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Fixed whitelist comment and removed useless (tags, sdp) mimetypes
+        from it. Also, GStreamer doesn't handle directly SMIL.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Eliminate the segfaults which occur when accessing the text interface now
+        implemented by text controls.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-12-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Turn the MediaPlayer supported types blacklist into a whitelist
+
+        [GTK] REGRESSION: webkit thinks it can render PDFs
+        https://bugs.webkit.org/show_bug.cgi?id=32183
+
+        Covered by API test.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25524
+        [Gtk] Expose the title attribute to assistive technologies
+
+        Expose 'alt' attribute from images as accessible name.
+        Expose the 'title' core HTML attribute as accessible description.
+        This is a modified version of the original fix submitted by Mario Sanchez Prada,
+        adjusted so that it doesn't impact other platforms.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_name):
+        (webkit_accessible_get_description):
+
+2009-12-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for generic font families
+
+        By not propagating the resolved font family in FontCacheQt and
+        only concidering the font description we ended up passing the
+        generic font families to Qt directly. Since most systems don't
+        have a mapping for these font families we ended up using the
+        default font in most cases.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.getOwnPropertyDescriptor() allows cross-frame access
+        https://bugs.webkit.org/show_bug.cgi?id=32119
+
+        Make all implementations of getOwnPropertyDescriptor that have
+        cross domain restrictions simply fail immediately on cross domain
+        access, rather than trying to mimic the behaviour of normal
+        property access.
+
+        Test: http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-12-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Moves JSC-specific functions from jni_utility and moves them to new jsc/jni_utility_private files.
+        https://bugs.webkit.org/show_bug.cgi?id=32157
+
+        Build fix only, no new tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Modified. Add jni_utility_private.[cpp|h].
+        * bridge/jni/jni_instance.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_jsobject.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_objc.mm: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_runtime.cpp: Modified. Include jni_utility_private.h for JSC.
+        * bridge/jni/jni_utility.cpp: Modified. Removed convertValueToJValue and convertArrayInstanceToJavaArray.
+        * bridge/jni/jni_utility.h: Modified. Removed convertValueToJValue and dispatchJNICall.
+        * bridge/jni/jsc: Added.
+        * bridge/jni/jsc/jni_utility_private.cpp: Added.
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/jni_utility_private.h: Added. Header for convertValueToJValue and dispatchJNICall.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Include jni_utility_private.h for JSC.
+
+2009-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        texImage2D pixel junk for transparency
+        https://bugs.webkit.org/show_bug.cgi?id=32188
+
+        Use kCGBlendModeCopy when drawing an image to the intermediate context
+        used to create a GL texture.
+
+        No test as we don't currently have any mechanism to retrieve pixel data
+        from the webgl context.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::imageToTexture):
+
+2009-12-03  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Advertize audio/ogg correctly and refactored mime-type cache
+        building.
+
+        [GTK] Recognize oga as audio/ogg
+        https://bugs.webkit.org/show_bug.cgi?id=31990
+
+        Test: media/media-can-play-ogg.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-12-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32175
+        REGRESSION: websocket/tests/url-parsing.html is crashing on Leopard Bot
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback): Call platformClose() to unschedule both
+        streams, guaranteeing that there will be no callbacks after SocketStreamHandle is destroyed.
+        (WebCore::SocketStreamHandle::writeStreamCallback): Edited a comment a bit.
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
+2009-12-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium: make rounded borders heavier.
+
+        Skia draws its rounded corners differently from the other ports.
+        Whereas they have anti-aliased clipping regions, Skia only has 1-bit
+        regions. (Which is technically more correct, but somewhat unhelpful
+        for us.) Instead, with Skia we use a layer and collect all the
+        clipping paths in effect. When the state is popped, we paint
+        transparency outside the clipping paths and merge the layer down.
+
+        This appears to cause rounded borders to look a little thin, which is
+        addressed in this patch.
+
+        This is well covered by existing tests but will require new baselines
+        in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31778
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-12-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7441571> Hardware-backed layers are skipped when printing
+        
+        When printing, set the PaintBehaviorFlattenCompositingLayers flag so that compositing layers
+        paint. This also causes 3D transforms to be flattened to 2D.
+
+        Test: printing/compositing-layer-printing.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix up some issues in my SVGListTraits change from yesterday.
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Not reviewed: chromium build fix.
+
+        Fix Chromium build break caused by moving of isDefaultPortForProtocol() and
+        portAllowed() into KURL.h/KURL.cpp.  Cloning code.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::portAllowed):
+
+2009-12-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Remove suppress highlight when restoring selected node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32152
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setDocument.selectNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+
+2009-12-04  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Gradient SVG animation demonstrates tearing at animation extremes
+        https://bugs.webkit.org/show_bug.cgi?id=11929
+
+        The focalPoint of a radial gradient is temporarly substracted by
+        the centralPoint, if the focalPoint is not in the radius of the
+        gradient. This is needed to calculate a new postion of the focalPoint
+        according to the specification. But the new focalPoint needs to be
+        moved by the centralPoint after this calculation, which is not the case
+        at the moment. This patch fixes this issue. It was also introduced a
+        deviation of maximal 0.2% for Cairo to get around the fixed point numbers
+        in Cairo.
+
+        W3C-SVG-1.1/pservers-grad-13-b needed an update. The missing adjustment
+        of the new focalPoint caused wrong results for the last three tests.
+
+        Test: svg/custom/radial-gradient-with-outstanding-focalPoint.svg
+
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+
+2009-12-04  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Do not use WebCore::String::String(const UChar*, int length) to convert
+        short v8 strings.
+
+        Plus added string traits.
+        https://bugs.webkit.org/show_bug.cgi?id=31415
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+
+2009-12-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: AX: buttons now extremely repetitive
+        https://bugs.webkit.org/show_bug.cgi?id=32164
+
+        Test: platform/mac/accessibility/button-shouldnot-have-axvalue.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isButton):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-12-04  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Check whether the right side of a string append is non-empty
+        https://bugs.webkit.org/show_bug.cgi?id=32151
+
+        Especially beneficial for CachedScript::script() method
+        which usually appends an empty string returned by flush()
+        to its m_script member. m_script is often hundreds of kbytes
+        which is duplated without reason.
+
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+
+2009-12-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Mail.app crashes when indenting table pasted from Numbers.app.
+        <rdar://problem/7209507>
+        https://bugs.webkit.org/show_bug.cgi?id=32166
+
+        Test: LayoutTests/editing/execCommand/indent-partial-table.html
+        
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Added test to verify that the end of the paragraph
+        after the selection has not been moved.
+
+2009-12-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32085
+        WebSocket should block the same ports that are blocked for resource loading
+
+        Test: websocket/tests/url-parsing.html
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+        Move isDefaultPortForProtocol() to KURL, because that's a better place for it (SecurityOrigin
+        is not even in WebCore/platform directory).
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setPort):
+        Updated for the new location of isDefaultPortForProtocol().
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::protocolIs): In an assertion, compare to "javascript" case-insensitively,
+        since the function doesn't require lower case input.
+        (WebCore::isDefaultPortForProtocol): Moved from SecurityOrigin.
+        (WebCore::portAllowed): Moved from ResourceHandle.
+        * platform/KURL.h:
+
+        * platform/network/ResourceHandle.cpp: (WebCore::ResourceHandle::create): Updated for the
+        new location of portAllowed().
+
+        * websockets/WebSocket.cpp: (WebCore::WebSocket::connect): Per the spec, raise a SECURITY_ERR
+        if trying to connect to a blocked port.
+
+2009-12-04  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebKit crashes when loading certain SVG images
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        Existing tests cover the change.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformDataPrivate::FontPlatformDataPrivate):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::family):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::italic):
+        (WebCore::FontPlatformData::smallCaps):
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+
+2009-12-04  Adam Treat  <atreat@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix wrong assert that was only working through sheer luck.
+        https://bugs.webkit.org/show_bug.cgi?id=32162
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create):
+
+2009-12-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow removing 'qrc' as a local security origin scheme
+
+        * page/SecurityOrigin.cpp:
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CollectionCache
+        https://bugs.webkit.org/show_bug.cgi?id=32109
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        struct name            - instantiated at: WebCore/'location'
+
+        struct CollectionCache - dom/Document.cpp:4029
+
+        * html/CollectionCache.h:
+
+2009-12-04  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a crashing bug in Geolocation when a watch is cleared from some callbacks. 
+        https://bugs.webkit.org/show_bug.cgi?id=32111
+
+        In Geolocation::GeoNotifier::timerFired, a JS callback may be invoked if a
+        fatal error was registered on this GeoNotifier or if this request has timed
+        out. If the request is a watch, and is cleared by a call to clearWatch in the
+        callback, the GeoNotifier object will be destroyed. We must therefore cache the
+        m_geolocation member to allow us to call Geolocation::fatalErrorOccurred or
+        Geolocation::requestTimedOut.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-clear-watch.html
+               fast/dom/Geolocation/timeout-clear-watch.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Cache the m_geolocation member before invoking the JS callback.
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for 2 classes of the platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name         - instantiated at: WebCore/'location'
+
+        class SharedTimer         - (its child class) workers/WorkerRunLoop.cpp:91
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new':
+
+        class TransformOperations - rendering/style/RenderStyle.h:1175
+
+        Noncopyable.h's include added to SharedTimer.h.
+
+        * platform/SharedTimer.h:
+        * platform/graphics/transforms/TransformOperations.h:
+
+2009-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK]Enable DNS prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=23846
+
+        Enable DNS prefetching.
+
+        Based on a patch by José Millán.
+
+        * platform/network/soup/DNSSoup.cpp:
+        (WebCore::prefetchDNS):
+
+2009-12-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the svg directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name           - instantiated at: WebCore/'location'
+
+        struct ResourceSet          - svg/graphics/SVGResource.cpp:148
+        class SVGFontData           - css/CSSFontFaceSource.cpp:156
+        class SVGDocumentExtensions - dom/Document.cpp:3962
+        class SVGViewSpec           - svg/SVGSVGElement.cpp:191
+
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGFontData.h:
+        * svg/SVGViewSpec.h:
+        * svg/graphics/SVGResource.cpp:
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: aria-activedescendant doesn't work as intended
+        https://bugs.webkit.org/show_bug.cgi?id=32100
+
+        Fixes a number of issues regarding the "tree" role and aria-activedescendant.
+        1. The indexes were being reported incorrectly by treeitems.
+        2. aria-activedescendant changes were not being sent to the containing item.
+        3. The tree's selected rows need to consult aria-activedescendant.
+        4. Since a tree changes what it returns as its children (it returns its rows)
+           the mac-specific array indexing methods need to correctly handle the tree case.
+
+        Tests: platform/mac/accessibility/aria-tree-activedescendant.html
+               platform/mac/accessibility/aria-tree-index-of-items.html
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::shouldFocusActiveDescendant):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-12-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the xml directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        Inherits the following class from Noncopyable because it is instantiated 
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        struct XMLHttpRequestStaticData - xml/XMLHttpRequest.cpp:134
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        class NodeTest                  - xml/XPathGrammar.y:258
+        class NodeSet                   - xml/XPathValue.cpp:52
+        struct EvaluationContext        - xml/XPathExpressionNode.cpp:40
+
+        * xml/XMLHttpRequest.cpp:
+        * xml/XPathExpressionNode.h:
+        * xml/XPathNodeSet.h:
+        * xml/XPathStep.h:
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        New History changes do not compile for Chromium/V8
+        https://bugs.webkit.org/show_bug.cgi?id=32148
+
+        Existing tests suffice (just trying to get code to compile).
+
+        * WebCore.gypi:
+        Added V8HistoryCustom.cpp and other missing files.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom handlers for History.pushState()/replaceState().
+        * bindings/v8/custom/V8HistoryCustom.cpp: Added.
+        Added custom handlers for History.pushState()/replaceState().
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::pushStateItem):
+        Stubbed out this routine for now - will implement in the future.
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<XBLBindingManager> Document::m_bindingManager;
+        https://bugs.webkit.org/show_bug.cgi?id=32147
+
+        The document actually owns the bindingManager.  That's what the code
+        should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::bindingManager):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<Tokenizer> Document::m_tokenizer;
+        https://bugs.webkit.org/show_bug.cgi?id=32145
+
+        The document actually owns the tokenizer.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+        (WebCore::Document::~Document):
+        (WebCore::Document::cancelParsing):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        * dom/Document.h:
+        (WebCore::Document::tokenizer):
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        OwnPtr<RenderArena> Document::m_renderArena;
+        https://bugs.webkit.org/show_bug.cgi?id=32146
+
+        The document owns the renderArena.  That's what the code should say.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Also, removed a redundant initialization
+        of the tokenizer that I missed in my previous patch.
+        (WebCore::Document::~Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        (WebCore::Document::renderArena):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolling back r51633 because it causes a chromium perf regression.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+
+2009-12-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The code should say that Document owns DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=32143
+
+        It's the truth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Document::docLoader):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        AX: VO just says "term" on many web sites
+        https://bugs.webkit.org/show_bug.cgi?id=32139
+
+        Test: platform/mac/accessibility/definition-list-term.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-12-03  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Implement WAI-ARIA scrollbar role and related property aria-orientation
+        https://bugs.webkit.org/show_bug.cgi?id=32126
+
+        Test: accessibility/aria-scrollbar-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isScrollbar):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::valueForRange):
+        (WebCore::AccessibilityRenderObject::orientation):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/7401617> Selection painting issue in hardware-
+        accelerated layers
+        which is another part of https://bugs.webkit.org/show_bug.cgi?id=23628
+        Fix selection painting to do container-relative repaints
+
+        Test: fast/repaint/block-selection-gap-in-composited-layer.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint): Compute and paint
+        gap rects in the coordinate space of the repaint container.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect): Added a
+        FIXME.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Map block selection gap rects from
+        the repaint container’s coordinate space to the view’s coordinate space
+        before adding them to the cached selection bounds.
+        (WebCore::RenderView::clearSelection): Changed to use
+        repaintRectangleInViewAndCompositedLayers() so that the selection rect
+        is invalidated in composited layers as well.
+
+2009-12-03  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 32066 - Add enable geolocation flag to WebCore::Settings for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=32066
+
+        Adds geolocationEnabled in Settings for runtime control of geolocaiton features. This defaults to ON
+        as it is intended as a development and testing aid, not a user control. To completely remove geolocation
+        from a given port, the compile time ENABLE_GEOLOCATION should still be used.
+        Adding placeholder GeolocationServiceChromium implementation, as this is required to allows
+        ENABLE_GEOLOCATION to be defined (in turn required for testing), even though this patch does not
+        make that the default just yet.
+
+        * WebCore.gypi:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Add new m_geolocationEnabled flag default value
+        (WebCore::Settings::setGeolocationEnabled): Setter for  m_geolocationEnabled flag
+        * page/Settings.h:
+        (WebCore::Settings::geolocationEnabled):  Add m_geolocationEnabled flag
+        * platform/chromium/GeolocationServiceChromium.cpp: Added.
+        (WebCore::GeolocationServiceChromium::GeolocationServiceChromium): Place holder GeolocationServiceChromium)
+        (WebCore::createGeolocationService): factory function, only required when ENABLED(GEOLOCATION) is true
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by John Sullivan.
+
+        SpinTracer: 349 spins in Mail at WebCore::Editor::advanceToNextMisspelling(bool)
+        <rdar://problem/7198592>
+        https://bugs.webkit.org/show_bug.cgi?id=32129
+
+        Fixed the way the next paragraph is calculated.
+        I've added a repro case in Safari and attached it to the Bugzilla bug.
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange): Changed the way we move to the
+        next paragraph in the loop.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No wonder editing WebCore.exp repeatedly while I worked on this patch never seemed to stick.
+
+        Long live our auto-generated overlords that I didn't know about...  
+
+        * WebCore.base.exp:
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r51627): 3 SVG tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=32117
+
+        Null checking Items in the SVGList is insufficient as items may
+        be floats, etc so add SVGListTraits::isNull and add appropriate
+        specializations.
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGListTypeOperations::isNull):
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGListTraits.h:
+        (WebCore::):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::documentDetached):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        No review - release build fix.
+
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::pushState):
+
+2009-12-03  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Multiple Undos removes the last posted comment and/or the ones before it.
+        <rdar://problem/6557066>
+        https://bugs.webkit.org/show_bug.cgi?id=32079
+        
+        The fix consists in preventing Undos and Redos to be applied to elements that
+        are no longer editable. We do not attempt to remove the commands from the queue.
+        It is a relatively simple fix that comes with a little extra overhead for the apply
+        and unapply methods where we are now performing the editability check.
+
+        Test: editing/undo/undo-indent-noneditable.html
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+
+2009-12-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7214236> and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the "onpopstate" attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from "scrollToAnchor()", combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of "loading a HistoryItem" to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix.
+        r51621 changed JS bindings only, broke v8's.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+
+2009-12-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Attributes and NamedNodeMaps aren't tracked correctly and may be prematurely garbage-collected.
+        https://bugs.webkit.org/show_bug.cgi?id=32094
+
+        Covered by existing test: LayoutTests/fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertNamedNodeMapToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-12-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Chromium: Add support for settings containing ":"
+
+        https://bugs.webkit.org/show_bug.cgi?id=32118
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection):
+
+2009-12-03  Rafael Antognolli  <antognolli@profusion.mobi>, Kenneth Christiansen <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        repaint events from outside the viewport aren't received
+        https://bugs.webkit.org/show_bug.cgi?id=32081
+
+        When using a tiled backing store for painting, you need to receive
+        event from outside the viewport. Setting the viewport to the size
+        of the contents is not an option if you want to make use of WebCore's
+        infrastructure for drawing scrollbars etc.
+
+        A new property, paintsEntireContents, has been introduced for the
+        above use-case. It is settable, as tiling will be optional for Qt,
+        and for the not yet upstreamed EFL port, there will be two different
+        views, where only one of them are tiled.
+
+        No change in behavior, so no new tests added.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setPaintsEntireContents):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::paintsEntireContents):
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * platform/graphics/SimpleFontData.h: Change #ifdef to define getNSFont() on Chrome/Mac .
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Provide forward declarations
+        of Core Text functions that are public on 10.6 but SPI on 10.5.
+
+2009-12-03  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Simplify the settings support in inspector controller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32076
+
+        Test: inspector/settings-set-get.html
+
+        * WebCore.Inspector.exp:
+        * bindings/js/JSInspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setting):
+        (WebCore::InspectorController::setSetting):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::attachWindow):
+        (WebCore::InspectorController::setAttachedWindowHeight):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showWindow):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setting):
+        (WebCore::InspectorFrontendHost::setSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting):
+        (WebCore::EmptyInspectorClient::storeSetting):
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] notifyHistoryItemChanged() should pass a pointer to the HistoryItem that changed.
+        https://bugs.webkit.org/show_bug.cgi?id=31915
+
+        No change in functionality so no new tests required.
+
+        * history/HistoryItem.cpp:
+        (WebCore::defaultNotifyHistoryItemChanged): Update this function to pass the HistoryItem that is being changed.
+        (WebCore::HistoryItem::setAlternateTitle): Update call to notifyHistoryItemChanged to include the new parameter.
+        (WebCore::HistoryItem::setURLString): ditto.
+        (WebCore::HistoryItem::setOriginalURLString): ditto.
+        (WebCore::HistoryItem::setReferrer): ditto.
+        (WebCore::HistoryItem::setTitle): ditto.
+        (WebCore::HistoryItem::setTarget): ditto.
+        (WebCore::HistoryItem::setDocumentState): On Android, add a call to notifyHistoryItemChanged. See bug for a discussion of why this is needed.
+        (WebCore::HistoryItem::clearDocumentState): ditto.
+        (WebCore::HistoryItem::setIsTargetItem): ditto.
+        (WebCore::HistoryItem::addChildItem): ditto.
+        (WebCore::HistoryItem::setFormInfoFromRequest): ditto.
+        * history/HistoryItem.h: Update signature of notifyHistoryItemChanged.
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] The FrameLoaderClient is unaware of BackForwardList changes.
+        https://bugs.webkit.org/show_bug.cgi?id=31914
+
+        This change adds three new methods on the FrameLoaderClient interface to receive notifications when the BackForwardList changes.
+
+        No new tests required. Functionality on all platforms upstream remains the same. Android is the first platform to make use of these callbacks.
+
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Execute the callback.
+        (WebCore::BackForwardList::goBack): ditto.
+        (WebCore::BackForwardList::goForward): ditto.
+        (WebCore::BackForwardList::goToItem): ditto.
+        (WebCore::BackForwardList::setCapacity): dito.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidAddBackForwardItem): Add an empty implementation for the callback that does nothing.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidRemoveBackForwardItem): ditto.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeBackForwardIndex): ditto.
+        * loader/FrameLoaderClient.h:
+
+2009-12-03  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Brady Eidson.
+
+        [Android] Upstream WebCore/history/android: Require some platform specific state attached to HistoryItem.
+        https://bugs.webkit.org/show_bug.cgi?id=31913
+
+        Android stores information such as the zoom scale factor and bridge back to the Java counterpart with HistoryItem.
+
+        No new tests required as this is Android specific code.
+
+        * history/HistoryItem.h: Add Android specific member data to HistoryItem.
+        * history/android: Added.
+        * history/android/AndroidWebHistoryBridge.h: Added.
+        * history/android/HistoryItemAndroid.cpp: Added, provides implementation for Android specific member functions in HistoryItem.
+        (WebCore::HistoryItem::bridge): Added.
+        (WebCore::HistoryItem::setBridge): Added.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        NULL ptr in SVGPathSegList::getPathSegAtLength()
+        https://bugs.webkit.org/show_bug.cgi?id=30313
+
+        Add exception checks to SVGPathSegList's implementation to catch (and propagate) exceptions.
+        Add null checks to SVGList's content manipulation functions to prevent
+        null values from entering the list in the first place.
+
+        Test: svg/dom/svgpath-out-of-bounds-getPathSeg.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::initialize):
+        (WebCore::SVGList::insertItemBefore):
+        (WebCore::SVGList::replaceItem):
+        (WebCore::SVGList::appendItem):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getPathSegAtLength):
+        * svg/SVGPathElement.h:
+        * svg/SVGPathElement.idl:
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::getPathSegAtLength):
+        (WebCore::SVGPathSegList::toPathData):
+        (WebCore::SVGPathSegList::createAnimated):
+        * svg/SVGPathSegList.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Sanitize web fonts using the OTS library 
+        https://bugs.webkit.org/show_bug.cgi?id=31106
+
+        Add support for OpenType sanitizer (OTS). It parses OpenType files (from @font-face)
+        and attempts to validate and sanitize them. We hope this reduces the attack surface
+        of the system font libraries.
+
+        * WebCore.gyp/WebCore.gyp: Added dependency to (chromium_src_dir)/third_party/ots/ library.
+        * WebCore.gypi: Added new files below.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Validate and transcode a web font.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp: Ditto.
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/opentype/OpenTypeSanitizer.cpp: Added.
+        (WebCore::OpenTypeSanitizer::sanitize):
+        * platform/graphics/opentype/OpenTypeSanitizer.h: Added.
+        (WebCore::OpenTypeSanitizer::OpenTypeSanitizer):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Web Inspector frontend heap allocates ScriptFunctionCall which is unsafe
+        https://bugs.webkit.org/show_bug.cgi?id=32098
+
+        Fix is simply to make the ScriptFunctionCall stack allocated as nature intended.
+        Doing this required adding an appendArgument(char*) to ScriptFunctionCall so
+        that an explicit String cast would not be necessary.
+
+        To prevent something like this happening again in future i've added private
+        operator new implementations to ScriptFunctionCall making this type of mistake
+        produce errors when compiling.
+
+        Test case: Inspector tests now pass with GC on every alloc enabled.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        (WebCore::ScriptFunctionCall::operator new):
+        (WebCore::ScriptFunctionCall::operator new[]):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage):
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::setChildNodes):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        (WebCore::InspectorFrontend::childNodeInserted):
+        (WebCore::InspectorFrontend::childNodeRemoved):
+        (WebCore::InspectorFrontend::attributesUpdated):
+        (WebCore::InspectorFrontend::didRemoveNode):
+        (WebCore::InspectorFrontend::didGetChildNodes):
+        (WebCore::InspectorFrontend::didApplyDomChange):
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        (WebCore::InspectorFrontend::didGetCookies):
+        (WebCore::InspectorFrontend::didDispatchOnInjectedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+
+2009-12-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32072, clean up invalid @-rule error handling so that we
+        pass more CSS test suite stuff.  Make the grammar stop enforcing the ordering of @namespace vs.
+        @variables vs. @import.  Just let the parser handle that instead.  This simplifies the grammar and
+        makes error handling deal with more cases correctly.
+
+        Added fast/css/namespaces/namespaces-invalid-at-rules.xml
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseRule):
+        (WebCore::CSSParser::createCharsetRule):
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::addNamespace):
+        (WebCore::CSSParser::createVariablesRule):
+        * css/CSSParser.h:
+
+2009-12-02  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Safari/Chromium for Windows fails to load CJK WebFonts
+        https://bugs.webkit.org/show_bug.cgi?id=31804
+        
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameAndActivateFont): Load a remote font even if the font has 2 or more faces.
+
+2009-12-02  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium: Need tickmarks in scrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=32069
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumMac.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm: Added.
+
+2009-11-13  Timothy Hatcher  <timothy@apple.com>
+
+        Expose a function to set the value of an input element on behalf of the user.
+        This function will dispatch the change event so the page is notified when autofill
+        happens. Also dispatch a change event when a select element is changed by autofill.
+
+        <rdar://problem/6760590> Would like a way to detect a login form AutoFill from JavaScript
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Added the DOMHTMLInputElementPrivate.h header.
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Call setSelectedIndexByUser instead so
+        a change event is fired. This method is called by Safari autofill.
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Use dispatchFormControlChangeEvent instead
+        of dispatching the change event directly to be consistent.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLInputElement::setValueForUser): Added. Calls setValue with the sendChangeEvent
+        (WebCore::HTMLInputElement::setValue): Added the optional sendChangeEvent argument. Mimics setChecked.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added setValueForUser for non-JS languages.
+        * html/InputElement.h: Added setValueForUser.
+
+2009-12-02  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM tree selection disappears upon page refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31142
+
+        Test: inspector/elements-panel-selection-on-refresh.html
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::pushNodeByPathToFrontend):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        (WebCore::InspectorController::resetScriptObjects):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForPath):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectDefaultNode):
+        (WebInspector.ElementsPanel.prototype.setDocument.selectLastSelectedNode):
+        (WebInspector.ElementsPanel.prototype.setDocument):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeByPathToFrontend):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32045, make sure escape sequences work with
+        all the @-rules we support.  When escape sequences are present, the lexical scanner
+        just returns a generic token name: ATKEYWORD.  We have to process the escape sequences
+        and then recheck against the rules we support with the final processed name.  If we
+        find a match, we mutate the token value to the appropriate rule name token, e.g.,
+        NAMESPACE_SYM.
+
+        Added fast/css/namespaces/namespaces-escapes.xml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::recheckAtKeyword):
+        (WebCore::CSSParser::text):
+        * css/CSSParser.h:
+
+2009-12-02  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.:w
+
+        Allow to skip thread checks when accessing DOMDataStore for processes
+        which run V8 in single thread mode.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Should be covered by buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMDataStore):
+        (WebCore::enableFasterDOMStoreAccess):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        * bindings/v8/V8DOMMap.h:
+
+2009-12-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Code clean up: remove ScriptObjectQuarantine.* as a whole.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32060
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/js/ScriptObjectQuarantine.h: Removed.
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::quarantineValue):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp: Removed.
+        * bindings/v8/ScriptObjectQuarantine.h: Removed.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::quarantineValue):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+
+2009-12-02  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket handshake check query component of URL
+        https://bugs.webkit.org/show_bug.cgi?id=31617
+
+        Tests: websocket/tests/url-with-credential.html
+               websocket/tests/url-with-empty-query.html
+               websocket/tests/url-with-fragment.html
+               websocket/tests/url-with-query-for-no-query.html
+               websocket/tests/url-with-query.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): returns a null if query is not specified and returns an empty if query is specified but empty.
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::resourceName): added. add query component to path if specified.
+        (WebCore::WebSocketHandshake::clientLocation):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+
+2009-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Incorrect code in WebGLRenderingContext.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32046
+
+        Fix incorrect code that happened to work. != has higher precendence than &.
+        The simplest fix is to remove the "!= 0" which violates WebKit style
+        guidelines anyway.
+
+        Also added periods to few comments in the same function.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+
+2009-12-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change [Reflect] to [ConvertNullToNullString, Reflect] for min, max,
+        pattern and step attributes of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=31708
+
+        * html/HTMLInputElement.idl:
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: implement support for ARIA drag and drop
+        https://bugs.webkit.org/show_bug.cgi?id=32007
+
+        Test: platform/mac/accessibility/aria-drag-drop.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIADropping):
+        (WebCore::AccessibilityObject::supportsARIADragging):
+        (WebCore::AccessibilityObject::isARIAGrabbed):
+        (WebCore::AccessibilityObject::setARIAGrabbed):
+        (WebCore::AccessibilityObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::supportsARIADropping):
+        (WebCore::AccessibilityRenderObject::supportsARIADragging):
+        (WebCore::AccessibilityRenderObject::isARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::setARIAGrabbed):
+        (WebCore::AccessibilityRenderObject::determineARIADropEffects):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        * html/HTMLAttributeNames.in:
+
+2009-12-01  Adam Barth  <abarth@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Unreviewed port of @sandbox to V8.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+
+2009-12-01  Patrik Persson  <patrik.j.persson@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        Implement HTML5 sandbox attribute for iframes.
+        http://www.w3.org/TR/html5/text-level-semantics.html#attr-iframe-sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=21288
+
+        Tests: fast/frames/sandboxed-iframe-attribute-parsing.html
+               fast/frames/sandboxed-iframe-forms.html
+               fast/frames/sandboxed-iframe-navigation-allowed.html
+               fast/frames/sandboxed-iframe-navigation-parent.html
+               fast/frames/sandboxed-iframe-navigation-targetlink.html
+               fast/frames/sandboxed-iframe-navigation-windowopen.html
+               fast/frames/sandboxed-iframe-plugins.html
+               fast/frames/sandboxed-iframe-scripting.html
+               fast/frames/sandboxed-iframe-storage.html
+               http/tests/security/sandboxed-iframe-document-cookie.html
+               http/tests/security/sandboxed-iframe-modify-self.html
+               http/tests/security/xss-DENIED-sandboxed-iframe.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html
+               http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html
+
+        * bindings/js/JSDOMWindowCustom.cpp: sandboxing navigation
+        (WebCore::createWindow):
+        * bindings/js/ScriptController.cpp: sandboxing scripts
+        (WebCore::ScriptController::isEnabled):
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::cookie): raise exception when accessed from sandbox
+        (WebCore::Document::setCookie): raise exception when accessed from sandbox
+        (WebCore::Document::initSecurityContext): updae sandbox status
+        (WebCore::Document::updateSandboxFlags):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * html/HTMLAppletElement.cpp: sandboxing applets
+        (WebCore::HTMLAppletElement::createRenderer):
+        (WebCore::HTMLAppletElement::renderWidgetForJSBindings):
+        (WebCore::HTMLAppletElement::canEmbedJava):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLFrameOwnerElement.cpp: management of sandbox flags as stated in attribute
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        (WebCore::HTMLFrameOwnerElement::setSandboxFlags):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::sandboxFlags):
+        * html/HTMLIFrameElement.cpp: sandbox attribute parsing
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+        * html/HTMLIFrameElement.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getCookies):
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::passesAccessControlCheck):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::submitForm): sandboxing forms
+        (WebCore::FrameLoader::requestObject): sandboxing plugins
+        (WebCore::FrameLoader::shouldAllowNavigation): sandboxing navigation
+        (WebCore::FrameLoader::updateSandboxFlags): propagation of sandbox flags
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::ownerElementSandboxFlagsChanged):
+        (WebCore::FrameLoader::isSandboxed):
+        (WebCore::FrameLoader::sandboxFlags):
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/DOMWindow.cpp: disable storage and databases in sandboxed frames
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        (WebCore::DOMWindow::openDatabase):
+        * page/SecurityOrigin.cpp: added sandboxing status
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::setSandboxFlags):
+        (WebCore::SecurityOrigin::isSandboxed):
+        (WebCore::SecurityOrigin::canAccessDatabase):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-12-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Kilzer.
+
+        ARIA: support a way to create a static text object
+        https://bugs.webkit.org/show_bug.cgi?id=32030
+
+        Test: accessibility/aria-text-role.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::stringValue):
+        (WebCore::AccessibilityRenderObject::isDescendantOfBarrenParent):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        Add SVG animation test framework with 'snapshot' functionality
+        https://bugs.webkit.org/show_bug.cgi?id=31897
+
+        Add 'sampleSVGAnimationForElementAtTime' method to the LayoutTestController,
+        for the use within the new SVG animation test framework (LayoutTests/svg/animations/)
+
+        layoutTestController.sampleAnimationAtTime(<svg animation id>, <absolute time>, <svg element id>);
+        to sample a svg animateMotion/animateColor/animate/set element at certain times.
+
+        After the desired SVG animation starts and calling the method above, it's immediately forwarded to
+        the desired sampling time. After JS returns from the 'sampleSVGAnimationForElementAtTime' method
+        a callback is fired used to sample the animation value at the target time. It's modelled similar
+        to the CSS animation/transition testing framework, inspired by
+        LayoutTests/animations/animation-test-helpers.js.
+
+        Though it has been extended to integrate within the fast/js/js-test-* framework, that's used for
+        the SVG dynamic-updates tests, to simplify test creation, by utilizing script-tests/* only.
+
+        Adding a simple testcase testing the DRT methods, it will soon be extended to test animVal/baseVal
+        interaction, while animating.
+
+        Test: svg/animations/animVal-basics.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::sampleAnimationAtTime):
+        * svg/SVGDocumentExtensions.h:
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::SMILTimeContainer):
+        (WebCore::SMILTimeContainer::sampleAnimationAtTime):
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * svg/animation/SMILTimeContainer.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add convenience methods to Element and QualifiedName that take
+        char* instead of AtomicString, in preparation for removing the
+        implicit conversion between the two types (30187).
+        https://bugs.webkit.org/show_bug.cgi?id=31749
+
+        * dom/Element.cpp:
+        (WebCore::Element::setCStringAttribute):  Equivalent to setAttribute.
+        * dom/Element.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::init):  Shared impl of both constructors
+        (WebCore::QualifiedName::QualifiedName):  New c'tor taking char*.
+        * dom/QualifiedName.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::CaseFoldingCStringTranslator):  Enables lookup by C string
+        (WebCore::HTTPHeaderMap::get):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::contains):  New variant that takes C string
+        (WebCore::HTTPHeaderMap::add):  New variant that takes C string
+        * platform/network/HTTPHeaderMap.h:
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):  Use symbolic names for headers
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):  New variant that takes C string
+        * platform/network/ResourceResponseBase.h:
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/CredentialStorageCFNet.cpp: Include RetainPtr.h.
+
+2009-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32036
+        Implement CredentialStorage::getFromPersistentStorage for CFNetwork
+
+        * platform/network/cf/CredentialStorageCFNet.cpp:
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+
+2009-12-01  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32001
+
+        Added missing localized strings (that I left out of the patch for bug #21554):
+        %d × %d pixels
+        %d × %d pixels (Natural: %d × %d pixels)
+
+        Also, changed formatting of these stings to conform with existing ones (added
+        a space on both sides of the multiply sign).
+
+        * English.lproj/localizedStrings.js: Added stings.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode):
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for bug 32032, empty namespaces should be allowed in @namespace directives in CSS.
+
+        Added fast/css/namespaces/namespaces-empty.xml
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addNamespace):
+        (WebCore::CSSStyleSheet::determineNamespace):
+
+2009-12-01  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Escape key in the Search Field should be more User Friendly
+        https://bugs.webkit.org/show_bug.cgi?id=32005
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): add mousedown listener on the search field
+        (WebInspector.searchFieldManualFocus): user clicked to focus on the search field
+        (WebInspector.searchKeyDown): handle escape
+
+2009-12-01  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by David Kilzer.
+
+        @namespace directives need to use "maybe_space" in the "maybe_ns_prefix" portion of the grammar to match
+        the spec.  Not doing so prevent comments from being used immmediately after the namespace prefix.
+
+        Added fast/css/namespaces-comments.xml
+
+        * css/CSSGrammar.y:
+
+2009-12-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Reloading WebInspector from context menu is closing it instead of reloading.
+        https://bugs.webkit.org/show_bug.cgi?id=32004
+
+        When reloading WebInspector, don't delete its m_page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+
+2009-12-01  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adds V8 bindings for Geolocation.
+        https://bugs.webkit.org/show_bug.cgi?id=30206
+
+        Also adds Geolocation files to Chrome build files.
+
+        * WebCore.gyp/WebCore.gyp: Modified. Corrects list of Geolocation IDL files.
+        * WebCore.gypi: Modified. Adds Geolocation files.
+        * bindings/v8/DOMObjectsInclude.h: Modified. Adds Geolocation includes.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified. Adds Geolocation files.
+        * bindings/v8/V8Index.cpp: Modified. Includes Geolocation generated headers.
+        * bindings/v8/V8Index.h: Modified. Adds Geolocation types to DOM_OBJECT_TYPES.
+        * bindings/v8/custom/V8CoordinatesCustom.cpp: Added. Handles optional properties.
+        * bindings/v8/custom/V8CustomBinding.h: Modified. Declares callbacks and getters.
+        * bindings/v8/custom/V8CustomPositionCallback.cpp: Added.
+        (WebCore::V8CustomPositionCallback::V8CustomPositionCallback): Added. Constructor.
+        (WebCore::V8CustomPositionCallback::~V8CustomPositionCallback): Added. Destructor.
+        (WebCore::V8CustomPositionCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionCallback.h: Added.
+        (WebCore::V8CustomPositionCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.cpp: Added.
+        (WebCore::V8CustomPositionErrorCallback::V8CustomPositionErrorCallback): Added. Constructor.
+        (WebCore::V8CustomPositionErrorCallback::~V8CustomPositionErrorCallback): Added. Destructor.
+        (WebCore::V8CustomPositionErrorCallback::handleEvent): Added. Invokes callback.
+        * bindings/v8/custom/V8CustomPositionErrorCallback.h: Added.
+        (WebCore::V8CustomPositionErrorCallback::create): Added. Factory method.
+        * bindings/v8/custom/V8GeolocationCustom.cpp: Added.
+        (WebCore::throwTypeMismatchException): Added. Throws a type mismatch error.
+        (WebCore::createPositionCallback): Added. Handles type checking for successCallback argument.
+        (WebCore::createPositionErrorCallback): Added. Handles type checking for errorCallback argument.
+        (WebCore::createPositionOptions): Added. Handles type checking for positionOptions argument.
+
+2009-12-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide a way to get ScriptState for the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32020
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::mainWorldScriptState):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromPage):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed mallocs to fastMallocs and frees to fastFrees in GraphicsContext3D. Also added error returns
+        https://bugs.webkit.org/show_bug.cgi?id=30778
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::imageToTexture):
+
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated HTMLCanvasElement to accept "experimental-webgl" as the context name.
+        https://bugs.webkit.org/show_bug.cgi?id=31672
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+
+2009-12-01  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Not reviewed: chromium build fix, added missing import.
+
+        * inspector/InspectorFrontendHost.cpp:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build via unexcluding generated files from
+        project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Stop copying IDL files in to the WebCore framework wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build by making the Xcode project compatible with Xcode 2.4.
+
+        This was probably broken by hand-editing the project file as Xcode itself
+        knows how to keep project files to a backwards-compatible subset of its format.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-12-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: windows build fix (bad vcproj in r51528).
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-27  Pavel Feldman  <pfeldman@dhcp-172-28-174-220.spb.corp.google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Split InspectorBackend into three parts: backend,
+        injected script host and frontend host.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31888
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInspectorBackendCustom.cpp: Removed.
+        * bindings/js/JSInspectorFrontendHostCustom.cpp: Added.
+        (WebCore::JSInspectorFrontendHost::search):
+        (WebCore::JSInspectorFrontendHost::setting):
+        (WebCore::JSInspectorFrontendHost::setSetting):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObject.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp: Removed.
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InjectedScriptHost.cpp: Added.
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::copyText):
+        (WebCore::InjectedScriptHost::nodeForId):
+        (WebCore::InjectedScriptHost::wrapObject):
+        (WebCore::InjectedScriptHost::unwrapObject):
+        (WebCore::InjectedScriptHost::pushNodePathToFrontend):
+        (WebCore::InjectedScriptHost::addNodesToSearchResult):
+        (WebCore::InjectedScriptHost::currentCallFrame):
+        (WebCore::InjectedScriptHost::databaseForId):
+        (WebCore::InjectedScriptHost::selectDatabase):
+        (WebCore::InjectedScriptHost::selectDOMStorage):
+        (WebCore::InjectedScriptHost::reportDidDispatchOnInjectedScript):
+        (WebCore::InjectedScriptHost::inspectorDOMAgent):
+        (WebCore::InjectedScriptHost::inspectorFrontend):
+        * inspector/InjectedScriptHost.h: Added.
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorController):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptHost.idl: Added.
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::InspectorBackend):
+        (WebCore::InspectorBackend::storeLastActivePanel):
+        (WebCore::InspectorBackend::toggleNodeSearch):
+        (WebCore::InspectorBackend::resourceTrackingEnabled):
+        (WebCore::InspectorBackend::debuggerEnabled):
+        (WebCore::InspectorBackend::enableDebugger):
+        (WebCore::InspectorBackend::disableDebugger):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        (WebCore::InspectorBackend::removeBreakpoint):
+        (WebCore::InspectorBackend::pauseInDebugger):
+        (WebCore::InspectorBackend::resumeDebugger):
+        (WebCore::InspectorBackend::stepOverStatementInDebugger):
+        (WebCore::InspectorBackend::stepIntoStatementInDebugger):
+        (WebCore::InspectorBackend::stepOutOfFunctionInDebugger):
+        (WebCore::InspectorBackend::pauseOnExceptions):
+        (WebCore::InspectorBackend::setPauseOnExceptions):
+        (WebCore::InspectorBackend::profilerEnabled):
+        (WebCore::InspectorBackend::enableProfiler):
+        (WebCore::InspectorBackend::disableProfiler):
+        (WebCore::InspectorBackend::startProfiling):
+        (WebCore::InspectorBackend::stopProfiling):
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        (WebCore::InspectorBackend::currentCallFrame):
+        (WebCore::InspectorBackend::highlightDOMNode):
+        (WebCore::InspectorBackend::hideDOMNodeHighlight):
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        (WebCore::InspectorBackend::nodeForId):
+        * inspector/InspectorBackend.h:
+        (WebCore::InspectorBackend::create):
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorFrontendHost):
+        (WebCore::InspectorController::injectedScriptHost):
+        * inspector/InspectorFrontendHost.cpp: Added.
+        (WebCore::InspectorFrontendHost::InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::~InspectorFrontendHost):
+        (WebCore::InspectorFrontendHost::loaded):
+        (WebCore::InspectorFrontendHost::attach):
+        (WebCore::InspectorFrontendHost::detach):
+        (WebCore::InspectorFrontendHost::closeWindow):
+        (WebCore::InspectorFrontendHost::windowUnloading):
+        (WebCore::InspectorFrontendHost::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendHost::moveWindowBy):
+        (WebCore::InspectorFrontendHost::localizedStringsURL):
+        (WebCore::InspectorFrontendHost::hiddenPanels):
+        (WebCore::InspectorFrontendHost::platform):
+        (WebCore::InspectorFrontendHost::port):
+        (WebCore::InspectorFrontendHost::addResourceSourceToFrame):
+        (WebCore::InspectorFrontendHost::addSourceToFrame):
+        * inspector/InspectorFrontendHost.h: Added.
+        (WebCore::InspectorFrontendHost::create):
+        (WebCore::InspectorFrontendHost::inspectorController):
+        (WebCore::InspectorFrontendHost::disconnectController):
+        * inspector/InspectorFrontendHost.idl: Added.
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.getCallFrames):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._copy):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._window):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/InspectorBackendStub.js: Added.
+        (.WebInspector.InspectorBackendStub):
+        (.WebInspector.InspectorBackendStub.prototype.wrapCallback):
+        (.WebInspector.InspectorBackendStub.prototype.platform):
+        (.WebInspector.InspectorBackendStub.prototype.port):
+        (.WebInspector.InspectorBackendStub.prototype.closeWindow):
+        (.WebInspector.InspectorBackendStub.prototype.attach):
+        (.WebInspector.InspectorBackendStub.prototype.detach):
+        (.WebInspector.InspectorBackendStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorBackendStub.prototype.clearMessages):
+        (.WebInspector.InspectorBackendStub.prototype.searchingForNode):
+        (.WebInspector.InspectorBackendStub.prototype.search):
+        (.WebInspector.InspectorBackendStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorBackendStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorBackendStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorBackendStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorBackendStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorBackendStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorBackendStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorBackendStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorBackendStub.prototype.loaded):
+        (.WebInspector.InspectorBackendStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorBackendStub.prototype.windowUnloading):
+        (.WebInspector.InspectorBackendStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorBackendStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorBackendStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.disableDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorBackendStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorBackendStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorBackendStub.prototype.enableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.disableProfiler):
+        (.WebInspector.InspectorBackendStub.prototype.startProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.stopProfiling):
+        (.WebInspector.InspectorBackendStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorBackendStub.prototype.getProfile):
+        (.WebInspector.InspectorBackendStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorBackendStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorBackendStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorBackendStub.prototype.setSetting):
+        (.WebInspector.InspectorBackendStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorBackendStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorBackendStub.prototype.setting):
+        * inspector/front-end/InspectorControllerStub.js:
+        * inspector/front-end/InspectorFrontendHostStub.js: Added.
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.platform):
+        (.WebInspector.InspectorFrontendHostStub.prototype.port):
+        (.WebInspector.InspectorFrontendHostStub.prototype.closeWindow):
+        (.WebInspector.InspectorFrontendHostStub.prototype.attach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.detach):
+        (.WebInspector.InspectorFrontendHostStub.prototype.search):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorFrontendHostStub.prototype.moveWindowBy):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loaded):
+        (.WebInspector.InspectorFrontendHostStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorFrontendHostStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setSetting):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setting):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        (WebInspector.ScriptsPanel.prototype._togglePauseOnExceptions):
+        (WebInspector.ScriptsPanel.prototype._togglePause):
+        (WebInspector.ScriptsPanel.prototype._stepOverClicked):
+        (WebInspector.ScriptsPanel.prototype._stepIntoClicked):
+        (WebInspector.ScriptsPanel.prototype._stepOutClicked):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype.performSearch.findSearchMatches):
+        (WebInspector.SourceView.prototype.performSearch):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.pendingDispatches.0.get platform):
+        (WebInspector.get port):
+        (WebInspector.set currentPanel):
+        (WebInspector._createPanels):
+        (WebInspector._loadPreferences):
+        (WebInspector.set attached):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (windowLoaded):
+        (WebInspector.windowUnload):
+        (WebInspector.close):
+        (WebInspector.toolbarDrag):
+        (WebInspector.UIString):
+
+2009-11-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        css2.1/t1205-c566-list-stl-00-e-ag.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23264
+        css2.1/t1205-c565-list-pos-00-b.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=23263
+
+        Ignore whitespaces after list markers.
+        Rendering of this was already done for the case where inside=false.
+        This fixes the rendering of inside=true case and calcInlinePrefWidths.
+
+        Test: fast/lists/calc-width-with-space.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-11-30  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51212
+
+        Fix scriptStateFromNode and ScriptStateFromPage to take DOMWrapperWorld
+        as the first argument.
+        Move mainThreadNormalWorld() to ScriptState.{h,cpp}.
+        Add debuggerWorld() and pluginWorld() in ScriptState.h.
+
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptState.h:
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+
+2009-11-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Can focus but not type into content editable block that contains only non-editable content.
+        <rdar://problem/5982901>
+        https://bugs.webkit.org/show_bug.cgi?id=31750
+        
+        The goal is to change the way we choose a visible position
+        after hit detection, by preferring a visually equivalent editable
+        position if available. By doing this, it is possible to add content
+        to an editable block that initially contains only non editable elements.
+
+        Test: editing/selection/mixed-editability-10.html
+
+        * WebCore.base.exp: Changed to match the new signature of downstream
+        and upstream in the Position class.
+        * dom/Position.cpp:
+        (WebCore::Position::atEditingBoundary): Added.
+        (WebCore::Position::upstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::downstream): Modified to allow to cross the boundary
+        between editable and non editable content if required.
+        (WebCore::Position::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        (WebCore::Position::getInlineBoxAndOffset): Modified to retrieve the inline box
+        to be used in calculating the caret rectangle.
+        * dom/Position.h:
+        (WebCore::Position::):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atEditingBoundary): Added.
+        (WebCore::PositionIterator::isCandidate): Modified to qualify as candidates positions
+        that are at the editability boundary.
+        * dom/PositionIterator.h:
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        (WebCore::lastEditablePositionBeforePositionInRoot): Modified to accept not only
+        descendants of the editable container, but the container itself.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Added logic to prefer an editable position,
+        if available.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::isAllCollapsibleWhitespace): Added.
+        * rendering/RenderText.h:
+
+2009-11-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add header needed for wx build.
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2009-11-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7424387> WebCore binary missing symbols when built for x86_64 from a machine that cannot run x86_64 binaries
+
+        The check for whether WTF_USE_PLUGIN_HOST_PROCESS is defined occurs under the native architecture of the build machine.
+        If that is 32-bit then WTF_USE_PLUGIN_HOST_PROCESS will not be defined.  We work around this by forcing the check to
+        be performed against the x86_64 architecture.
+
+        * DerivedSources.make:
+
+2009-11-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=32000 Crash in 
+        Safari caused by extreme column-gap and column-width values 
+        -and corresponding-
+        <rdar://problem/7425433>
+
+        Prevent desiredColumnCount from being less than 1 since it is used 
+        as a divisor.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::calcColumnWidth):
+
+2009-11-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31659
+        Connection must be closed in case of Web Socket handshake error
+
+        The network connection was closed, but the close event wasn't dispatched.
+
+        Tested by websocket/tests/handshake-error.html, which is un-skipped now.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::platformClose):
+        Call client didHandle() method. This looks strange in CFNetwork implementation, because
+        it's the client that asked to close the stream, so it shouldn't need the callback. It makes
+        more sense in cross-process implementation, because closing is async there.
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+
+        Remove the last uses of mainThreadCurrentWorld(), so the world is always obtained via
+        currentWorld().  Switch this to obtain the world from the ExecsState's lexical global
+        object instead.  Remove the call/construct/evaluate 'InWorld' methods, since these
+        are no longer necessary.
+
+        * WebCore.base.exp:
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::mainThreadNormalWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::updateDocument):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+
+2009-11-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        All HTML5 media element events should be regular events
+        https://bugs.webkit.org/show_bug.cgi?id=30513
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::noneSupported):
+        (WebCore::HTMLMediaElement::mediaEngineError):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Call scheduleEvent instead of scheduleProgressEvent.
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+            Call scheduleEvent instead of scheduleProgressEvent. Call renderer->updateFromElement
+            after scheduling a 'progress' event so the controller will update download
+            progress indicator.
+        * html/HTMLMediaElement.h:
+            Remove scheduleProgressEvent prototype.
+
+2009-11-30  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Wrong console output for Regexp escape sequence
+        https://bugs.webkit.org/show_bug.cgi?id=31538
+
+        Updated inspector/console-format.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement): style issues.
+        (WebInspector.ConsoleView.createFilterElement): style issues.
+        (WebInspector.ConsoleView): added _customFormatters table.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): style isses.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): style issues.
+        (WebInspector.ConsoleView.prototype._format): simplified delegation to formatter logic.
+        (WebInspector.ConsoleView.prototype._formatobject):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._printArray):
+        (WebInspector.ConsoleMessage.prototype._format): commented and broke down the algorithm into parts.
+        (WebInspector.ConsoleMessage.prototype._formatWithSubstitutionString.append): handle substitution string formatting.
+        (WebInspector.ConsoleMessage.prototype._formatIndividualValue): handling individual value formatting.
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js: simplified regex formatting.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyStringAsFragment): converted new RegExp to literal for performance benefits.
+        * inspector/front-end/utilities.js: 
+        (Element.prototype.hasStyleClass): update inaccurate comment.
+        (String.prototype.trimURL): converted new RegExp to literal for performance benefits.
+
+2009-11-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Clean up V8 bindings for CSSStyleDeclaration and CSSVariableDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=31895
+
+        No new tests. This is already covered by:
+                fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+                fast/dom/CSSStyleDeclaration/css-style-item.html
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionStringIndexedPropertyGetter):
+        (WebCore::setCollectionStringIndexedGetter):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds include of wtf/StdLibExtras.h for DEFINE_STATIC_LOCAL in V8 ScriptController.
+        https://bugs.webkit.org/show_bug.cgi?id=31932
+
+        Build fix only, no new tests.
+
+        * bindings/v8/ScriptController.cpp: Modified. Adds include of wtf/StdLibExtras.h.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PassOwnPtr include to ScriptExecutionContext.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31929
+
+        Build fix only, no new tests.
+
+        * dom/ScriptExecutionContext.h: Modified. Adds PassOwnPtr include.
+
+2009-11-30  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION (r49757): masking-mask-01-b.svg rendered incorrectly
+        [https://bugs.webkit.org/show_bug.cgi?id=31980]
+
+        It turns out, that we did not handle maskUnits="userSpaceOnUse"
+        correctly. We just need to move the context of the maskImage
+        if maskContentUnits="objectBoundingBox". The context gets scaled
+        on this unit combination, so we have to substract the position of
+        the targetRect. On userSpaceOnUse the position just depends on the
+        position of the mask element.
+        I added a test with some senseless and reasonable values for size
+        and postion of the mask and it's contents. I also used every
+        combination of maskUnits and maskContentUnits to be sure, that it
+        is fixed this time.
+
+        Test: svg/custom/mask-with-all-units.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31928
+
+        Build fix only, no new tests.
+
+        * page/DOMWindow.cpp: Modified. Adds ENABLE(INSPECTOR) guards around DOMWindow::inspectorTimelineAgent.
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds SHARED_WORKERS guards to V8 WorkerContextExecutionProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=31926
+
+        Build fix only, no new tests.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+
+2009-11-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Chrome::contentsSizeChanged() is called when the content size has not changed
+        https://bugs.webkit.org/show_bug.cgi?id=31978
+
+        Do not trigger contentsSizeChaned() is the new size is the same as the old one.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix some compiler warnings seen on QtWebKit/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31962
+
+        No new tests as there is no functional change.
+
+        * platform/network/ResourceHandle.h: Make destructor virtual as 
+        after r50772 ResourceHandle has virtual functions.
+
+        * plugins/mac/PluginPackageMac.cpp: 
+        (WebCore::PluginPackage::fetchInfo): Fix typo WTF is a namespace
+        not a label
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Add l to the format
+        specifier
+
+2009-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add new headers to sources list.
+
+        * GNUmakefile.am:
+
+2009-11-30  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Get context menu to work in QGraphicsView
+        
+        Flash expects the value in record.where to be the global position for
+        displaying the context menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31979
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds PLATFORM(CHROMIUM) guards around memory usage code in V8GCController.
+        https://bugs.webkit.org/show_bug.cgi?id=31925
+
+        This code uses ChromiumBridge and Chromium-specific constant values not
+        appropriate for other platforms such as Android.
+
+        Build fix only, no new tests.
+
+        * bindings/v8/V8GCController.cpp: Modified. Adds PLATFORM(CHROMIUM) around Chromium-specific code.
+
+2009-11-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix.
+
+        Correct draw signature used in ImageCairoWin.cpp.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        postMessage should serialize File objects
+        https://bugs.webkit.org/show_bug.cgi?id=31955
+
+        Update SerializedScriptValue to include support for
+        File objects in the serialized object graph.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::asString):
+
+2009-11-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Optimize the hierarchy rebuilding of compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31879
+        
+        When updating the compositing layer hierarchy, instead of removing all
+        child layers and then re-adding them one by one, build a vector of child
+        layers, and set them in one go.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::setChildren): New method that takes a Vector of child
+        GraphicsLayers.
+        
+        * platform/graphics/mac/GraphicsLayerCA.h: Override setChildren().
+        * platform/graphics/win/GraphicsLayerCACF.h: Ditto.
+        * platform/graphics/mac/GraphicsLayerCA.mm: 
+        (WebCore::GraphicsLayerCA::setChildren): Implement setChildren() to 
+        set the bit that notes that sublayers changed.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::GraphicsLayerCACF::setChildren): Implement setChildren() to 
+        udpate sublayers, with a note that this is not efficient.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        When updating compositing layers, use the faster updateLayerTreeGeometry() if
+        we know that no layer hierarchy changes are needed, and, at the root, use
+        the vector returned from rebuildCompositingLayerTree() to attach the root
+        layer.
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Changed to
+        collect child layers into Vectors of GraphicsLayers, which can be set as
+        layer children in one go.
+        (WebCore::RenderLayerCompositor::updateLayerTreeGeometry): Split out from
+        rebuildCompositingLayerTree() for simplicity, and called when we just need to
+        update layer geometry, without doing any reparenting.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31971
+
+        Updated comment to reflect latest XSSAuditor bindings.
+
+        No functionality was changed. So, no new tests.
+
+        * page/XSSAuditor.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31969
+
+        Removes unnecessary #include files.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSComputedStyleDeclaration.cpp: Removed include CachedImage.h, and
+        Pair.h
+        * css/CSSCursorImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSFontFaceSrcValue.cpp: Removed include Node.h
+        * css/CSSFontSelector.cpp: Removed include NodeList.h
+        * css/CSSGradientValue.cpp: Removed include GraphicsContext.h, ImageBuffer.h
+        * css/CSSImageValue.cpp: Removed include RenderStyle.h
+        * css/CSSImportRule.cpp: Removed include MediaList.h
+        * css/CSSMutableStyleDeclaration.cpp: Removed include CSSProperty.h
+        * css/CSSRule.cpp: Removed include CSSStyleSheet.h
+        * css/CSSStyleSelector.cpp: Removed include CSSFontFace.h,
+        CSSFontFaceSource.h, and CSSProperty.h
+        * page/EventSource.h: Removed include EventListener.h
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31965
+
+        Removed #include KeyframeList.h from CSSStyleSelector.h. Instead,
+        forward declared it.
+
+        As a side effect, we need to #include KeyframeList.h in
+        RenderLayerBacking.cpp.
+
+        No functionality was changed. So, no new tests.
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h: Removed #include KeyframeList.h
+        * rendering/RenderLayerBacking.cpp: Added #include KeyframeList.h
+
+2009-11-29  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Continue to search for matching node in the case where multiple nodes
+        have the same id.
+        https://bugs.webkit.org/show_bug.cgi?id=31428
+
+        Test: fast/dom/Element/id-in-node-list-index01.html
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31966
+
+        Removed #include RenderStyle.h from file KeyframeAnimation.h. Instead,
+        forward declared it.
+
+        No functionality was changed. So, no new tests.
+
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, fix change log entry date.
+
+        For some reason, bugzilla-tool did not update the date in the change
+        log entry for my last commit (r51468). So, this commit fixes the date
+        of that entry.
+
+2009-11-29  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31964
+
+        Removed #include StringImpl, StyleImage. Instead, forward declared them.
+        Also, we can substitute #include <wtf/PassRefPtr.h> for #include PlatformString.h,
+        since it seems we only really used it to include PassRefPtr.h.
+
+        No functionality was changed. So, no new tests.
+
+        * rendering/style/ContentData.h:
+
+2009-11-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the rendering and storage directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31906
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class SQLTransactionClient      - storage/DatabaseThread.cpp:45
+        class SQLTransactionCoordinator - storage/DatabaseThread.cpp:46
+        class OriginUsageRecord         - storage/OriginQuotaManager.cpp:66
+        class DatabaseTracker           - storage/DatabaseTracker.cpp:62
+        class ScrollbarTheme            - (its child class) rendering/RenderScrollbarTheme.cpp:35
+        class RenderSelectionInfoBase   - (its child class) rendering/RenderView.cpp:310
+        class RenderOverflow            - rendering/RenderBox.cpp:2846
+
+        Inherits the following classes from FastAllocBase because these are instantiated by 'new':
+
+        struct FillLayer                - css/CSSStyleSelector.cpp:197
+        struct ShadowData               - rendering/style/ShadowData.cpp:35
+        class CounterContent            - css/CSSStyleSelector.cpp:4111
+
+        * platform/ScrollbarTheme.h:
+        * rendering/RenderOverflow.h:
+        * rendering/RenderSelectionInfo.h:
+        * rendering/style/CounterContent.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/ShadowData.h:
+        * storage/DatabaseTracker.h:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLTransactionClient.h:
+        * storage/SQLTransactionCoordinator.h:
+
+2009-11-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium build fix introduced by r51428.
+
+        [Chromium] Ignore line-height CSS property for PushButton
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustButtonStyle):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed Chromium test fix by reverting r51413.
+
+        [v8] Do not check the thread when accessing DOMDataStore
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Unreviewed, comment fix.
+
+        Corrected misspelling of the word "implemented".
+
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-11-27  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31940
+
+        Makes the error messages more descriptive when we refuse to load an object/embed or
+        refuse to load from the document base URL.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject): Changed console message to be more descriptive.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto.
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Instead of generating negative identifiers for cached resources in
+        InspectorController and extending identifier type from 'unsigned long' to 'long
+        long' reuse progress tracker from the inspected page to generate those
+        identifiers. It guarantees that InspectorResources have unique ids since
+        all of them are generated by that progress tracker.
+
+        Added a couple new overloaded methods to Script* objects that accept
+        long and unsigned long arguments. These types of argumens have already
+        been passed as long long.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31921
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Use inspected page's ProgressTracker to generate unique identifiers for cached resources in InspectorController.
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::createCached):
+        * inspector/InspectorResource.h: Change InspectorResource identifier type from 'long long' to 'unsigned long'.
+        (WebCore::InspectorResource::create):
+        (WebCore::InspectorResource::identifier):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+
+2009-11-26  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Assertion failure in RenderBlock::positionForPointWithInlineChildren when running fast/inline/relative-positioned-overflow.html
+        https://bugs.webkit.org/show_bug.cgi?id=29966
+
+        When an empty inline element is clicked, the root inline box has
+        no leaf children. Use the renderer of a normal child instead.
+
+        This change resolves Windows port's assertion failure in a layout test.
+        Also, this fixes the behavior when a user drags the mouse from an
+        empty inline element to above texts.
+
+        Test: editing/selection/last-empty-inline.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+
+2009-11-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to push buttons on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31712
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=button> issue with Chromium/Windows
+        and Chromium/Linux.
+        
+        * rendering/RenderThemeChromiumSkia.cpp: Implement adjustButtonStyle() to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustButtonStyle().
+
+2009-11-26  Kinuko Yasuda  <kinuko@chromium.com>
+
+        Reviewed by Eric Seidel.
+
+        Remove the special charset meta tag in the clipboard so that
+        copy-and-paste with interchange breaklines/spaces works correctly
+        within WebKit.
+
+        No new tests.  Layout tests that involve copy-and-paste with
+        interchange breaklines (like editing/pasteboard/paste-line-endings-00?)
+        should pass on Mac/Chromium with this fix.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-11-26  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Eric Seidel.
+
+        Compile with QT_NO_WHEELEVENT defined.
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        No new tests as there is no functional change.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: Change the
+          path for GOwnPtr.h.
+        * platform/text/TextEncoding.cpp: Ditto.
+        * platform/text/gtk/TextCodecGtk.cpp: Ditto.
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Not reviewed. Build fix: revert r51421.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        This is a WebCore part of the fix that allows to view plugin
+        resources loaded by plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31832
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h: Remove unused DocumentLoader parameters from inspector methods.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::addLength): Update loading end time when new data are received.
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didFailToLoad): Notify InspectorController about the failure.
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+
+2009-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21554
+
+        Implements support for hovering over <img> src to display the height and width of that image
+        in a tooltip. Displays both the displayable and natural dimensions of the image.
+
+        Test: inspector/elements-img-tooltip.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.createTooltipForImageNode): Added.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle.callback):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.getPropertiesAsync): Added.
+        * inspector/front-end/inspector.js:
+        (WebInspector.linkifyURLAsNode): Added tooltipText argument.
+        (WebInspector.linkifyURL): Ditto.
+
+2009-11-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after drawPattern API change.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use an internal field instead of hidden property to speedup lookup
+        of entered isolated world.
+
+        Plus some inlinings.
+        https://bugs.webkit.org/show_bug.cgi?id=31884
+
+        Covered by layout tests + manual running of some benchmarks as
+        content scripts.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::setDOMWrapper):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+        (WebCore::V8IsolatedWorld::getGlobalObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Corrects build break on Windows.
+
+        Rename platform/text/qt/TextBoundaries.cpp to TextBoundariesQt.cpp since
+        platform/text/TextBoundaries.cpp was compiled instead when compiling with nmake.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBoundariesQt.cpp: Renamed from WebCore/platform/text/qt/TextBoundaries.cpp.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+
+2009-11-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not check if the thread is main or not when accessing DOMDataStore as currently in Chromium WebKit is used in main thread only.
+        https://bugs.webkit.org/show_bug.cgi?id=31877
+
+        Covered by layout tests and buildbots.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+
+2009-11-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Mac Plugins : Pass mouse position relative to the fake window
+        
+        When using off-screen rendering, we need to pass mouse events relative
+        to the fake window instead of the global position.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31794
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use QNetworkReply::rawHeaderPairs
+        https://bugs.webkit.org/show_bug.cgi?id=31826
+
+        The QNetworkReply is internally storing the HTTP headers
+        as a list of pairs. Currently we have to ask the QNetworkReply
+        to put all header names into a QStringList. Afterwards we will
+        iterate over this QStringList and ask the QNetworkReply to
+        give us the value for this header name. The current Qt implementation
+        is doing a linear to find the header value.
+
+        Use a new API to directly access the list of pairs and push
+        this into WebCore. This avoids doing some allocations and doing
+        linear searches from within a loop.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add Qt specific information of RenderPart
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        The WebCore::Widget of the RenderPart (RenderWidget) might be
+        backed with a platform widget. Print both the WebCore::Widget
+        and platform widget state. In the above bug we had a problem
+        that the WebCore::Widget was invisible but the QWidget was
+        visible.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Add special case for RenderPart
+
+2009-11-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Call Widget::setSelfVisible from hide/show
+        https://bugs.webkit.org/show_bug.cgi?id=31203
+
+        Call Widget::setSelfVisible from Widget::show and
+        Widget::hide and use isParentVisible to decide
+        if the widget should be shown. This way client
+        code can rely on isVisible.
+
+        Change PluginViewQt::show, PluginViewQt::hide to
+        call the base class as it is doing the right thing
+        now. Add an assert verify that platfomWidget and
+        platformPluginWidget are the same.
+
+        * manual-tests/qt/qtplugin.html: Modify manual test
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation of REQUEST_DEBUG debug code
+        https://bugs.webkit.org/show_bug.cgi?id=31850
+
+        In r47907 the single parameter KURL constructor to parse
+        from a WebCore::String was replaced with a two parameter
+        constructor. I think in this debug case parsing the urls
+        again is no problem and I have changed the code to use the
+        two parameter version.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+
+2009-11-26  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Avoid using JavaScript objects as context data
+        https://bugs.webkit.org/show_bug.cgi?id=31873
+
+        Change the context "data" from a JavaScript object holding the two properties type and value to
+        a string holding type and value separated by a comma.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        (WebCore::V8Proxy::setContextDebugId):
+        (WebCore::V8Proxy::contextDebugId):
+
+2009-11-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Implement canSetValueAttribute in the API, the clean-up part.
+        https://bugs.webkit.org/show_bug.cgi?id=31894
+
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Added RefCounted decl.
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Removed mis-refcountingness.
+
+2009-11-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Off-by-one error in index validation for drawElements and drawArrays
+        https://bugs.webkit.org/show_bug.cgi?id=31891
+
+        Fixed computation of number of elements for bound array objects.
+
+        Test: fast/canvas/webgl/index-validation.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+
+2009-11-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Update SharedScript to use eventNames() instead of EventNames()
+        https://bugs.webkit.org/show_bug.cgi?id=31890
+
+        * SharedScript/WebKitSharedScript.cpp:
+        (WebCore::LoadEventTask::performTask):
+
+2009-11-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, all through to m_qtMovie.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            Make all but the destructor private since MediaPlayer call through the media
+            engine interface.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+            Use handy new constants for QuickTime track types.
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+            New, closed caption support.
+        * platform/graphics/win/QTMovieWin.h:
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+            Deal with closed caption buttons.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::shouldRenderMediaControlPart):
+            New, don't ask the media engine if it has closed captions unless the Safari theme will
+            be able to render the button.
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+            New.
+        * rendering/RenderThemeWin.h:
+
+2009-11-25  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        MessagePorts always look remotely entangled even when closed.
+        https://bugs.webkit.org/show_bug.cgi?id=31698
+
+        Tests: Existing tests suffice, Chromium soak test passes now.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Removed kMessagePortEntangledPortIndex which is no longer used.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper):
+        Simplified GC code to reflect the Chromium MessagePort implementation
+        (locallyEntangledPort() always returns false).
+        (WebCore::GCEpilogueVisitor::visitDOMWrapper):
+        Cleaned up epilogue code to handle the case where the port gets closed
+        in mid-GC (due to the parent context being freed).
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::close):
+        Now sets the closed flag.
+        (WebCore::MessagePort::disentanglePorts):
+        Updated to use new isCloned() API instead of relying on isEntangled(), which was incorrect.
+        * dom/MessagePort.h:
+        Added a m_closed flag and updated isEntangled() to check it.
+        (WebCore::MessagePort::isEntangled):
+        Now returns false if the port has been closed.
+        (WebCore::MessagePort::isCloned):
+        Added new API to differentiate between cloned and closed ports (closed ports can still be passed to postMessage).
+
+2009-11-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crash of QtWebKit on any page with Flash when compiled with MinGW.
+
+        Fix inline assembly, don't dereference the function pointer twice.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+
+2009-11-22  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove the Referer header when redirecting to a non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31785
+
+        This makes Qt pass two tests introduced in r50226.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        The select elements do not reflect the actual choice the user makes.
+        https://bugs.webkit.org/show_bug.cgi?id=31831
+
+        Handle the drawing of the listboxes in Android code.
+
+        No new features, just fixing an Android problem. Existing layout tests are sufficient.
+
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::theme):
+        (WebCore::RenderThemeAndroid::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeAndroid::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeAndroid::adjustButtonStyle):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::adjustListboxStyle):
+        * platform/android/RenderThemeAndroid.h:
+
+2009-11-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Load InspectorResource mime type from CachedResource for 304 responses
+
+        For network libraries that do not merge cache data into 304 ResourceResponses,
+        the mime type for cached resources is unknown.
+        https://bugs.webkit.org/show_bug.cgi?id=31868
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::type):
+
+2009-11-25  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android is missing implementation of SSL Key generator functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31825
+
+        This change adds the PlatformBridge class to platform/android.
+        PlarformBridge is used to access the embedding layer for things
+        such as key generator, cookies, plugins, etc.
+
+        No new tests required, this is platform code.
+
+        * platform/android/PlatformBridge.h: Added.
+        * platform/android/SSLKeyGeneratorAndroid.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+
+2009-11-25  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] use gst_init_check() instead of gst_init()
+        https://bugs.webkit.org/show_bug.cgi?id=31864
+
+        Use gst_init_check() instead of gst_init() to prevent eventual
+        unexpected exit of the application.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+2009-11-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Some tests are crashing from time to time
+        https://bugs.webkit.org/show_bug.cgi?id=31866
+
+        Make sure we do not notify the client of a finished load, if the
+        load has been cancelled, or the client is gone.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-24  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Android] Upstream Android changes to WebCore/bridge/jni
+        https://bugs.webkit.org/show_bug.cgi?id=31824
+
+        No new tests required as no new functionality.
+
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass): Add calls to delete allocated references, to avoid potential leaks.
+        * bridge/jni/jni_instance.cpp: Add an Android include path.
+        * bridge/jni/jni_instance.h: Add getter/setter for JObjectWrapper::_instance and make the JavaInstance ctor and member variables protected. Both needed for the Android port, see bug for discussion.
+        (JSC::Bindings::JObjectWrapper::instance): Added.
+        (JSC::Bindings::JObjectWrapper::setInstance): Added.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod): Delete an allocated reference to avoid a potential leak.
+        * bridge/jni/jni_utility.h:
+        (JSC::Bindings::callJNIMethodV): Delete an allocated reference to avoid a potential leak.
+
+2009-11-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for classes of the plugins and rendering directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31827
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and no need to be copyable:
+
+        class/struct name               - instantiated at: WebCore/'location'
+
+        class PluginRequest             - plugins/PluginView.cpp:521
+        class PluginMainThreadScheduler - plugins/PluginMainThreadScheduler.cpp:34
+        class PluginDatabase            - plugins/PluginDatabase.cpp:50
+        struct MimeClassInfo            - plugins/PluginInfoStore.cpp:50
+        struct PluginInfo               - plugins/PluginInfoStore.cpp:40
+        class RenderArena               - dom/Document.cpp:1401
+        class RenderImageScaleData      - rendering/RenderImage.cpp:149
+        class TableLayout               - (its child class) rendering/RenderTable.cpp:82
+        struct ColumnInfo               - rendering/RenderBlock.cpp:3590
+        struct FloatingObject           - rendering/RenderBlock.cpp:2300
+        struct MaxMargin                - rendering/RenderBlock.cpp:4794
+        class RenderMarquee             - rendering/RenderLayer.cpp:3277
+
+        * plugins/PluginData.h:
+        * plugins/PluginDatabase.h:
+        * plugins/PluginMainThreadScheduler.h:
+        * plugins/PluginView.h:
+        * rendering/RenderArena.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMarquee.h:
+        * rendering/TableLayout.h:
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Initial implementation of WebKitSharedScript and SharedScriptContext
+        https://bugs.webkit.org/show_bug.cgi?id=31569
+
+        No new tests since there are no bindings yet (soon to come).
+
+        * DerivedSources.make: Add WebKitSharedScript and SharedScriptContext to a list of idl files.
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify WebKitSharedScriptRepository that document is detaching.
+        * dom/EventTarget.cpp: Add new casting methods, since the new types are EventTargets.
+        (WebCore::EventTarget::toWebKitSharedScript):
+        (WebCore::EventTarget::toSharedScriptContext):
+        * dom/EventTarget.h: Ditto
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::isSharedScriptContext): New virtual method, since there is a new type of context.
+
+        * SharedScript/SharedScriptContext.cpp: Added. Similar to WorkerContext, but w/o threading.
+        (WebCore::SharedScriptContext::SharedScriptContext):
+        (WebCore::SharedScriptContext::~SharedScriptContext):
+        (WebCore::SharedScriptContext::clearScript):
+        (WebCore::SharedScriptContext::virtualURL):
+        (WebCore::SharedScriptContext::virtualCompleteURL):
+        (WebCore::SharedScriptContext::reportException):
+        (WebCore::SharedScriptContext::addMessage):
+        (WebCore::SharedScriptContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::SharedScriptContext::scriptImported):
+        (WebCore::SharedScriptContext::matches):
+        (WebCore::SharedScriptContext::addToDocumentsList):
+        (WebCore::SharedScriptContext::destructionTimerFired):
+        (WebCore::SharedScriptContext::removeFromDocumentList):
+        (WebCore::SharedScriptContext::load):
+        (WebCore::SharedScriptContext::postTask):
+        (WebCore::SharedScriptContext::eventTargetData):
+        (WebCore::SharedScriptContext::ensureEventTargetData):
+        (WebCore::SharedScriptContext::scriptExecutionContext):
+        * SharedScript/SharedScriptContext.h: Added.
+        (WebCore::SharedScriptContext::create):
+        (WebCore::SharedScriptContext::isSharedScriptContext):
+        (WebCore::SharedScriptContext::userAgent):
+        (WebCore::SharedScriptContext::toSharedScriptContext):
+        (WebCore::SharedScriptContext::self):
+        (WebCore::SharedScriptContext::script):
+        (WebCore::SharedScriptContext::loaded):
+        (WebCore::SharedScriptContext::name):
+        (WebCore::SharedScriptContext::refEventTarget):
+        (WebCore::SharedScriptContext::derefEventTarget):
+        (WebCore::SharedScriptContext::refScriptExecutionContext):
+        (WebCore::SharedScriptContext::derefScriptExecutionContext):
+        * SharedScript/SharedScriptContext.idl: Added.
+
+        * SharedScript/SharedScriptController.h: 
+        Added. Empty implementation of a ScriptController, will come later as part of bindings. Needed to compile.
+
+        * SharedScript/WebKitSharedScript.cpp: Added. EventTarget-based DOM object.
+        (WebCore::WebKitSharedScript::WebKitSharedScript):
+        (WebCore::WebKitSharedScript::~WebKitSharedScript):
+        (WebCore::WebKitSharedScript::setContext):
+        (WebCore::LoadEventTask::create): Fires asynchronous 'load' event when underlying SharedScriptContext is initialized.
+        (WebCore::LoadEventTask::performTask):
+        (WebCore::LoadEventTask::LoadEventTask):
+        (WebCore::WebKitSharedScript::scheduleLoadEvent):
+        * SharedScript/WebKitSharedScript.h: Added.
+        (WebCore::WebKitSharedScript::create):
+        (WebCore::WebKitSharedScript::scriptExecutionContext):
+        (WebCore::WebKitSharedScript::toWebKitSharedScript):
+        (WebCore::WebKitSharedScript::context):
+        (WebCore::WebKitSharedScript::refEventTarget):
+        (WebCore::WebKitSharedScript::derefEventTarget):
+        (WebCore::WebKitSharedScript::eventTargetData):
+        (WebCore::WebKitSharedScript::ensureEventTargetData):
+        * SharedScript/WebKitSharedScript.idl: Added.
+
+        * SharedScript/WebKitSharedScriptRepository.cpp: Added. Implements a list of running SharedScriptContexts.
+        (WebCore::ScriptLoader::ScriptLoader): The helper class to load an initial script of SharedScriptContext.
+        (WebCore::ScriptLoader::load):
+        (WebCore::ScriptLoader::notifyFinished):
+        (WebCore::WebKitSharedScriptRepository::instance): Repository has a static global instance.
+        (WebCore::WebKitSharedScriptRepository::connect):
+        (WebCore::WebKitSharedScriptRepository::documentDetached): Called from Document::detach().
+        (WebCore::WebKitSharedScriptRepository::removeSharedScriptContext): Called from ~SharedScriptContext().
+        (WebCore::WebKitSharedScriptRepository::connectToSharedScript):
+        (WebCore::WebKitSharedScriptRepository::getSharedScriptContext):
+        * SharedScript/WebKitSharedScriptRepository.h: Added.
+        (WebCore::WebKitSharedScriptRepository::WebKitSharedScriptRepository):
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+        
+        This part of the checkin adds the Windows specific GraphicsLayer support files.
+        It provides the interface between GraphicsLayer and CACF. It also deals with
+        the compositing loop, and provides the plumbing to pass the root layer up to
+        WebView.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateRecursive):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/win/GraphicsLayerCACF.cpp: Added.
+        * platform/graphics/win/GraphicsLayerCACF.h: Added.
+        * platform/graphics/win/WKCACFContextFlusher.cpp: Added.
+        * platform/graphics/win/WKCACFContextFlusher.h: Added.
+        * platform/graphics/win/WKCACFContextFlusherWin.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.cpp: Added.
+        * platform/graphics/win/WKCACFLayer.h: Added.
+        * platform/graphics/win/WKCACFLayerWindow.cpp: Added.
+        * platform/graphics/win/WKCACFLayerWindow.h: Added.
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Do error checking of parameter to createShader
+        https://bugs.webkit.org/show_bug.cgi?id=31808
+
+        Test: fast/canvas/webgl/invalidPassedParams.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::createShader):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+
+2009-11-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Ignore line-height CSS property specified to a search field on
+        Windows and Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31820
+
+        LayoutTests/fast/forms/control-restrict-line-height.html checks that the
+        following controls should ignore line-height CSS property.
+         - <select>
+         - <input type=button>
+         - <input type=search>
+        This change addresses the <input type=search> issue with Chromium/Windows
+        and Chromium/Linux.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldStyle): Implement this to ignore line-height.
+        * rendering/RenderThemeChromiumSkia.h: Declare adjustSearchFieldStyle().
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Stylistic fix: indent the member var initialisation.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31848 - Remove uses of mainThreadCurrentWorld, and of currentWorld using a globalData.
+
+        These methods get the world from the global data rather than from an execstate.
+        If the current world is always read from an exec state then it can be read
+        from the global object, and world entry can become automagical, rather than
+        being explicitly set by an EnterDOMWrapperWorld.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::currentWorld):
+        (WebCore::DOMObjectWrapperMapFor):
+        (WebCore::hasCachedDOMObjectWrapper):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::hasCachedDOMNodeWrapper):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::cacheDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::createDOMNodeWrapper):
+        (WebCore::getDOMNodeWrapper):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        (WebCore::createWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Also, don't include the wrong one!
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Include the proper WKSI header.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Windows build fix.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Revert r51351 until a new WebKitSupportLibrary is available.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31844
+        SocketStreamHandleCFNet should support CONNECT proxy credentials
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/CredentialStorage.h:
+        * platform/network/mac/CredentialStorageMac.mm: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        * platform/network/cf/CredentialStorageCFNet.cpp: Added.
+        (WebCore::CredentialStorage::getFromPersistentStorage):
+        Add support for fetching credentials from persistent storage (CFNet version is currently
+        a stub).
+
+        * bindings/js/JSWebSocketCustom.cpp: Removed an unneeded include.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::getStoredCONNECTProxyCredentials):
+        (WebCore::authenticationSchemeFromAuthenticationMethod):
+        (WebCore::SocketStreamHandle::addCONNECTCredentials):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        Check if connection attempt was resulted in 407, and try stored credentials if it did.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.base.exp:
+        Updated WKSI.
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 2: Add a new bit to the PaintBehavior flags, PaintBehaviorFlattenCompositingLayers,
+        and pass that down when painting into an image.
+        
+        When set, it forces painting of compositing layers to go down a software paint path
+        when all layers are painted, irrespective of compositing status, and where
+        3d transforms are flattened to 2d. When doing this, we also need to use temporary
+        clip rects for layers which are normally composited.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::paintBehavior):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::renderableTransform):
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderObject.h:
+
+2009-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Find highlight is drawn incorrectly on pages with compositing layers
+        <rdar://problem/7413925>
+        
+        Part 1: Rename PaintRestriction to PaintBehavior, and make it a bitmask, in
+        preparation for adding a new flag related to painting into an image.
+        
+        PaintBehaviorSelectionOnly and PaintBehaviorForceBlackText are now separate flags.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintBehavior):
+        * page/FrameView.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2009-11-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7409331> Windows: Support closed caption in <video> element
+
+        Enable closed captions in QuickTime/Windows media engine.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasClosedCaptions):
+        (QTMovieWin::setClosedCaptionsVisible):
+        * platform/graphics/win/QTMovieWin.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+
+2009-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Chromium] Renderer hang when using www.expedia.com
+        https://bugs.webkit.org/show_bug.cgi?id=31822
+
+        Test: http/tests/cache/subresource-failover-to-network.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Use the originalRequest
+        when inheriting cache policy.  This matches SubresourceLoader::create.
+
+2009-11-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Change get... calls to latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=30091
+
+        Removed old versions of get calls on WebGLRenderingContext and
+        added new ones per spec returning "any". New code simplifies
+        GraphicsContext3D and fixes previously unimplemented routines.
+        Added custom JS and V8 bindings. Added exhaustive test case
+        exercising all new code paths. Updated preexisting test cases for
+        new APIs. Fixed preexisting bugs in WebKit's and Chrome's WebGL
+        implementations.
+
+        Ran WebGL layout tests in WebKit (clean) and Chrome (couple of
+        preexisting known failures) and manual WebGL tests in both
+        browsers.
+
+        Test: fast/canvas/webgl/gl-object-get-calls.html
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameterHelper):
+        (WebCore::JSWebGLRenderingContext::getBufferParameter):
+        (WebCore::JSWebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContext::getParameter):
+        (WebCore::JSWebGLRenderingContext::getProgramParameter):
+        (WebCore::JSWebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::JSWebGLRenderingContext::getShaderParameter):
+        (WebCore::JSWebGLRenderingContext::getTexParameter):
+        (WebCore::JSWebGLRenderingContext::getUniform):
+        (WebCore::JSWebGLRenderingContext::getVertexAttrib):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::):
+        (WebCore::getObjectParameter):
+        (WebCore::getProgramParameter):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::setObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::create):
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        * html/canvas/WebGLBuffer.h:
+        * html/canvas/WebGLGetInfo.cpp: Added.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::~WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getType):
+        (WebCore::WebGLGetInfo::getBool):
+        (WebCore::WebGLGetInfo::getFloat):
+        (WebCore::WebGLGetInfo::getLong):
+        (WebCore::WebGLGetInfo::getString):
+        (WebCore::WebGLGetInfo::getUnsignedLong):
+        (WebCore::WebGLGetInfo::getWebGLBuffer):
+        (WebCore::WebGLGetInfo::getWebGLFloatArray):
+        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
+        (WebCore::WebGLGetInfo::getWebGLIntArray):
+        (WebCore::WebGLGetInfo::getWebGLProgram):
+        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
+        (WebCore::WebGLGetInfo::getWebGLTexture):
+        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
+        * html/canvas/WebGLGetInfo.h: Added.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderbuffer.cpp:
+        (WebCore::WebGLRenderbuffer::create):
+        (WebCore::WebGLRenderbuffer::WebGLRenderbuffer):
+        * html/canvas/WebGLRenderbuffer.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLStateRestorer::WebGLStateRestorer):
+        (WebCore::WebGLStateRestorer::~WebGLStateRestorer):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::activeTexture):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bindFramebuffer):
+        (WebCore::WebGLRenderingContext::bindRenderbuffer):
+        (WebCore::WebGLRenderingContext::bindTexture):
+        (WebCore::WebGLRenderingContext::getBufferParameter):
+        (WebCore::WebGLRenderingContext::getFramebufferAttachmentParameter):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::getProgramInfoLog):
+        (WebCore::WebGLRenderingContext::getRenderbufferParameter):
+        (WebCore::WebGLRenderingContext::getShaderParameter):
+        (WebCore::WebGLRenderingContext::getShaderInfoLog):
+        (WebCore::WebGLRenderingContext::getShaderSource):
+        (WebCore::WebGLRenderingContext::getString):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::getUniform):
+        (WebCore::WebGLRenderingContext::getVertexAttrib):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::getBooleanParameter):
+        (WebCore::WebGLRenderingContext::getFloatParameter):
+        (WebCore::WebGLRenderingContext::getIntParameter):
+        (WebCore::WebGLRenderingContext::getLongParameter):
+        (WebCore::WebGLRenderingContext::getUnsignedLongParameter):
+        (WebCore::WebGLRenderingContext::getWebGLFloatArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLIntArrayParameter):
+        (WebCore::WebGLRenderingContext::getWebGLUnsignedByteArrayParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLTexture.cpp:
+        (WebCore::WebGLTexture::create):
+        (WebCore::WebGLTexture::WebGLTexture):
+        * html/canvas/WebGLTexture.h:
+        * manual-tests/webgl/resources/utils3d.js:
+        (initWebGL):
+        (loadShader):
+        (Framerate.prototype.snapshot):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+
+2009-11-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add additional search path for QuickTime SDK.
+
+2009-11-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Gtk] GStreamer-CRITICAL's (and other warnings) on <video>
+        https://bugs.webkit.org/show_bug.cgi?id=26354
+
+        Implemented MediaPlayerPrivate::isAvailable by checking the
+        presence of the playbin2 GStreamer element.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-24  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        When building up the pango layout from text boxes, only append a
+        newline char after verifying there are no more boxes on this line.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+
+2009-11-24  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Keyboard Shortcut to Clear Console Messages
+        https://bugs.webkit.org/show_bug.cgi?id=31780
+
+        All Platforms:  Ctrl+L  = Clear Console Messages
+        Mac Only:       Cmd+K   = Clear Console Messages
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView): create shortcuts
+        (WebInspector.ConsoleView.prototype._promptKeyDown): handle shortcuts
+        * inspector/front-end/KeyboardShortcut.js:
+        (WebInspector.KeyboardShortcut.makeKey): convenience conversion of "a-z" character to keyCode
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): style fixes for keyboard shortcuts
+
+2009-11-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touch inspector controller in order to
+        kick win bot inspector deploy. rs=aroben.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement expandable compartments on timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31796
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._addToRecordsWindow):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordListRow.prototype.dispose):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow.prototype._onClick):
+        (WebInspector.TimelineRecordGraphRow.prototype.dispose):
+        * inspector/front-end/inspector.css:
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        No new tests as there is no new functionality.
+
+        * platform/graphics/win/IntPointWin.cpp:
+        * platform/graphics/win/IntRectWin.cpp:
+        * platform/graphics/win/IntSizeWin.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+        * platform/win/PlatformMouseEventWin.cpp:
+
+2009-11-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium build fix).
+
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-11-23  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent ResourceHandleMac's version of ResourceHandle::receivedCredential from stripping
+        identity and certificate information from a WebCore::Credential when receivedCredential
+        needs to modify the credential's persistence.
+
+        Adding a new constructor Credential(const Credential& original, CredentialPersistence)
+        that copies every field from original except for persistence.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):
+        * platform/network/Credential.h:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 2/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Add references from the JSDOMWindowShell and the JSDOMGlobalObject to the world that owns them,
+        so that we can get to the world from the lexical global object of an ExecState.  In the long-term
+        we should switch over to using this approach for all cases we want to get a world from an exec state.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::WebCoreJSClientData::beginningExecution):
+        (WebCore::WebCoreJSClientData::completedExecution):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::world):
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::world):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::initScript):
+
+2009-11-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add range checks to rendering calls in WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=31239
+
+        I am now tracking the size of the data in each CanvasBuffer object
+        and keeping track of the buffer size of each active vertex attrib.
+        In drawArrays and drawElements I make sure no attempt is made to
+        access elements outside the valid buffer ranges. The test at:
+
+            http://cs.helsinki.fi/u/ilmarihe/c3d/functions/drawArraysOutOfBounds.html
+
+        no longer crashes.
+
+        I also added all the WebGL enumerations to GraphicsContext3D to use them in the validation checks
+
+        Tests: fast/canvas/webgl/drawArraysOutOfBounds.html
+               fast/canvas/webgl/drawElementssOutOfBounds.html
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::JSWebGLRenderingContext::bufferData):
+        (WebCore::JSWebGLRenderingContext::bufferSubData):
+        (WebCore::JSWebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::data):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer):
+        (WebCore::WebGLBuffer::associateBufferData):
+        (WebCore::WebGLBuffer::associateBufferSubData):
+        (WebCore::WebGLBuffer::byteLength):
+        * html/canvas/WebGLBuffer.h:
+        (WebCore::WebGLBuffer::elementArrayBuffer):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::sizeInBytes):
+        (WebCore::WebGLRenderingContext::bindBuffer):
+        (WebCore::WebGLRenderingContext::bufferData):
+        (WebCore::WebGLRenderingContext::bufferSubData):
+        (WebCore::WebGLRenderingContext::createShader):
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::validateIndexArray):
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enableVertexAttribArray):
+        (WebCore::WebGLRenderingContext::isFramebuffer):
+        (WebCore::WebGLRenderingContext::isProgram):
+        (WebCore::WebGLRenderingContext::isRenderbuffer):
+        (WebCore::WebGLRenderingContext::isShader):
+        (WebCore::WebGLRenderingContext::isTexture):
+        (WebCore::WebGLRenderingContext::useProgram):
+        (WebCore::WebGLRenderingContext::validateProgram):
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+        (WebCore::WebGLRenderingContext::detachAndRemoveAllObjects):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+        * html/canvas/WebGLRenderingContext.idl:
+        * html/canvas/WebGLShader.cpp:
+        (WebCore::WebGLShader::create):
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::createShader):
+
+2009-11-23  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JSC bindings for HasIndexGetter generates incorrect code (affects
+        MediaList and CSSStyleDeclaration).
+        This cleans up the edge cases for indexing out of range for style and
+        computed style objects to return an empty string according to the spec.
+        MediaList now returns null when indexed out of range.
+        https://bugs.webkit.org/show_bug.cgi?id=31683
+
+        Tests: fast/dom/CSSStyleDeclaration/css-computed-style-item.html
+               fast/dom/CSSStyleDeclaration/css-style-item.html
+               fast/dom/StyleSheet/css-medialist-item.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: If IndexGetterReturnsString then
+                we do not check the length before calling the item function.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::item):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::item):
+        * css/CSSStyleDeclaration.idl:
+
+2009-11-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        DocumentMarkers need to be educated about transforms
+        https://bugs.webkit.org/show_bug.cgi?id=31751
+        
+        Find highlight is incorrect with transforms
+        <rdar://problem/6358394>
+
+        Allow callers to specify that Frame::selectionTextRects() takes transforms into account
+        when computing the set of rects that encompass a selection. For transformed elemenets, the
+        selection rect will be the bounding box of the selected content.
+        
+        Fix DocumentMarkers to cache rects in absolute coordinates, rather than painting coordinates.
+        
+        Test: editing/selection/transformed-selection-rects.html
+        
+        * WebCore.base.exp:
+        Frame::selectionTextRects() has a new parameter.
+        
+        * dom/Document.cpp:
+        (WebCore::Document::setRenderedRectForMarker):
+        * dom/Document.h:
+        Pass the marker as a const reference.
+        
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::Range::textQuads):
+        Add a new method, textQuads(), which returns a list of quads, respecting transforms.
+        
+        * page/Frame.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects):
+        Add a new parameter, respectTransforms, and when that is RespectTransforms, use the quad
+        method to get quads for ranges, and then take their bounding boxes.
+
+        * rendering/InlineTextBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        
+        Pass DocumentMarkers as a const references.
+        Convert the argument to setRenderedRectForMarker() into absolute coordinates.
+        
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Cairo] support blurred test-shadow
+        [https://bugs.webkit.org/show_bug.cgi?id=31797]
+
+        Support for blurred text-shadows on Cairo. This patch
+        reuses the code of blurred box-shadows, introduced in
+        bug 26102. For a full textshadow support, a filters enabled
+        build is needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change incorrect calls to the constructor "EventNames()" to the correct accessor
+        "eventNames()". This saves ~100 AtomicString lookups each time.
+        https://bugs.webkit.org/show_bug.cgi?id=31811
+
+        * dom/EventNames.h:  Make constructor private to prevent this from happening again.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):  EventNames() --> eventNames()
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity):  EventNames() --> eventNames()
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):  EventNames() --> eventNames()
+        (WebCore::FrameLoader::pageHidden):  EventNames() --> eventNames()
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):  EventNames() --> eventNames()
+
+2009-11-23  Adam Langley  <agl@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Chromium Linux: Limit the stroke width and mitre limit.
+
+        Limit the stroke width and mitre limit that we'll pass into Skia to
+        avoid overflowing Skia's uint16_t glyph widths.
+
+        http://code.google.com/p/chromium/issues/detail?id=28250
+        https://bugs.webkit.org/show_bug.cgi?id=31747
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (scalarBound):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31812
+        WebSocket code uses RefPtr::get() where it shouldn't
+
+        No change in funcitonality, just coding style correction.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::bufferedAmount):
+        (WebCore::WebSocketChannel::close):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didOpen):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        (WebCore::WebSocketChannel::didFail):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): pacExecutionCallbackMainThread
+        is static, so it can't use member variables directly.
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * platform/network/cf/SocketStreamHandle.h: Removed names from some void* arguments, since
+        they didn't carry useful information.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): When we need an http-style URL, we actually
+        always need https.
+        (WebCore::SocketStreamHandle::scheduleStreams): Factored out from constructor, since streams
+        only get scheduled after PAC is fetched and executed asynchronously.
+        (WebCore::SocketStreamHandle::copyPACExecutionDescription): Return a description for event
+        source.
+        (WebCore::MainThreadPACCallbackInfo::MainThreadPACCallbackInfo): Forward callback to main thread.
+        (WebCore::SocketStreamHandle::pacExecutionCallback): Ditto.
+        (WebCore::SocketStreamHandle::pacExecutionCallbackMainThread): Ditto. To avoid code duplication,
+        we make the call even on Mac.
+        (WebCore::SocketStreamHandle::executePACFileURL): Make an async call to CFNetworkExecuteProxyAutoConfigurationURL.
+        (WebCore::SocketStreamHandle::removePACRunLoopSource): Once PAC execution is done or aborted,
+        we need to get rid of the event source.
+        (WebCore::SocketStreamHandle::chooseProxy): Use stored m_httpsURL.get.
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): Factored out from chooseProxy - the
+        array may come directly from system configuration, or from PAC.
+        (WebCore::SocketStreamHandle::chooseProxy): Tiger version of this function is now completely
+        separate.
+        (WebCore::SocketStreamHandle::~SocketStreamHandle): Run loop source should be destroyed
+        before we get to the destructor.
+        (WebCore::SocketStreamHandle::platformClose): Destroy the run loop source, if PAC execution
+        is still in progress.
+
+2009-11-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't leak the CGImage we create when drawing a sub image.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-11-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Don't crash when OOM in creating isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=31805
+
+        We need to add some more null checks to avoid crashing.  No new tests
+        because we don't have a good way to test out-of-memory bugs.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-11-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the implementation of the filterRes attribute. It
+        helps the SVG developer to set the quality of a filter by
+        giving the width or height of filter.
+        This patch also sets the filter resolution to lower values
+        if a intermediate ImageBuffer size is bigger than the given
+        maximal size.
+        The maximal size is set to 5000x5000 by default. This is a
+        subjectiv decission. Everthing greater than this values gets
+        sensible slower. Values of 10000x10000 crashed on WebKitGtk.
+        For mobil devices a maximum size of 100x100 or 200x200 seems
+        to be reasonable.
+        The important fact on filter resolution is, that the output
+        size is still the size given by the <filter> element.
+
+        Tests: svg/filters/big-sized-filter-2.svg
+               svg/filters/big-sized-filter.svg
+               svg/filters/filterRes.svg
+
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/FloatRect.h:
+        (WebCore::FloatRect::scale): Add the abbility to scale a rect by x and y.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::createPlatformShadow): Use scaledSubRegion for
+        calculation.
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply): Use scaledSubRegion for effect intern
+        calculations.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply): Use scaledSubRegion for effect intern calculations.
+        * platform/graphics/filters/Filter.h: Add the abbility to change the quality
+        of a filter output.
+        (WebCore::Filter::filterResolution):
+        (WebCore::Filter::setFilterResolution):
+        (WebCore::Filter::calculateEffectSubRegion): Calculates the correct subRegion
+        as well as the scaledSubRegion. It also searches for the biggest effect size.
+        We have to change the filter resolution, if one intermediate ImageBuffer size
+        doesn't fit in the maximal image size.
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::calculateDrawingRect): Use scaledSubRegion to get
+        the right part of a previous effect result.
+        (WebCore::FilterEffect::getEffectContext): Use scaledSubRegion to create
+        a new intermediate ImageBuffer for the result of the current effect.
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::scaledSubRegion): The scaled subRegion of a the
+        filter effect.
+        (WebCore::FilterEffect::setScaledSubRegion):
+        (WebCore::FilterEffect::effectBoundaries): The original values of the
+        EffectElement for a second subRegion calculation.
+        (WebCore::FilterEffect::setEffectBoundaries):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter): Set the scale factor to one.
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::maxImageSize):
+        (WebCore::ImageBufferFilter::calculateEffectSubRegion):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect): Use scaledSubRegion for effect
+        intern calculations.
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::parseMappedAttribute): Parse filterRes attribute.
+        (WebCore::SVGFilterElement::buildFilter): Give SVGResourceFilter the current
+        filterResolution.
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes): Save
+        values to effectBoundaries of the filter effect
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::shouldProcessFilter): Return signal if a neccessary value is zero.
+        (WebCore::SVGResourceFilter::fitsInMaximumImageSize): Checks if the given size
+        fits into the maximal image size, modifys scale factors if not and return a
+        bool: fits.
+        (WebCore::SVGResourceFilter::prepareFilter): Scale the SourceImage to
+        filterResolution (given by FilterElement or calculated on to big image sizes).
+        Set the scale level to SVGFilter.
+        (WebCore::SVGResourceFilter::applyFilter): Don't apply filters if shouldProcessFilter
+        is wrong.
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::setFilterResolution): FilterResolution of FilterElement.
+        (WebCore::SVGResourceFilter::setHasFilterResolution): Does FilterElement provides
+        a FilterResolution?
+        (WebCore::SVGResourceFilter::scaleX): Current scale factor for horizontal.
+        (WebCore::SVGResourceFilter::scaleY): Current scale factor for vertical.
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply): Use scaledSubRegion for effect intern calculations.
+        Kernel values are scaled to current filter resolution too.
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply): Use scaledSubRegion for effect intern calculations.
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion): Calculate subRegion for LayoutTests,
+        scaledSubRegion according to the current filterResolution and get the maximal image size.
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode): Original values of the FilterElement. 
+        (WebCore::SVGFilter::filterRegion): Use virtual for clarification.
+        (WebCore::SVGFilter::sourceImageRect): Use virtual for clarification.
+        (WebCore::SVGFilter::maxImageSize): Get the maximal image size.
+
+2009-11-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Wrong runtime instance objects of wrapped QObjects may be used if
+        the wrapped object died before the gc removed the instance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31681
+
+        Before using a cached instance, verify that its wrapped QObject is
+        still alive.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::hashKey):
+
+2009-11-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARIA: support aria-flowto
+        https://bugs.webkit.org/show_bug.cgi?id=31762
+
+        Test: platform/mac/accessibility/aria-flowto.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        (WebCore::AccessibilityObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::linkedUIElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo):
+        (WebCore::AccessibilityRenderObject::ariaFlowToElements):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-11-22  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Build fix for WML enabled builds.
+        Adopt WebCore API changes.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce sidebar background on timeline panel in order
+        to prevent it from flickering on scroll.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31789
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Reimplement TimelinePanel to make it fast:
+        - Extract grid and overview into separate files
+        - Make timeline create only divs for visible rows
+
+        https://bugs.webkit.org/show_bug.cgi?id=31784
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        * inspector/front-end/TimelineGrid.js: Added.
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addEventDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js: Added.
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._onCheckboxClicked):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.setSidebarWidth):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowResizeDragging):
+        (WebInspector.TimelineOverviewPane.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.prototype._windowDragging):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowLeft):
+        (WebInspector.TimelineOverviewPane.prototype._resizeWindowRight):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowPosition):
+        (WebInspector.TimelineOverviewPane.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewCalculator):
+        (WebInspector.TimelineOverviewCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineOverviewCalculator.prototype.reset):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineOverviewCalculator.prototype.formatValue):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.resize):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype.show):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineRecordListRow):
+        (WebInspector.TimelineRecordListRow.prototype.update):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-11-22  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Disable access to file:/// directory listings
+        https://bugs.webkit.org/show_bug.cgi?id=31329
+
+        Deny access to directory listings. This needs doing in WebKit for
+        WebKit clients that do permit top-level navigation to file:///dir.
+        This matches Firefox, plus the existing Safari implementation (which
+        does not support any directory access at all). It will fix the
+        LayoutTest named below for Chromium.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+
+        * page/SecurityOrigin.cpp: Deny access to directory listings.
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canRequest):
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Support Ctrl+P and Ctrl+N, Readline keyboard shortcuts in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=31400
+
+        Handle the following when on a Mac:
+
+          Ctrl+P = Previous (like Up arrow)
+          Ctrl+N = Next (like Down arrow)
+
+        No longer rerun autocompletion when just pushing a modifier key
+        like Control, Alt, Shift, or Meta.
+
+        Improved arrow key behavior with Multiline code in the Console, with the following behavior:
+
+          Up   = Previous Command if on First Line (caret moves to the end of the first line)
+                 otherwise default caret movement in text.
+          Down = Next Command if on Last Line (caret naturally moves to the end)
+                 otherwise default caret movement in text.
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.handleKeyEvent): handle new keyboard shortcuts
+        (WebInspector.TextPrompt.prototype.isCaretOnFirstLine): check if the caret is on the top line
+        (WebInspector.TextPrompt.prototype.isCaretOnLastLine): check if the caret is on the bottom line
+        (WebInspector.TextPrompt.prototype._upKeyPressed):
+        (WebInspector.TextPrompt.prototype._downKeyPressed):
+        (WebInspector.TextPrompt.prototype._moveBackInHistory):
+        (WebInspector.TextPrompt.prototype._moveForwardInHistory):
+
+2009-11-21  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a tooltip containing the full url of the resource to each element
+        in the Resources panel so that it is possible to quickly see the query
+        parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=19103
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.refresh):
+        Set the tooltip to be the resource's url.
+
+2009-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        CSSKeyframesRule::findRule() and deleteRule() should accept 'from' and 'to' as well as percentages
+        https://bugs.webkit.org/show_bug.cgi?id=31588
+        
+        In WebKitCSSKeyframesRule::findRuleIndex(), map 'from' to 0% an 'to' to 100%
+        so that findRule() and deleteRule() work with these keywords.
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+
+2009-11-21  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31647
+
+        Changed KeyboardEvent::m_keyEvent from a raw pointer to an OwnPtr.
+
+        No functionality was changed. So, no new tests.
+
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::~KeyboardEvent):
+        * dom/KeyboardEvent.h: Changed m_keyEvent to OwnPtr.
+        (WebCore::KeyboardEvent::keyEvent):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for aria-owns
+        https://bugs.webkit.org/show_bug.cgi?id=31702
+
+        Re-organized how accessibilityAttributeNames are returned so 
+        that it's possible for an element to add an attribute based on 
+        a dynamic value. In this case, we only want to add AXOwn if the 
+        element actually supports aria-owns.
+  
+        Test: platform/mac/accessibility/aria-owns.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::supportsARIAOwns):
+        (WebCore::AccessibilityObject::ariaOwnsElements):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaOwnsElements):
+        (WebCore::AccessibilityRenderObject::supportsARIAOwns):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper additionalAccessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7414396> Leopard & Tiger: Support closed caption in <video> element
+
+        * css/mediaControls.css:
+            Define closed caption toggle button.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create closed caption toggle button in display order.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't require MediaControllerThemeQuickTime theme for captions toggle button.
+            No need to check if the movie has video, a closed captions track is a video
+            track.
+
+2009-11-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Running code in the Console that ends with a
+        single line comment no longer produces a parse error.
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-11-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for 'math' role
+        https://bugs.webkit.org/show_bug.cgi?id=31706
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-20  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NPN_ReloadPlugins does not reload the page even if reloadPages is true.
+        https://bugs.webkit.org/show_bug.cgi?id=30460
+
+        Replace call to PluginDatabase::installedPlugins()->refresh() with Page::refreshPlugins().
+        It already refreshes plugins and reloads pages when necessary.
+
+        Tests: plugins/reloadplugins-and-pages.html
+               plugins/reloadplugins-no-pages.html
+
+        * plugins/PluginInfoStore.cpp:
+        (WebCore::refreshPlugins):
+
+2009-11-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://7409188> WebKit needs to be able to serialize and deserialize objects.
+
+        Expose WebCore object serialization to WebKit.
+
+        * WebCore.base.exp:
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31741>.
+        Web Inspector: User Entered Data on the console should show up no matter what filters.
+        
+        Always show .console-user-command-result, no matter what the filter say
+        we should do with the other classes.
+
+        * inspector/front-end/inspector.css:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31700>.
+        Web Inspector: isMac should be in one central location + Cached.
+        
+        We should cache the value of isMac, and make the indexOf call in one
+        single location, because we are calling it from multiple places, and saving
+        the result can save us time, and make the call sites simpler.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+        (WebInspector.isMac):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Removed .DS_Store accidentally added in last (r51245).
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add Console Only Layout Mode
+        https://bugs.webkit.org/show_bug.cgi?id=30282
+
+        Adds a Console Panel, which allows for a Full size Console. This
+        extends the Drawer to the size of a Panel. This also fixes previous
+        resize issues with the Drawer.
+
+        * inspector/front-end/ConsolePanel.js: added.
+        (WebInspector.ConsolePanel):
+        (WebInspector.ConsolePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ConsolePanel.prototype.show):
+        (WebInspector.ConsolePanel.prototype.hide):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype.set visibleView):
+        (WebInspector.Drawer.prototype.get savedHeight): access the saved height of the variable console.
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+        (WebInspector.Drawer.prototype.hide.animationFinished):
+        (WebInspector.Drawer.prototype.hide):
+        (WebInspector.Drawer.prototype.resize): resize appropriately if full/non-full
+        (WebInspector.Drawer.prototype.enterPanelMode):
+        (WebInspector.Drawer.prototype.exitPanelMode):
+        (WebInspector.Drawer.prototype.immediatelyExitPanelMode):
+        (WebInspector.Drawer.prototype._cancelAnimationIfNeeded):
+        (WebInspector.Drawer.prototype._animateDrawerHeight.animationFinished):
+        (WebInspector.Drawer.prototype._animateDrawerHeight):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._statusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+
+        Miscellaneous changes and cleanup.
+
+        * English.lproj/localizedStrings.js: "Console" toolbar title.
+        * inspector/front-end/ConsoleView.js: removed unnecessary element reordering  
+        * inspector/front-end/Images/consoleIcon.png: added.
+        * inspector/front-end/inspector.css: added icon.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): create console panel
+        (WebInspector.windowResize): resize drawer if necessary
+        (WebInspector.documentKeyDown): esc should not toggle the console when in panel mode
+        (WebInspector.animateStyle): start animation interval, returns the interval key
+        (WebInspector.toggleAttach): resize drawer if necessary
+        (WebInspector.showConsolePanel): restore the panel when the inspector restarts
+        (WebInspector.showProfileForURL): style fix
+
+        Restore the panel when the inspector restarts.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+        Build files.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31699>.
+        Web Inspector: Should Cache Values of InspectorController.platform() and port().
+
+        Refactor the Inspector to cache the value of InspectorController.platform
+        and InspectorController.port, because those need to call into C++, they are
+        being called more and more as we add platform specific keyboard shortcuts, and
+        they shouldn't change in the lifecycle of the Web Inspector.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (WebInspector.get platform):
+        (WebInspector.get port):
+        (WebInspector.loaded):
+        (WebInspector.documentKeyDown):
+        (WebInspector.toolbarDragStart):
+
+2009-11-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build fix for filters enabled builds.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7389945> QTKit based media engine should not claim to support 
+        fullscreen on Leopard
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+            Only return true on SnowLeopard for now.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            No need to special case MediaFullscreenButtonPart as the default implementation 
+            asks the media engine if it supports fullscreen.
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        Patch by Yongjun Zhang <yongjun.zhang@nokia.com> and
+                 Girish Ramakrishnan <girish@forwardbias.in>
+        
+        [Qt] Implement support for rendering plugins on Qt/Mac when a page is used
+        without a QWebView or when inside QGraphicsWebView.
+        
+        Currently, the code provides the cgcontext of the PlatformPluginWidget to
+        the plugin. This approach does not work when we are printing, or using
+        QWebFrame::render() to render to a QImage/QPixmap since the plugin ends
+        up drawing on the QWebView (i.e platformPluginWidget's cgcontext) instead
+        of the QPaintDevice's context.
+        
+        To solve all cases and keep the code simple, we render the plugin to an
+        offscreen pixmap in all cases. This way, the plugin always renders to the
+        CGContext of the pixmap and we then use QPainter to blit the pixmap into
+        the QPaintDevice. We also create a fake window and set it's WindowRef in
+        NPWindow. Only with this WindowRef does Flash paint correctly to the QPixmap.
+        
+        Now, that's the theory. In practice, ATM, mouse events do not work when using
+        the fake window. So, setPlatformPluginWidget() is still called when using QWebView
+        so that there are no regressions after this patch. Once we get mouse events
+        working, setPlatformPluginWidget will be removed.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31183
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-11-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Resync Resources Backend and Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=31705
+
+        * inspector/front-end/Resource.js: resync enum values with backend
+        (WebInspector.Resource.prototype._mimeTypeIsConsistentWithType): return false if all else fails, not true in all cases
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        Build change only. No new tests possible.
+
+        * config.h: Modified. Added Android-specific configuration.
+
+2009-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Change default stylesheet to reset text indentation for ruby elements by default.
+        (https://bugs.webkit.org/show_bug.cgi?id=31247)
+
+        Test: fast/ruby/ruby-text-indent.html
+
+        * css/html.css: reset text-indent on <ruby> and <rt> elements
+
+2009-11-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes <http://webkit.org/b/22754>.
+        Web Inspector: Keyboard shortcut for Element finder.
+
+        Use Command + Shift + C as a shortcut for Node Search, to 
+        match the Firebug shortcut to do the same thing.
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleKeyEvent):
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoaderRunLoopCF.
+
+        * platform/network/ResourceHandle.h: Removed loaderRunLoop().
+
+        * platform/network/cf/LoaderRunLoopCF.cpp: Added.
+        (WebCore::emptyPerform):
+        (WebCore::runLoaderThread):
+        (WebCore::loaderRunLoop):
+        * platform/network/cf/LoaderRunLoopCF.h: Added.
+        Moved the run loop that we use for CFNetwork from ResourceHandle to its own file, because
+        it's needed for more than just resource loading.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Use loaderRunLoop() from its new location.
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::DNSResolveQueue::resolve): Ditto.
+
+        * platform/network/cf/SocketStreamHandle.h: Added static callbacks for forwarding events to
+        main thread.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Use loaderRunLoop() on Windows instead of
+        inoperable main run loop.
+
+        (WebCore::MainThreadEventCallbackInfo::MainThreadEventCallbackInfo): 
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::readStreamCallbackMainThread):
+        (WebCore::SocketStreamHandle::writeStreamCallbackMainThread):
+        Forward stream events to main thread on Windows.
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Quick style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+      
+       Build fix. No review needed.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * platform/graphics/qt/StillImageQt.cpp:
+        (WebCore::StillImage::draw):
+        * platform/graphics/qt/StillImageQt.h:
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+       Build fix. No review needed.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+
+2009-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31321 Make -webkit-
+        color-correction work with untagged images
+
+        Image's draw(), drawPattern(), and fillWithSolidColor() functions 
+        now take a ColorSpace. A bunch of classes inherit from Image, so 
+        draw() and drawPattern() functions there must also take a 
+        ColorSpace.
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        (WebCore::Image::drawTiled):
+        * platform/graphics/Image.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::draw):
+        (WebCore::GeneratedImage::drawPattern):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+
+        All of the drawImage() functions and drawTiled() functions of 
+        GraphicsContext now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawImage):
+        (WebCore::GraphicsContext::drawTiledImage):
+        * platform/graphics/GraphicsContext.h:
+
+        This is where the actual work is done.
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace): New static function that returns a 
+        copy of the given image in the given ColorSpace *IF* we should use 
+        the given ColorSpace. We will ignore the color space if the image 
+        is tagged and return 0. 
+        (WebCore::BitmapImage::draw): Now takes a ColorSpace and uses it to 
+        call imageWithColorSpace(). 
+        (WebCore::Image::drawPattern): Same.
+
+        Attempt to keep all ports building. 
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/haiku/ImageHaiku.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+        Callers of GraphicsContext's drawImage() and drawTiled() functions 
+        now need to send a ColorSpace.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+
+2009-11-19  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Properly create a CGImageRef on non-PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=27777
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::sharedBufferGetBytesAtPosition):
+        (WebCore::sharedBufferRelease):
+        (WebCore::ImageSource::setData):
+        * platform/graphics/cg/ImageSourceCG.h:
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+
+2009-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        -webkit-user-drag: element Drag images include overflow decorations from incorrect nodes
+        https://bugs.webkit.org/show_bug.cgi?id=31656
+
+        Make sure we're a child of the painting root before drawing overflow features.
+
+        * manual-tests/user-drag-with-decorations.html: Added.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix Chromium build.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Add new enum values for Show/HideClosedCaptionButton to make it compile.
+
+2009-11-19  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Do not assert when a high number is used for roman numerals in lists.
+        https://bugs.webkit.org/show_bug.cgi?id=31652
+
+        Test: fast/lists/ol-start-roman.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toRoman): Increase the char array size.
+
+2009-11-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Add translatable strings to cover validationMessage, after
+        r51172. Already covered by existing test.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        WebCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        No new tests as there is no functional change.
+
+        * html/HTMLInputElement.cpp: Remove include directive
+        for float.h as it is included in MathExtras.h already.
+
+2009-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Instrumentation should account for painting in compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=31674
+
+        Add calls to InspectorTimelineAgent for painting into compositing layers,
+        which is not accounted for in FrameView::paintContents().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Avoid fetching the FrameView multiple times.
+        
+        (WebCore::inspectorTimelineAgent):
+        (WebCore::RenderLayerBacking::paintContents):
+
+2009-11-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7035231>
+        Support closed caption in <video> element
+
+        Test: media/media-captions.html
+
+        * WebCore.base.exp:
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+            Define ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+            Define and match mediaControlsToggleClosedCaptionsButton.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+            Define and match PseudoMediaControlsToggleClosedCaptions.
+
+        * css/CSSValueKeywords.in:
+            Define and use media-toggle-closed-captions-button.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQuickTime.css:
+            Add webkit-media-controls-toggle-closed-captions-button.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): 
+            Initialize m_closedCaptionsVisible.
+        (WebCore::HTMLMediaElement::loadInternal): 
+            Set m_closedCaptionsVisible to false.
+        (WebCore::HTMLMediaElement::hasClosedCaptions): 
+        (WebCore::HTMLMediaElement::closedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): 
+            New, captions internal methods.
+        (WebCore::HTMLMediaElement::setWebkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitClosedCaptionsVisible): 
+        (WebCore::HTMLMediaElement::webkitHasClosedCaptions): 
+            New, captions DOM API.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for captions API.
+
+        * platform/ThemeTypes.h:
+            Add MediaToggleClosedCaptionsButtonPart.
+
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+            Add empty implmentations.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::NullMediaPlayerPrivate::setClosedCaptionsVisible):
+            New, empty implementations of media engine closed caption functions.
+        (WebCore::MediaPlayer::hasClosedCaptions):
+        (WebCore::MediaPlayer::setClosedCaptionsVisible):
+            New, call media engine closed caption functions.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivateInterface::setClosedCaptionsVisible):
+            Declare new media engine methods.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasClosedCaptions):
+        (WebCore::MediaPlayerPrivate::setClosedCaptionsVisible):
+            New, QTKit implementation of closed caption methods.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+            Add help text for ShowClosedCaptionsButton and HideClosedCaptionsButton.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+            Declare and initialize wkQTMovieHasClosedCaptions and wkQTMovieSetShowClosedCaptions.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Deal with MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler):
+        (WebCore::MediaControlToggleClosedCaptionsButtonElement::updateDisplayType):
+            New, implement the closed caption toggle button,
+
+        * rendering/MediaControlElements.h:
+            Define MediaShowClosedCaptionsButton and MediaHideClosedCaptionsButton,
+            declare MediaControlToggleClosedCaptionsButtonElement.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        (WebCore::RenderMedia::createToggleClosedCaptionsButton):
+        (WebCore::RenderMedia::createStatusDisplay):
+        (WebCore::RenderMedia::updateControls):
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderMedia.h:
+            Deal with m_toggleClosedCaptionsButton.
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+            Deal with MediaToggleClosedCaptionsButtonPart.
+
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+            Declare paintMediaToggleClosedCaptionsButton.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+            New.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+            Don't render captions toggle button unless we are using the new theme, the
+            movie has captions, and the movie is in a <video> element since we currently
+            rely on QTKit to render the captions.
+
+        * rendering/style/RenderStyleConstants.h:
+            Define MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON.
+
+2009-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing header.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31634
+        Ignore realm for proxy protection spaces
+
+        Only affects WebSocket proxy authentication, cannot be tested in DRT.
+
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::operator==):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+
+2009-11-19  Olivier Goffart  <ogoffart@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Normalize signal and slot signatures.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2009-11-19  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Store cookie domains in the WebInspector object
+
+        The cookie domains have been moved from StoragePanel into WebInspector.
+        Also, the document URLs are now passed inside the WebInspector.addResource()
+        payload rather than pushed directly from InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=31627
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.addCookieDomain):
+        (WebInspector.reset):
+
+2009-11-19  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the other part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31585
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class RegularExpression    - instantiated at: WebCore/page/Frame.cpp:415
+        class TransformationMatrix - instantiated at: WebCore/rendering/TransformState.cpp:62
+        class Path                 - instantiated at: WebCore/html/HTMLAreaElement.cpp:73
+        class FontPlatformData     - instantiated at: WebCore/platform/graphics/qt/FontCacheQt.cpp:188
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class Cursors                         - instantiated at: WebCore/platform/qt/CursorQt.cpp:146
+        class NetworkStateNotifier            - instantiated at: WebCore/platform/network/NetworkStateNotifier.cpp:37
+        struct CrossThreadResourceRequestData - instantiated at: WebCore/platform/network/ResourceRequestBase.cpp:71
+
+        class ImageDecoder - its child class is instantiated at: WebCore/platform/graphics/qt/ImageDecoderQt.cpp:46
+        class MediaPlayerPrivateInterface - its child class is instantiated at: WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:119
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/NetworkStateNotifier.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/qt/CursorQt.cpp:
+        * platform/text/RegularExpression.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51172.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::validationMessageValueMissingText):
+        (WebCore::validationMessageTypeMismatchText):
+        (WebCore::validationMessagePatternMismatchText):
+        (WebCore::validationMessageTooLongText):
+        (WebCore::validationMessageRangeUnderflowText):
+        (WebCore::validationMessageRangeOverflowText):
+        (WebCore::validationMessageStepMismatchText):
+
+2009-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed <rdar://problem/7398987> Assertion failure in
+        RenderLayer::updateClipRects when a plug-in’s enclosing layer is
+        enclosed by a transformed layer
+
+        Tests: fast/layers/clip-rects-transformed-2.html
+               fast/layers/clip-rects-transformed.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clippingRoot): Added. Finds the nearest ancestor
+        that is either transformed or composited. During painting and hit
+        testing, when a transformed or composited layer is hit, it becomes the
+        new root layer, which ultimately gets passed to calculateRects().
+        (WebCore::RenderLayer::childrenClipRect): Pass the clipping root as the
+        root layer to calculateRects(), and return the bounding box of the
+        transformed rectangle.
+        (WebCore::RenderLayer::selfClipRect): Ditto.
+        * rendering/RenderLayer.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        No new tests as there is no change if compiled with 
+        Qt v4.4 or later version.
+
+        * WebCore.pro:
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::startDocument):
+        (WebCore::XMLTokenizer::parseDtd):
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/FontQt43.cpp: Removed.
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::clearData):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::keyIdentifierForQtKeyCode):
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/text/qt/TextBoundaries.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-11-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=27959>.
+        Support for validationMessage attribute, as per HTML5 specs.
+
+        Test: fast/forms/validationMessage.html
+
+        * html/HTMLButtonElement.idl: validationMessage attribute
+        * html/HTMLFieldSetElement.idl: validationMessage attribute
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.idl: validationMessage attribute
+        * html/HTMLSelectElement.idl: validationMessage attribute
+        * html/HTMLTextAreaElement.idl: validationMessage attribute
+        * html/ValidityState.cpp: new method to retrieve pertinent localized text
+        * html/ValidityState.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/wx/LocalizedStringsWx.cpp:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        Fix a typo. Remove the trailing semicolon
+        from an include directive after r51137.
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r51159.
+
+        Include float.h for DBL_MANT_DIG. Not sure why this
+        is not a problem for other ports.
+
+        * html/HTMLInputElement.cpp:
+
+2009-11-19  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 31574 -  Crashing bug when removing <ruby> element
+        (https://bugs.webkit.org/show_bug.cgi?id=31574)
+
+        Cause of the bug:
+        1.) RenderBlock::destroy() of the RenderRubyRun called destroyLeftoverChildren()
+        2.) that called destroy() of the RenderRubyBase(), which in RenderObject::destroy() calls remove()
+        3.) remove() is being redirected as parent()->removeChild() in RenderObject.h
+        4.) this triggers the special handling of child removal in RenderRubyRun that
+            causes it to destroy itself
+        5.) On returning from all this the renderer crashes when accessing a member
+            or virtual function on this now illegal object.
+
+        I therefore added a flag that tracks if the ruby run is being destroyed.
+        If so, avoid doing the special handling in removeChild that caused this.
+        It's not the most elegant solution, but the easiest to implement without
+        touching unrelated code. Also, it's self-documenting.
+
+        Test: fast/ruby/ruby-remove.html
+
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::destroy):
+        (WebCore::RenderRubyRun::removeChild):
+        * rendering/RenderRubyRun.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        No new tests as there is no functional change.
+
+        * WebCore.pro:
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBoundaries for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBoundariesWince.cpp: Added.
+
+2009-11-18  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement TextBreakIterator for WINCE port.
+        https://bugs.webkit.org/show_bug.cgi?id=27371
+
+        * platform/text/wince/TextBreakIteratorWince.cpp: Added.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add support for ValidityState.typeMismatch for the following INPUT types:
+          date datetime datetime-local month time week
+        https://bugs.webkit.org/show_bug.cgi?id=31342
+
+        Tests: fast/forms/ValidityState-typeMismatch-date.html
+               fast/forms/ValidityState-typeMismatch-datetime.html
+               fast/forms/ValidityState-typeMismatch-datetimelocal.html
+               fast/forms/ValidityState-typeMismatch-month.html
+               fast/forms/ValidityState-typeMismatch-time.html
+               fast/forms/ValidityState-typeMismatch-week.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToISODateTime): Check the type
+          validity of the specified type and string using the ISODateTime class.
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): Check the type validity
+          for date, datetime, datetime-local, month, time and week with
+          HTMLInputElemtn::formStringToISODateTime()
+
+2009-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix REGRESSION (r47022): Performance of DocumentFragment.appendChild is 1000x slower sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=31237
+        
+        Also speeds up Dromaeo DOM Core tests by 1.31x.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Change marking algorithm to avoid O(N^2) behavior. The subtree
+        mark bit was no longer effective; instead I changed things so only a node that has no ancestors
+        with wrappers would do marking; there should be only one in the typical case (the root of the
+        detached subtree).
+        * dom/Node.cpp:
+        (WebCore::Node::Node): Remove now useless m_inSubtreeMark bit and related functions.
+        * dom/Node.h: ditto
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get rid of the redundant strokeType and fillType data members on
+        a GraphicsContext as well as the FillOrStrokeType enum. Use
+        null pointers instead.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor): Null out the pattern
+        and gradient.
+        (WebCore::GraphicsContext::setFillColor): Ditto.
+        (WebCore::GraphicsContext::setStrokePattern): Null out the graident.
+        (WebCore::GraphicsContext::setFillPattern): Ditto.
+        (WebCore::GraphicsContext::setStrokeGradient): Null out the pattern.
+        (WebCore::GraphicsContext::setFillGradient): Ditto.
+
+        * platform/graphics/GraphicsContextPrivate.h: Remove all that stuff.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::setPlatformStroke): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern): Removed unneeded get.
+        (WebCore::GraphicsContext::applyFillPattern): Ditto.
+        (WebCore::calculateDrawingMode): Use fillPattern and strokePattern
+        to see if there is a pattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::drawPath): Use fillGradient, strokeGradient,
+        fillPattern, and strokePattern instead of fillType and strokeType.
+        (WebCore::GraphicsContext::fillPath): Added FIXME about color space that
+        is used in the pattern and gradient case probably erroneously. Moved
+        gradient code inside an if statement. Streamlined pattern code and
+        use an if statement. No switch any more.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath): Use null checks on fillPattern and
+        fillGraident instead of a switch statement.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath): Removed unneeded check of fillType.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Support for step attribute and ValidityStae.stepMismatch for
+        type=number and range.  stepMismatch will be false if the
+        difference between the current value and a multiple of the step
+        value is very small.
+
+        Change the behavior of RenderSlider so that it always has a value
+        rounded to the step attribute value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31331
+
+        Tests: fast/forms/ValidityState-stepMismatch-number.html
+               fast/forms/ValidityState-stepMismatch-range.html
+               fast/forms/ValidityState-stepMismatch-unsupported.html
+               fast/forms/input-step.html
+
+        * html/HTMLAttributeNames.in: Add "step".
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getStepParameters):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Add "step".
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::stepMismatch): Forward to HTMLInputElement::stepMismatch().
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::clampValue):
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to ASSERT(isMainThread()) in ThreadShared methods.
+        https://bugs.webkit.org/show_bug.cgi?id=31637
+
+        Added ASSERT(IsMainThread()) to all following methods:
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared):
+        (WebCore::TreeShared::~TreeShared):
+        (WebCore::TreeShared::ref):
+        (WebCore::TreeShared::deref):
+        (WebCore::TreeShared::setParent):
+        (WebCore::TreeShared::parent):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        Add plugin visibility manual test
+
+        https://bugs.webkit.org/show_bug.cgi?id=31542
+
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+
+2009-11-18  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector - remember last script displayed in Scripts panel
+        https://bugs.webkit.org/show_bug.cgi?id=27552
+
+        Manual test added
+        
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showScript):
+        (WebInspector.ScriptsPanel.prototype.showResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.ScriptsPanel.prototype._goBack):
+        (WebInspector.ScriptsPanel.prototype._goForward):
+        * manual-tests/inspector/remember-last-script.html: Added.
+
+2009-11-18  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Create bounded transparency layers instead of just clipping.
+
+        No new tests because this is just a performance improvement.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+
+2009-11-18  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add support for displaying deleteButton.
+        https://bugs.webkit.org/show_bug.cgi?id=31560
+
+        Test: LayoutTests/editing/deleting/5408255.html
+
+        * WebCore.qrc:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Qt build without JavaScript debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31575
+
+        * page/Console.idl:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24971
+        And
+        <rdar://problem/7138265>
+
+        Fixes an issue where setting the height of a table row programmatically
+        (via JavaScript) causes the table to be improperly rendered because the
+        height of each row in the table is not recalculated with respect to the
+        CSS height property.
+
+        In particular, programmatically setting the height of some table row causes
+        the rows of that table to be rendered with a height equal to the minimum
+        height required by the cells in that row, regardless of any specified cell
+        heights. Instead, when RenderTableSection::recalcCells is called, the height
+        of each row should be set to the CSS height property just as we do in
+        RenderTableSection::addChild.
+
+        Test: fast/table/row-height-recalc2.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::setRowHeightToRowStyleHeightIfNotRelative): Added.
+        (WebCore::RenderTableSection::addChild): Moved code that set row height into
+        method WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+        (WebCore::RenderTableSection::recalcCells): Modified to call
+        WebCore::setRowHeightToRowStyleHeightIfNotRelative.
+
+2009-11-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of platform directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31473
+
+        Inherits the following classes from FastAllocBase because these are
+        instantiated by 'new':
+
+        class  AnimationList         - instantiated at WebCore/rendering/style/StyleRareNonInheritedData.cpp:85
+        class  Color                 - instantiated at WebCore/rendering/RenderTheme.cpp:48
+        struct Length                - instantiated at WebCore/platform/Length.cpp:103
+        class  PlatformKeyboardEvent - instantiated at WebCore/dom/KeyboardEvent.cpp:63
+        class  ContextMenuItem       - instantiated at WebCore/platform/ContextMenu.cpp:70
+        class  DeprecatedPtrList     - instantiated at WebCore/rendering/RenderBlock.cpp:2284
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and no need to be copyable:
+
+        class  GraphicsContextPrivate - instantiated at WebCore/platform/graphics/GraphicsContext.cpp:78
+        class  FontCache              - instantiated at WebCore/platform/graphics/qt/FontCacheQt.cpp:43
+        struct MediaPlayerFactory     - instantiated at WebCore/platform/graphics/MediaPlayer.cpp:163
+        class  DeprecatedPtrListNode  - instantiated at WebCore/platform/DeprecatedPtrListImpl.cpp:53
+
+        * platform/ContextMenuItem.h:
+        * platform/DeprecatedPtrList.h:
+        * platform/DeprecatedPtrListImpl.cpp:
+        * platform/Length.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/animation/AnimationList.h:
+        * platform/graphics/Color.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/MediaPlayer.cpp:
+
+2009-11-18  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-18  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove V8CanvasPixelArrayCustom.cpp because it is no longer used by V8.
+        https://bugs.webkit.org/show_bug.cgi?id=31499
+
+        No new tests, just a build cleanup.
+
+        * WebCore.gypi:
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-11-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Enable wx plugin support using the Windows implementation as a base.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31636
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::unloadModule):
+        (WebCore::listDirectory):
+        * plugins/PluginDatabase.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+        * wscript:
+
+2009-11-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Add shared timer and sound utilities to platform/android
+        https://bugs.webkit.org/show_bug.cgi?id=31584
+
+        No new tests required, this is platform specific code.
+
+        * platform/android/SharedTimerAndroid.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/android/SoundAndroid.cpp: Added.
+        (WebCore::systemBeep):
+
+2009-11-18  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix profile tree nodes loss after focus / restore actions.
+
+        Focusing on a node is currently implemented via nodes reattaching
+        with some caching involved. It seems that not all code was updated
+        to handle this scenario correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31553
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._restore):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._willHaveChildren):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGridNode.prototype._detach):
+        (WebInspector.DataGridNode.prototype.savePosition):
+        (WebInspector.DataGridNode.prototype.restorePosition):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.restore):
+
+2009-11-18  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPageClient.h needs in some cases QCursor, but it does not
+        include it 
+        https://bugs.webkit.org/show_bug.cgi?id=31527
+
+        No new tests as this is just a coding style fix that affects the 
+        build of some not yet submitted patches (i.e. for bug 30173).
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-18  Nicolas Roard   <nicolas@roard.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        InspectorTimelineAgent.h should be guarded by ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=31504
+
+        * inspector/InspectorTimelineAgent.h:Added the guard.
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Build fix to my previous checkin, for Windows Chromium
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::PropertySynchronizer::synchronize): Fix implicit-conversion error on AtomicString.
+
+2009-11-18  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Directly Access <head> Instead of Searching for It
+        https://bugs.webkit.org/show_bug.cgi?id=31641
+        
+        Changed old access of the head element (document.getElementsByTagName)
+        to just use the document.head accessor.
+
+        * inspector/front-end/FontView.js:
+        (WebInspector.FontView):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.js:
+        (windowLoaded):
+
+2009-11-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix two Geolocation assertions.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame): No need to use PageGroupLoadDeferrer since this
+        is not called from JS. 
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Watchers::set): The PassRefPtr was getting nulled out, so we need to put it in
+        a RefPtr first.
+
+2009-11-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Case sensitive file system build fix.
+
+        * platform/network/Credential.h: It's not WTF, just wtf.
+
+2009-11-18  Aaron Golden  <agolden@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for certificates to WebCore::Credential so we can convert between NSURLCredential
+        objects and WebCore::Credential objects without losing certificate information.
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential):  Adding a constructor that takes an identity argument and a certificate chain argument
+        (WebCore::Credential::isEmpty):  Modifying isEmpty to support certificate based credentials (which don't have a username or password)
+        (WebCore::Credential::identity): Accessor for the m_identity property
+        (WebCore::Credential::certificates): Accessor for the m_certificates property
+        (WebCore::Credential::type):  Accessor for the m_type property
+        (WebCore::operator==):  Modifying == to compare the identity and certificate chains of certificate based credentials.
+        * platform/network/Credential.h:  Adding new fields to WebCore::Credential to support certificate based credentials.
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):  Modifying the mac() conversion method to correctly convert certificate based WebCore::Credential objects.
+        (WebCore::core):  Modifying the core() conversion method to correctly convert certificate based NSURLCredential objects.
+
+2009-11-18  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Reverting r50919 that has introduced a non-thread-safe refcounting in ScriptExecutionContext::postTaskToMainThread.
+        https://bugs.webkit.org/show_bug.cgi?id=31615
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+
+2009-11-18  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate unnecessary String-->AtomicString conversions from generated V8 bindings,
+        by causing the right v8-to-WebCore conversion function to be called for every parameter.
+        This no longer requires any IDL metadata, so I've removed the [HintAtomic] annotations.
+        To enforce correctness, I added a mode that disables implicit
+        String-->AtomicString conversions while compiling the generated bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31168
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Generate usage of V8Parameter class.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:  Enable NO_IMPLICIT_ATOMICSTRING.
+        * bindings/v8/V8Binding.h:  Add V8Parameter class.
+        * css/WebKitCSSKeyframesRule.h:  Make AtomicString conversions explicit.
+        * dom/Document.idl:  Remove obsolete [HintAtomic] annotation.
+        * platform/text/AtomicString.h:  Added NO_IMPLICIT_ATOMICSTRING option.
+        * svg/SVGAnimatedTemplate.h:  Change some return types to String to avoid implicit conversion.
+        * svg/SVGAnimatedProperty.h: Adapt to changed return types in SVGAnimatedTemplate.
+
+2009-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move FillOrStrokeType out of public header.
+
+        * platform/graphics/GraphicsContext.h: Updated copyright date to cover
+        some years we published Apple changes, sorted forward declarations,
+        removed FillOrStrokeType enum.
+        * platform/graphics/GraphicsContextPrivate.h: Updated copyright date
+        to cover some years we published Apple changes, sorted includes,
+        moved FillOrStrokeType enum here.
+
+2009-11-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add Settings for WebKitShowDebugBorders and WebKitShowRepaintCounter
+        https://bugs.webkit.org/show_bug.cgi?id=31601
+
+        These are used to debug accelerated compositing layers. I removed
+        the platform specific code from GraphicsLayerCA.mm and added calls
+        to GraphicsLayerClient to get it from the higher levels. The values 
+        now get cached in RenderLayerCompositing and are queried from there
+        by RenderLayerBacking (which implements the GraphicsLayerClient interface).
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * page/Settings.h:
+        (WebCore::Settings::showDebugBorders):
+        (WebCore::Settings::showRepaintCounter):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::showDebugBorders):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::showDebugBorders):
+        (WebCore::RenderLayerBacking::showRepaintCounter):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::showDebugBorders):
+        (WebCore::RenderLayerCompositor::showRepaintCounter):
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of metrics and properties sidebars'
+        flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31629
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+
+2009-11-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes <http://webkit.org/b/31606>.
+        Web Inspector: Enter/Return key should enter edit mode for Editable Fields.
+        
+        This implements Enter starting editing mode in an editable DataGrid. If the
+        DataGrid is editable and the user hits return, startEditing the first child
+        of the selected node. Also refactored some editing functions to take an 
+        event target instead of the event itself, because the functions only needed
+        the target. Lastly, added had return in editing mode stop propogation, because
+        when enter was hit to confirm text, it would propagate back to the datagrid
+        and try to start editing again.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._ondblclick):
+        (WebInspector.DataGrid.prototype._startEditing):
+        (WebInspector.DataGrid.prototype.handleKeyEvent):
+        (WebInspector.DataGrid.prototype.dataGridNodeFromEvent):
+        (WebInspector.DataGrid.prototype._mouseDownInDataTable):
+        (WebInspector.DataGrid.prototype._clickInDataTable):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+
+2009-11-18  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        HTMLAnchorElement is inconsistent with its internal handling of the value returned for the href attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=31593
+
+        Test: fast/dom/HTMLAnchorElement/set-href-attribute-whitespace.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::href): Add call to deprecatedParseURL.
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Touch InspectorController so that frontend
+        JS files are deployed on Windows.
+
+        * inspector/InspectorController.cpp:
+
+2009-11-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clone timeline records array instead of
+        copying reference on invalidate all.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31596
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+
+2009-11-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements don't drop out of compositing layers when animation ends
+        https://bugs.webkit.org/show_bug.cgi?id=31613
+        <rdar://problem/7402913>
+
+        Avoid setting the mustOverlapCompositedLayers flag on RenderLayers which
+        are compositing anyway for other reasons. Doing so can cause those layers
+        to stay in compositing mode even after animations finish, because needsToBeComposited()
+        continues to return true.
+        
+        No new tests because it's not possible to determine which elements are in
+        compositing layers from DRT output.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-11-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Mac Plugins: Remove null timer
+        
+        A null timer was used to send mouse move events. Instead, we now use
+        move events to send nullEvent. This brings down CPU usage by 20-30%.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31624
+
+        * plugins/PluginView.h:
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::handleMouseEvent):
+
+2009-11-18  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] WebKit crashes when loading certain SVG images
+
+        Check if the familly exist before creating the PlatformData from it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29443
+
+        Test: svg/text/text-font-invalid.html
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-11-17  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix crash in Chromium/Mac where dropdowns weren't dismissed correctly
+        after navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=31609
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal): Set parent for external
+        dropdowns, so that |PopupListBox::hidePopup()| can successfully notify
+        its parent's client.
+
+2009-11-17  Hayato Ito  <hayato@google.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid infinite mutual recursion when deeply nested tags are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=30651
+
+        Test: fast/parser/block-nesting-cap-table.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::tagPriorityOfNode):
+        (WebCore::HTMLParser::limitBlockDepth):
+        (WebCore::HTMLParser::insertNodeAfterLimitBlockDepth):
+        (WebCore::HTMLParser::insertNode):
+        * html/HTMLParser.h:
+
+2009-11-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Final clean-ups for minor coding standard violations.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+
+2009-11-17  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        In all valid script tags for JavaScript, the event handler in <script...for> should not get executed.
+        https://bugs.webkit.org/show_bug.cgi?id=31567
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+
+2009-11-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make DRT show web inspector for tests in inspector/ folder.
+        - Updated DRT to show/close inspector for all tests under /inspector
+        - Introduced LayoutTestController::setTimelineProfilingEnabled and
+          WebInspector::setTimelineProfilingEnabled beside setJavaScriptProfilingEnabled
+        - Removed reload on each inspector test
+        - Renamed fast/inspector to fast/inspector-support in order not to trigger
+        inspector for those.
+        - Reimplemented timeline tests in order to get rid of reload there.
+        - Moved tests that don't require harness into the fast group.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31472
+
+        * WebCore.Inspector.exp:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+
+2009-11-17  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] Android is missing the implementation of the GeolocationService iface.
+        https://bugs.webkit.org/show_bug.cgi?id=31554
+
+        No new tests required as this is platform specific code.
+
+        * platform/android/GeolocationServiceAndroid.cpp: Added.
+        (WebCore::GeolocationServiceAndroid::create):
+        (WebCore::GeolocationServiceAndroid::GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::startUpdating):
+        (WebCore::GeolocationServiceAndroid::stopUpdating):
+        (WebCore::GeolocationServiceAndroid::suspend):
+        (WebCore::GeolocationServiceAndroid::resume):
+        (WebCore::GeolocationServiceAndroid::newPositionAvailable):
+        (WebCore::GeolocationServiceAndroid::newErrorAvailable):
+        (WebCore::GeolocationServiceAndroid::timerFired):
+        (WebCore::GeolocationServiceAndroid::isPositionMovement):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreAccurate):
+        (WebCore::GeolocationServiceAndroid::isPositionMoreTimely):
+        * platform/android/GeolocationServiceAndroid.h: Added.
+        (WebCore::GeolocationServiceAndroid::~GeolocationServiceAndroid):
+        (WebCore::GeolocationServiceAndroid::lastPosition):
+        (WebCore::GeolocationServiceAndroid::lastError):
+        * platform/android/GeolocationServiceBridge.cpp: Added.
+        (WebCore::):
+        (WebCore::GeolocationServiceBridge::GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::~GeolocationServiceBridge):
+        (WebCore::GeolocationServiceBridge::start):
+        (WebCore::GeolocationServiceBridge::stop):
+        (WebCore::GeolocationServiceBridge::setEnableGps):
+        (WebCore::GeolocationServiceBridge::newLocationAvailable):
+        (WebCore::GeolocationServiceBridge::newErrorAvailable):
+        (WebCore::GeolocationServiceBridge::toGeoposition):
+        (WebCore::GeolocationServiceBridge::startJavaImplementation):
+        (WebCore::GeolocationServiceBridge::stopJavaImplementation):
+        * platform/android/GeolocationServiceBridge.h: Added.
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewd build fix.
+
+        - Fix typo in WebCore.vcproj.
+        - Intlude limits.h for INT_MAX.
+        - Enclose with parenthesis to suspress warning.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * html/ISODateTime.cpp:
+        (WebCore::ISODateTime::addDay):
+
+2009-11-16  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure wx scrollbar drawing code factors in transforms when switching backends,
+        fix calcs for scrollbar length, and tweak the Mac scrollbar tracking rects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31570
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        * platform/wx/ScrollbarThemeWx.h:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h:
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-11-16  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Introduce WebCore::ISODateTime class.
+        https://bugs.webkit.org/show_bug.cgi?id=31340
+
+        This class represents a value of date/time types of the HTML5 INPUT
+        element, and has some parsing methods for ISO 8601.
+
+        This change has no tests because the class is not used yet.
+
+        * GNUmakefile.am: Add ISODateTime.cpp and ISODateTime.h.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * WebCoreSources.bkl: ditto.
+        * html/ISODateTime.cpp: Added. Implementation of WebCore::ISODateTime class.
+        (WebCore::isLeapYear):
+        (WebCore::maxDayOfMonth):
+        (WebCore::dayOfWeek):
+        (WebCore::ISODateTime::maxWeekNumberInYear):
+        (WebCore::countDigits):
+        (WebCore::toInt):
+        (WebCore::ISODateTime::parseYear): Private helper for parseDate() and parseWeek().
+        (WebCore::ISODateTime::addDay): Private helper for parseTimeZone().
+        (WebCore::ISODateTime::addMinute): ditto.
+        (WebCore::ISODateTime::parseTimeZone): Private helper for parseDateTime().
+        (WebCore::ISODateTime::parseMonth): Parser for <input type=month>.
+        (WebCore::ISODateTime::parseDate): Parser for <input type=date>.
+        (WebCore::ISODateTime::parseWeek): Parser for <input type=week>.
+        (WebCore::ISODateTime::parseTime): Parser for <input type=time>.
+        (WebCore::ISODateTime::parseDateTimeLocal): Parser for <input type=datetime-local>.
+        (WebCore::ISODateTime::parseDateTime): Parser for <input type=datetime>.
+        * html/ISODateTime.h: Added.  Declare WebCore::ISODateTime class.
+        (WebCore::ISODateTime::ISODateTime):
+        (WebCore::ISODateTime::millisecond):
+        (WebCore::ISODateTime::second):
+        (WebCore::ISODateTime::minute):
+        (WebCore::ISODateTime::hour):
+        (WebCore::ISODateTime::monthDay):
+        (WebCore::ISODateTime::month):
+        (WebCore::ISODateTime::fullYear):
+        (WebCore::ISODateTime::week):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: #ifdef, not #if.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Fix a typo in previous commit.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Tiger build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Define CFN_EXPORT, as this macro was named
+        differently in Tiger CFNetwork.
+
+2009-11-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [KURLGoogle] setHostAndPort doesn't handle arguments without port correctly.
+
+        Fix a bug in the code that was dormant until http://trac.webkit.org/changeset/50784.
+
+        Covered by existing test: LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::setHostAndPort): Added handling of arguments without port specified.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Jon Honeycutt.
+
+        A better Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Use a macro that inserts __declspec(dllimport) when appropriate for CFNetwork imports.
+
+2009-11-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Rename protocolIsValid to isValidProtocol.
+        https://bugs.webkit.org/show_bug.cgi?id=31503
+
+        This name change was suggested in https://bugs.webkit.org/show_bug.cgi?id=29972#c19.
+
+        No new tests since no new functionality was introduced.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::setProtocol):
+        * platform/KURL.cpp:
+        (WebCore::isValidProtocol):
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2009-11-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: aria-labelledby duplicates some of its WAI-ARIA label
+        https://bugs.webkit.org/show_bug.cgi?id=31565
+
+        Test: accessibility/aria-labelledby-overrides-label.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hasTextAlternative):
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-11-16  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle the case of a null NPObject* in NPN_SetException in
+        the V8 bindings.  This allow out of process plugins calling
+        NPN_SetException to just send null instead of sending an
+        NPObject* that would be an address in a different 
+        process's memory space.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31561
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_SetException): Allow null NPObject* and just throw a general error.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::SocketStreamHandle::createStreams):
+        Disable CONNECT proxies on Windows until WebKitSupportLibrary includes support for those.
+
+2009-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] ASSERT failure while running DRT
+        https://bugs.webkit.org/show_bug.cgi?id=30978
+
+        Add needed Structure typeInfo flags to QtRuntimeObjectImpl and QtRuntimeMethod.
+        These flags are needed after r49649, where HasDefaultmark was changed to OverrideMarkChildren.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::createStructure):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the build.  Land a file that was missing from r51049.
+
+        * bindings/js/JSWebGLArrayHelper.h: Copied from WebCore/html/canvas/WebGLByteArray.idl.
+        (WebCore::setWebGLArrayFromArray):
+
+2009-11-16  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update API of WebGLArray and friends
+        https://bugs.webkit.org/show_bug.cgi?id=31175
+
+        * bindings/js/JSWebGLArrayCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWebGLArrayHelper.h: Added.
+        (WebCore::setWebGLArrayFromArray):
+        * bindings/js/JSWebGLByteArrayCustom.cpp:
+        (WebCore::JSWebGLByteArray::set):
+        * bindings/js/JSWebGLFloatArrayCustom.cpp:
+        (WebCore::JSWebGLFloatArray::set):
+        * bindings/js/JSWebGLIntArrayCustom.cpp:
+        (WebCore::JSWebGLIntArray::set):
+        * bindings/js/JSWebGLShortArrayCustom.cpp:
+        (WebCore::JSWebGLShortArray::set):
+        * bindings/js/JSWebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedByteArray::set):
+        * bindings/js/JSWebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedIntArray::set):
+        * bindings/js/JSWebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::JSWebGLUnsignedShortArray::set):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructWebGLArray):
+        (WebCore::getWebGLArrayElement):
+        (WebCore::setWebGLArrayFromArray):
+        (WebCore::setWebGLArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * html/canvas/WebGLArray.cpp:
+        (WebCore::WebGLArray::WebGLArray):
+        (WebCore::WebGLArray::~WebGLArray):
+        (WebCore::WebGLArray::setImpl):
+        * html/canvas/WebGLArray.h:
+        (WebCore::WebGLArray::isByteArray):
+        (WebCore::WebGLArray::isUnsignedByteArray):
+        (WebCore::WebGLArray::isShortArray):
+        (WebCore::WebGLArray::isUnsignedShortArray):
+        (WebCore::WebGLArray::isIntArray):
+        (WebCore::WebGLArray::isUnsignedIntArray):
+        (WebCore::WebGLArray::isFloatArray):
+        (WebCore::WebGLArray::buffer):
+        (WebCore::WebGLArray::baseAddress):
+        (WebCore::WebGLArray::byteOffset):
+        * html/canvas/WebGLArray.idl:
+        * html/canvas/WebGLArrayBuffer.cpp:
+        (WebCore::WebGLArrayBuffer::create):
+        (WebCore::WebGLArrayBuffer::WebGLArrayBuffer):
+        (WebCore::WebGLArrayBuffer::data):
+        (WebCore::WebGLArrayBuffer::byteLength):
+        (WebCore::WebGLArrayBuffer::~WebGLArrayBuffer):
+        * html/canvas/WebGLArrayBuffer.h:
+        * html/canvas/WebGLByteArray.cpp:
+        (WebCore::WebGLByteArray::create):
+        (WebCore::WebGLByteArray::byteLength):
+        (WebCore::WebGLByteArray::slice):
+        (WebCore::WebGLByteArray::set):
+        * html/canvas/WebGLByteArray.h:
+        (WebCore::WebGLByteArray::isByteArray):
+        (WebCore::WebGLByteArray::data):
+        (WebCore::WebGLByteArray::set):
+        (WebCore::WebGLByteArray::get):
+        (WebCore::WebGLByteArray::item):
+        * html/canvas/WebGLByteArray.idl:
+        * html/canvas/WebGLFloatArray.cpp:
+        (WebCore::WebGLFloatArray::create):
+        (WebCore::WebGLFloatArray::WebGLFloatArray):
+        (WebCore::WebGLFloatArray::length):
+        (WebCore::WebGLFloatArray::byteLength):
+        (WebCore::WebGLFloatArray::slice):
+        (WebCore::WebGLFloatArray::set):
+        * html/canvas/WebGLFloatArray.h:
+        (WebCore::WebGLFloatArray::isFloatArray):
+        (WebCore::WebGLFloatArray::data):
+        (WebCore::WebGLFloatArray::set):
+        (WebCore::WebGLFloatArray::get):
+        (WebCore::WebGLFloatArray::item):
+        * html/canvas/WebGLFloatArray.idl:
+        * html/canvas/WebGLIntArray.cpp:
+        (WebCore::WebGLIntArray::create):
+        (WebCore::WebGLIntArray::WebGLIntArray):
+        (WebCore::WebGLIntArray::length):
+        (WebCore::WebGLIntArray::byteLength):
+        (WebCore::WebGLIntArray::slice):
+        (WebCore::WebGLIntArray::set):
+        * html/canvas/WebGLIntArray.h:
+        (WebCore::WebGLIntArray::isIntArray):
+        (WebCore::WebGLIntArray::data):
+        (WebCore::WebGLIntArray::set):
+        (WebCore::WebGLIntArray::get):
+        (WebCore::WebGLIntArray::item):
+        * html/canvas/WebGLIntArray.idl:
+        * html/canvas/WebGLShortArray.cpp:
+        (WebCore::WebGLShortArray::create):
+        (WebCore::WebGLShortArray::WebGLShortArray):
+        (WebCore::WebGLShortArray::length):
+        (WebCore::WebGLShortArray::byteLength):
+        (WebCore::WebGLShortArray::slice):
+        (WebCore::WebGLShortArray::set):
+        * html/canvas/WebGLShortArray.h:
+        (WebCore::WebGLShortArray::isShortArray):
+        (WebCore::WebGLShortArray::data):
+        (WebCore::WebGLShortArray::set):
+        (WebCore::WebGLShortArray::get):
+        (WebCore::WebGLShortArray::item):
+        * html/canvas/WebGLShortArray.idl:
+        * html/canvas/WebGLUnsignedByteArray.cpp:
+        (WebCore::WebGLUnsignedByteArray::create):
+        (WebCore::WebGLUnsignedByteArray::WebGLUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::length):
+        (WebCore::WebGLUnsignedByteArray::byteLength):
+        (WebCore::WebGLUnsignedByteArray::slice):
+        (WebCore::WebGLUnsignedByteArray::set):
+        * html/canvas/WebGLUnsignedByteArray.h:
+        (WebCore::WebGLUnsignedByteArray::isUnsignedByteArray):
+        (WebCore::WebGLUnsignedByteArray::data):
+        (WebCore::WebGLUnsignedByteArray::set):
+        (WebCore::WebGLUnsignedByteArray::get):
+        (WebCore::WebGLUnsignedByteArray::item):
+        * html/canvas/WebGLUnsignedByteArray.idl:
+        * html/canvas/WebGLUnsignedIntArray.cpp:
+        (WebCore::WebGLUnsignedIntArray::create):
+        (WebCore::WebGLUnsignedIntArray::WebGLUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::length):
+        (WebCore::WebGLUnsignedIntArray::byteLength):
+        (WebCore::WebGLUnsignedIntArray::slice):
+        (WebCore::WebGLUnsignedIntArray::set):
+        * html/canvas/WebGLUnsignedIntArray.h:
+        (WebCore::WebGLUnsignedIntArray::isUnsignedIntArray):
+        (WebCore::WebGLUnsignedIntArray::data):
+        (WebCore::WebGLUnsignedIntArray::set):
+        (WebCore::WebGLUnsignedIntArray::get):
+        (WebCore::WebGLUnsignedIntArray::item):
+        * html/canvas/WebGLUnsignedIntArray.idl:
+        * html/canvas/WebGLUnsignedShortArray.cpp:
+        (WebCore::WebGLUnsignedShortArray::create):
+        (WebCore::WebGLUnsignedShortArray::WebGLUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::length):
+        (WebCore::WebGLUnsignedShortArray::byteLength):
+        (WebCore::WebGLUnsignedShortArray::slice):
+        (WebCore::WebGLUnsignedShortArray::set):
+        * html/canvas/WebGLUnsignedShortArray.h:
+        (WebCore::WebGLUnsignedShortArray::isUnsignedShortArray):
+        (WebCore::WebGLUnsignedShortArray::data):
+        (WebCore::WebGLUnsignedShortArray::set):
+        (WebCore::WebGLUnsignedShortArray::get):
+        (WebCore::WebGLUnsignedShortArray::item):
+        * html/canvas/WebGLUnsignedShortArray.idl:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Declare constants as extern "C".
+
+2009-11-15  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Enable support for webkit-box-shadow in Cairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=26102.
+
+        Covered by existing fast/box-shadow tests.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:  Add
+          support for fillRect shadows.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Don't try to include a file that's not
+        in WebKitSupportLibrary.
+
+2009-11-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31494
+        Add unauthenticated proxy support to SocketStreamHandleCFNet
+
+        Cannot be tested in DRT.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxy): Fetch proxy information from OS.
+        (WebCore::SocketStreamHandle::createStreams): Apply it to the newly created streams.
+
+2009-11-14  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Broken back/forward after using ErrorPageExtension to set error page
+        https://bugs.webkit.org/show_bug.cgi?id=30573
+
+        Make FrameLoader::checkLoadCompleteForThisFrame method
+        to check for any working DocumentLoader instance (through
+        activeDocumentLoader()) instead of only checking for
+        'm_provisionalDocumentLoader' in order to decide to if
+        it is going to reset of not the back and forward history.
+        after an error page has been loaded.
+
+        Test: LayoutTests/fast/history/back-forward-reset-after-error-handling.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2009-11-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="directory"
+        https://bugs.webkit.org/show_bug.cgi?id=31516
+
+        Test: platform/mac/accessibility/aria-directory.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isOrderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):
+
+2009-11-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by George Staikos.
+        
+        Compare UChars single unit at a time as opposed to the uint32_t
+        approach as casting to unaligned addresses may cause a bus failure
+        on ARMv5 and below. This change replicates the same defines that
+        exists in AtomicString.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=31475
+        
+        * platform/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2009-11-15  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Wrap some SVG code in V8DOMWrapper with an ENABLE(SVG) test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31490
+
+        * bindings/v8/V8DOMWrapper.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. The FileChooser constructor doesn't need to be redefined.
+
+        * platform/haiku/FileChooserHaiku.cpp:
+
+2009-11-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [Haiku] Build fix. ColorSpace name had a wrong CamelCase.
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r50999.
+        http://trac.webkit.org/changeset/50999
+
+        Need to fix some issues in the Windows build. Missed some places where
+        RenderTextControl::isEdited is called.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setUserEdited):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        (WebCore::RenderTextControl::isUserEdited):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31186
+
+        Renames RenderTextControl::m_edited and RenderTextControl::m_userEdited to
+        m_wasChangedSinceLastChangeEvent and m_lastChangeWasUserEdit, respectively.
+        These are more descriptive names so as to clear an ambiguity surrounding
+        their usage. Also, renames associated setters and getters so that they
+        coincide with the renamed fields.
+
+        No functionality was changed. So, no tests were included.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setLastChangeWasUserEdit): Formerly named setUserEdited.
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::wasChangedSinceLastChangeEvent): Formerly named isEdited.
+        (WebCore::RenderTextControl::setChangedSinceLastChangeEvent): Formerly named setEdited.
+        (WebCore::RenderTextControl::lastChangeWasUserEdit): Formerly named setUserEdited.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-11-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6946165> Would like to be able to specify the number of visible lines when using -webkit-line-clamp
+
+        Test: fast/overflow/line-clamp.html
+
+        * css/CSSComputedStyleDeclaration.cpp: (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Updated to handle different types of values.
+        * css/CSSParser.cpp: (WebCore::CSSParser::parseValue): ditto.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::applyProperty): ditto.
+
+        * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        Use the line count value if available.  Otherwise, convert the percentage to the line count, as we did before.  Also,
+        if there is anchor as the last child box, still allow adding the ellipsis.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively): Call isNone on the LineClampValue to see if the line-clamp property has been set.
+        (WebCore::RenderLayer::scrollRectToVisible): ditto.
+
+        * WebCore.xcodeproj/project.pbxproj: Added LineClampValue.h
+        * rendering/style/LineClampValue.h: Added.
+        (WebCore::LineClampValue::LineClampValue):
+        (WebCore::LineClampValue::value):
+        (WebCore::LineClampValue::isPercentage):
+        (WebCore::LineClampValue::isNone):
+        (WebCore::LineClampValue::operator==):
+        (WebCore::LineClampValue::operator!=):
+        * rendering/style/RenderStyleConstants.h: (WebCore::): Define ELineClampType enum for percentage or line count.
+
+        * rendering/style/RenderStyle.h: Use LineClampValue.
+        (WebCore::InheritedFlags::lineClamp):
+        (WebCore::InheritedFlags::setLineClamp):
+        (WebCore::InheritedFlags::initialLineClamp):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-11-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7287487> 
+        Do not use QuickTime version to detect media controller theme
+
+        * WebCore.base.exp: Export wkMediaControllerThemeAvailable
+        * platform/mac/WebCoreSystemInterface.h: Ditto.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::mediaControllerTheme): Use wkMediaControllerThemeAvailable instead of the
+        QuickTime version to see if it is possible to use MediaControllerThemeQuickTime.
+
+2009-11-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Recognizes date/datetime/datetime-local/month/time/week types of INPUT element.
+          They have no dedicated UI and no type validation for now.
+        - Clean up setInputType() and formControlType() of HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29004
+
+        Test: fast/forms/input-type-change3.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::createTypeMap):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::createFormControlTypes):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+
+2009-11-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: checkbox does not determine its label from text content
+        https://bugs.webkit.org/show_bug.cgi?id=31456
+
+        Test: accessibility/aria-checkbox-text.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-11-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Fix build to catch up with http://trac.webkit.org/changeset/50973.
+        This is just enough changes to unbreak the port.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+        * loader/FrameLoaderClient.h:
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Provide an empty implementation of this method because I don't know
+        what it is supposed to do on Chromium.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * loader/FrameLoader.h: Make dispatchDidClearWindowObjectsInAllWorlds()
+        public, as Chromium's V8Proxy calls it.
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix to Chromium build.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): 
+
+2009-11-13  Aaron Boodman  <aa@chromium.org>
+
+        Unreviewed fix for Chromium build.
+
+        * platform/text/TextBoundaries.cpp: Use longer path to refer to Unicode.h.
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.  Should fix failure #4.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::initContextIfNeeded):
+
+2009-11-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed partial build fix for Chromium.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::getAllWorlds):
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Windows and Chromium builds after http://trac.webkit.org/changeset/50977.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        * WebCore.gypi: Rename TextBoundariesICU -> TextBoundaries
+        * WebCore.vcproj/WebCore.vcproj: Rename TextBoundariesICU -> TextBoundaries
+
+2009-11-12  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        LocalStorage quota should include key sizes in its count
+        https://bugs.webkit.org/show_bug.cgi?id=31451
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setItem):
+            Count keys in the quota when adding a new item.
+        (WebCore::StorageMap::removeItem):
+            Remove the key's length from the quota if we're removing the item.
+        (WebCore::StorageMap::importItem):
+            Assume that we're adding things for the first time.
+            Count keys in the quota.
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Moving TextBoundariesICU.cpp to TextBoundaries.cpp
+        by removing the direct ICU dependency and replacing it
+        with WTF functions and WebCore's own TextBreakIterator
+        abstractions.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/text/TextBoundaries.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/TextBoundariesICU.cpp: Removed.
+        * platform/text/TextBreakIterator.h:
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::textBreakLast):
+        (WebCore::textBreakPrevious):
+
+2009-11-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        WebCore::externalRepresentation should update layout before getting render object
+        https://bugs.webkit.org/show_bug.cgi?id=31459
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+
+2009-11-13  Adam Roben  <aroben@apple.com>
+
+        Tell FrameLoaderClient when window objects in isolated worlds are
+        cleared
+
+        Fixes <http://webkit.org/b/31124> Tell the WebFrameLoadDelegate when
+        window objects in isolated worlds are cleared
+
+        Test: http/tests/security/isolatedWorld/didClearWindowObject.html
+
+        Reviewed by Dave Hyatt.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::WebCoreJSClientData::getAllWorlds): Added. Copies all the
+        worlds in m_worldSet to the passed-in Vector.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::getAllWorlds): Added. Calls through to
+        WebCoreJSClientData.
+        (WebCore::ScriptController::initScript): Changed to call
+        FrameLoader::dispatchDidClearWindowObjectInWorld.
+
+        * bindings/js/ScriptController.h: Added getAllWorlds.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidClearWindowObjectInWorld):
+        Updated for FrameLoaderClient change.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::begin):
+        Changed to call dispatchDidClearWindowObjectsInAllWorlds.
+
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectsInAllWorlds):
+        Added. Retrieves all the worlds, then calls through to
+        dispatchDidClearWindowObjectInWorld for each one.
+        (WebCore::FrameLoader::dispatchDidClearWindowObjectInWorld): Replaces
+        dispatchWindowObjectAvailable. Calls up to the client, then, if the
+        world is the mainThreadNormalWorld(), tells the Inspector about it,
+        too.
+
+        * loader/FrameLoader.h: Replaced dispatchWindowObjectAvailable with
+        dispatchDidClearWindowObjectInWorld. Added
+        dispatchDidClearWindowObjectsInAllWorlds.
+
+        * loader/FrameLoaderClient.h: Replaced windowObjectCleared with
+        dispatchDidClearWindowObjectForWorld.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix SVG context assignment for pod types.
+        https://bugs.webkit.org/show_bug.cgi?id=31497
+
+        I broke this in r50958.
+
+        Tested by svg/custom/viewport-update2.svg.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-11-13  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Bring the platform/android files inline with Android 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=31423
+
+        No new tests required: these are all Android-specific files.
+
+        * platform/android/ClipboardAndroid.cpp:
+        (WebCore::ClipboardAndroid::files):
+        * platform/android/ClipboardAndroid.h:
+        * platform/android/FileChooserAndroid.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        (WebCore::fileButtonChooseFileLabel):
+        * platform/android/KeyEventAndroid.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeAndroid::baselinePosition):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::adjustMenuListStyleCommon):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        * platform/android/ScreenAndroid.cpp:
+        * platform/android/ScrollViewAndroid.cpp:
+        (WebCore::ScrollView::platformOffscreenContentRectangle):
+        * platform/android/TemporaryLinkStubs.cpp:
+        (JSC::Bindings::dispatchJNICall):
+        * platform/android/WidgetAndroid.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * WebCore.pro:
+
+2009-11-13  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement composition events introduced in DOM Level 3.
+        This change adds a new IDL which defines the composition events, adds a class which
+        implements the composition events, and sends the composition events according to
+        the specification.
+        https://bugs.webkit.org/show_bug.cgi?id=26310
+
+        Test: fast/events/ime-composition-events-001.html
+
+        * DerivedSources.make: Added CompositionEvent so we can compile "CompositionEvent.idl".
+        * GNUmakefile.am: Added "CompositionEvent.{cpp,h,idl}".
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added "CompositionEvent.{cpp,h,idl}" and "JSCompositionEvent.{cpp,h}".
+        * WebCoreSources.bkl: Added "JSCompositionEvent.{cpp,h}".
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Call isCompositionEvent() to create the CompositionEvent wrapper.
+        * bindings/v8/DOMObjectsInclude.h: Added "JSCompositionEvent.h".
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Added "JSCompositionEvent.cpp".
+        * bindings/v8/V8DOMWrapper.cpp: Call isCompositionEvent() to identify an event as a CompositionEvent.
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+        * bindings/v8/V8Index.cpp: Added "V8CompositionEvent.h".
+        * bindings/v8/V8Index.h: Added V8Index::COMPOSITIONEVENT.
+        * dom/CompositionEvent.cpp: Implements the CompositionEvent class.
+        (WebCore::CompositionEvent::CompositionEvent):
+        (WebCore::CompositionEvent::~CompositionEvent):
+        (WebCore::CompositionEvent::initCompositionEvent):
+        (WebCore::CompositionEvent::isCompositionEvent):
+        * dom/CompositionEvent.h: Declares the CompositionEvent class.
+        (WebCore::CompositionEvent::create):
+        (WebCore::CompositionEvent::data):
+        * dom/CompositionEvent.idl: Added the IDL of DOM CompositionEvent.
+        * dom/Event.cpp:
+        (WebCore::Event::isCompositionEvent): Added a method to identify an event is a CompositionEvent.
+        * dom/Event.h:
+        * dom/EventNames.h: Added composition{start,update,end} to eventNames.
+        * editing/Editor.cpp:
+        (WebCore::Editor::confirmComposition): Sent a CompositionEnd event.
+        (WebCore::Editor::setComposition): Sent a Composition{Start,Update,End} event.
+
+2009-11-13  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a link error in unofficial GCC 4.4 builds on Linux.
+        https://bugs.webkit.org/show_bug.cgi?id=31477
+
+        * bindings/v8/V8Binding.cpp:  Add explicit instantiations of v8StringToWebCoreString template.
+
+2009-11-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix Debug build after http://trac.webkit.org/changeset/50960.
+
+        The CounterNode class does not support all methods necessary to efficiently update the counter tree as needed per CSS2.1
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        We currently fill a path with solid color instead of filling
+        a clipping path. This causes problems on some composite operators,
+        since Cairo modifies the area outside the path.
+        This fixes the behavior of WebKitGtk on fast/canvas/canvas-composite-alpha.html
+
+        Thanks to Benjamin Otte for tracking the bug down.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker implementation.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31440
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * storage/DatabaseTracker.h:
+        * storage/chromium/DatabaseTrackerChromium.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase):
+        * storage/chromium/QuotaTracker.cpp:
+        (WebCore::QuotaTracker::updateDatabaseSize):
+        * storage/chromium/QuotaTracker.h:
+
+2009-11-13  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The CounterNode class is missing some basic tree navigation methods common in other WebKit trees such as the rendering tree
+        https://bugs.webkit.org/show_bug.cgi?id=31213
+        Added tree navigation methods that permit full implementation of CSS2.1
+        counter feature without using recursion proportional to the counter
+        tree depth.
+        No new tests because I did not find any bug that is fixed by this
+        commit yet, this just reduces the size of the patch for 11031 and
+        helps respond to some concerns regarding that patch.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+
+        (WebCore::CounterNode::nextInPreOrderAfterChildren):
+        (WebCore::CounterNode::nextInPreOrder):
+        Added to support non-recursive tree traversal necessary for
+        efficient full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::lastDescendant):
+        (WebCore::CounterNode::previousInPreOrder):
+        Moved this methods such that they occupy a place similar to that of
+        identically named methods on the render tree. This allows for their
+        broader use needed in full implementation of CSS2.1 counters.
+
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        Changed such that insertion/removal of a counter, triggers not only
+        recalculation of PrefixWidths, but also reassesment of values in
+        counter nodes. This is the basis full implementation of CSS2.1
+        counters. It does not change current behavior by much because of
+        changes needed to the recalculation algorithm, but those are comming
+        in the patch for 11031.
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::counter):
+        Only changed argument type to prepare for implementation of Darin
+        Adler's recommendation for the patch to 11031.
+
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeChildren):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+        Added the ability to restrict invalidation to counters with a given
+        identifier.
+        Also invalidated counters that are on the child container itself
+        which were missed by the previous algorithm, but were a valid case.
+
+2009-11-13  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Protect SVG animated properties from destruction in bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31474
+
+        See http://crbug.com/26719.
+
+        Tested by LayoutTests/svg/custom/js-update-transform-addition.svg
+        under Valgrind.
+
+        Made sure we keep a reference to SVG properties while setting a
+        context:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::withSVGContext):
+
+2009-11-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Incorporate Benjamin Otte's recommendations to avoid
+        a buffer overrun, and small performance improvement.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::copyContextProperties): Correctly size output
+         storage for cairo_get_dash to avoid buffer overrun.
+        (WebCore::drawPathShadow): Prefer cairo_fill_extents
+         to slower cairo_stroke_extents when not drawing shadows.
+
+2009-11-13  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Do not register Chromium's HTML5 DB VFS as the default
+        VFS. Otherwise, other sqlite DB users in the same process will
+        stop working.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31462
+
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle): Explicitly cast "-1" to CFOptionFlags,
+        avoiding a sign mismatch warning.
+
+2009-11-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Release build fix.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        Use ASSERT_UNUSED for unused stream parameter.
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31441
+        Implement SocketStreamHandleCFNet
+
+        Existing WebSocket tests now pass on Mac. No proxy support yet.
+
+        * platform/network/SocketStreamHandleClient.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        (WebCore::SocketStreamHandle::shouldUseSSL):
+        (WebCore::SocketStreamHandle::refAuthenticationClient):
+        (WebCore::SocketStreamHandle::derefAuthenticationClient):
+        (WebCore::SocketStreamHandle::):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+        (WebCore::SocketStreamHandle::chooseProxy):
+        (WebCore::SocketStreamHandle::createStreams):
+        (WebCore::SocketStreamHandle::copyCFStreamDescription):
+        (WebCore::SocketStreamHandle::readStreamCallback):
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+        (WebCore::SocketStreamHandle::~SocketStreamHandle):
+        (WebCore::SocketStreamHandle::platformSend):
+        (WebCore::SocketStreamHandle::platformClose):
+        (WebCore::SocketStreamHandle::receivedCredential):
+        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::SocketStreamHandle::receivedCancellation):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering (take 2).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Chromium: [REGRESSION] Crash while stopping on a breakpoint.
+        Rolling back r50890.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31467
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [CAIRO] shadow support for Canvas and SVG
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+        
+        This is the fix of a regression, caused by the shadow patch
+        from the bug above. Reinserted the save and restore calls
+        that were accidently removed by the previous patch.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+
+2009-11-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Reverting r50908 since it makes inspector tests
+        time out.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+
+2009-11-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable 'console.profile()' and 'console.profileEnd()'
+        regardless of JAVASCRIPT_DEBUGGER.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31293
+
+        * WebCore.gypi:
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profile):
+        (WebCore::JSConsole::profileEnd):
+        * bindings/v8/custom/V8ConsoleCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * page/Console.idl:
+
+2009-11-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::evaluateInWorld): Add a dummy
+         method which isn't called in chromium to make things compile.
+
+2009-11-12  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+        
+        The document-open.html test was flaky at times. The test invokes the layout test plugin
+        which in its destroy stream handler opens a new document. This basically tears down the
+        stream and the associated plugin instance, which causes a crash when the plugin stream
+        dereferences an invalid m_client pointer which points to the PluginView instance which
+        is invalid at this time. Fix is to set the m_client pointer to NULL in the stop function
+        and check for the same.
+       
+        https://bugs.webkit.org/show_bug.cgi?id=31067
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::stop):
+        (WebCore::PluginStream::destroyStream):
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Renaming some parameters passed to DB-related methods to better
+        indicate their purpose.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31449
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transformed reflected elements are clipped inside element with opacity
+        https://bugs.webkit.org/show_bug.cgi?id=30957
+        
+        transparencyClipBox() attemped to minimize the size of the transparency layer by mapping
+        each clip rect into painting space before taking the unions. This, however, did not work
+        correctly with combinations of reflections and transforms. Fixed by unioning the
+        clipRect and mapping through transforms along the way.
+        
+        Also leave some #ifdeffed code in beginTransparencyLayers() that makes it easy to see
+        where the transparency layers are.
+
+        Test: fast/reflections/opacity-reflection-transform.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::expandClipRectForDescendantsAndReflection):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        Improve SecurityOrigin::toString comment
+        https://bugs.webkit.org/show_bug.cgi?id=31041
+
+        * page/SecurityOrigin.h:
+
+2009-11-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        externalRepresentation should take Frame as the argument
+        https://bugs.webkit.org/show_bug.cgi?id=31393
+
+        No new tests as this is just a refactoring.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/RenderTreeAsText.h:
+
+2009-11-12  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Android] The Android specific files in page/Android are out of date.
+        https://bugs.webkit.org/show_bug.cgi?id=31437
+
+        No tests required.
+
+        * page/android/DragControllerAndroid.cpp:
+        (WebCore::DragController::dragOperation): Added.
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/android/EventHandlerAndroid.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Added.
+        * page/android/InspectorControllerAndroid.cpp: Removed.
+
+2009-11-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] shadow support for Canvas and SVG.
+        [https://bugs.webkit.org/show_bug.cgi?id=30960]
+
+        Implement Canvas/SVG shadow support for Cairo.  This patch
+        uses the filter code from SVG Filters.  That means that it is
+        necessary to activate filters to see the shadows.
+
+        Test: fast/canvas/canvas-shadow.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj: Add new ImageBufferFilter files.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (GraphicsContext::calculateShadowBufferDimensions): New helper routine.
+        (WebCore::setPlatformFill):
+        (WebCore::setPlatformStroke):
+        (WebCore::copyContextProperties):
+        (WebCore::drawPathShadow):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::createPlatformShadow):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Add filter effect.
+        * platform/graphics/filters/Filter.h: Correct 'const' signatures.
+        * platform/graphics/filters/ImageBufferFilter.cpp: Added.
+        * platform/graphics/filters/ImageBufferFilter.h: Added.
+        * svg/graphics/filters/SVGFilter.cpp: Correct 'const' signatures.
+        * svg/graphics/filters/SVGFilter.h: Correct 'const' signatures.
+
+2009-11-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add postTaskToMainThread to ScriptExecutionContext.
+        Move the code to post task to the main thread into a new method on ScriptExecutionContext,
+        to use as a helper implementation of the virtual ScriptExecutionContext::postTask(Task) in
+        contexts that live on the main thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31427
+
+        No new tests - simply moving the code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::postTask):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskData::PerformTaskData):
+        (WebCore::PerformTaskData::performTask):
+        (WebCore::ScriptExecutionContext::postTaskToMainThread):
+        * dom/ScriptExecutionContext.h:
+
+2009-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix crash when removing compositing layers when GC is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=31429
+
+        Workaround <rdar://problem/7390716> by special-casing the removal
+        of all sublayers when GC is enabled.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::safeSetSublayers):
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The last of the V8 binding optimizations.
+        - Replace string-valued element accessors with a shared getter/setter function.
+        - Change error handling flow of control to avoid extra branches and function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=31443
+        
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::getElementStringAttr):  Body of string-valued Element getter function.
+        (WebCore::setElementStringAttr):  Body of string-valued Element setter function.
+        * bindings/v8/V8Binding.h:
+
+2009-11-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/7267951>
+        Canvas methods should reject uses of NaN and Infinity.
+
+        Test: fast/canvas/canvas-with-illegal-args.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: profile timeline panel, fix obvious problems.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31432
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.hasStyleClass):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: preload status bar button glyphs
+        in order to prevent them from flickering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31439
+
+        * inspector/front-end/inspector.js:
+        (preloadImages):
+
+2009-11-12  Adam Roben  <aroben@apple.com>
+
+        Replace worldIDs with world objects
+
+        Part of <http://webkit.org/b/31414> Implement new SPI for dealing with
+        user scripts/stylesheets and isolated worlds
+
+        Reviewed by Sam Weinig.
+
+        Covered by existing tests.
+
+        * WebCore.base.exp: Update exported symbols to match what now exists
+        and is needed by WebKit.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Updated for function rename.
+
+        * bindings/js/ScriptController.cpp: Removed code that dealt with
+        worldIDs.
+        (WebCore::ScriptController::createWorld): Added. Returns a new world
+        suitable for use on the main thread.
+        (WebCore::ScriptController::executeScriptInWorld): Renamed from
+        executeScriptInIsolatedWorld, since this works just fine with a
+        "normal" world.
+
+        * bindings/js/ScriptController.h: Added createWorld, removed functions
+        that took worldIDs, renamed executeScriptInIsolatedWorld to
+        executeScriptInWorld.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        Updated for changes to UserScriptMap and ScriptController.
+
+        * page/Frame.h: Changed injectUserScriptsForWorld to take a
+        DOMWrapperWorld* instead of a worldID.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        Changed these functions to take a DOMWrapperWorld* instead of a
+        worldID. Also updated for changes to UserScript and UserStyleSheet.
+
+        * page/UserScript.h:
+        * page/UserStyleSheet.h: Changed not to hold a worldID, since it was
+        never used.
+
+        * page/UserScriptTypes.h:
+        * page/UserStyleSheetTypes.h: Changed UserScriptMap and
+        UserStyleSheetMap to use a RefPtr<DOMWrapperWorld> instead of a
+        worldID as their key type.
+
+
+2009-11-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31260>.
+        Web Inspector: Main Resources Other than HTML are mis-detected.
+        
+        Even if the resource is a main resource, look at its CachedResource type, 
+        because it might be an image, stylesheet, or JavaScript file, and we
+        want to show them all correctly.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResourceType): Move this method out so it can be called in multiple places.
+        (WebCore::InspectorResource::type): 
+        * inspector/InspectorResource.h:
+
+2009-11-12  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Table-driven setup for V8 binding template callback functions. 100k in code savings.
+        https://bugs.webkit.org/show_bug.cgi?id=31420
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Change generated ConfigureXXXTemplate fn
+            to call configureTemplate().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::configureTemplate):  New function; does all the standard configuration work.
+        (WebCore::createCallback):  De-inlined wrapper for FunctionTemplate creation.
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):  Just wrapped the very long fn parameter list.
+        (WebCore::batchConfigureCallbacks):  New function, used by configureTemplate.
+        (WebCore::batchConfigureConstants):  Just wrapped the very long fn parameter list.
+        * bindings/v8/V8Proxy.h:
+
+2009-11-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50876.
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7388969> Add DOM API for fullscreen video
+        
+        DOM API for fullscreen <video>.
+
+        Tests: media/media-fullscreen-inline.html
+               media/media-fullscreen-not-in-document.html
+
+        * dom/EventNames.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+        * html/HTMLAttributeNames.in:
+            Add onwebkitbeginfullscreen and onwebkitendfullscreen.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onwebkitbeginfullscreen and onwebkitendfullscreen.
+        (WebCore::HTMLMediaElement::enterFullscreen):
+            Schedule webkitbeginfullscreenEvent event, don't set m_isFullscreen unless we
+            actually do enter fullscreen.
+        (WebCore::HTMLMediaElement::exitFullscreen):
+            Schedule webkitendfullscreenEvent event.
+        (WebCore::HTMLMediaElement::webkitEnterFullScreen):
+        (WebCore::HTMLMediaElement::webkitExitFullScreen):
+        (WebCore::HTMLMediaElement::webkitSupportsFullscreen):
+        (WebCore::HTMLMediaElement::webkitDisplayingFullscreen):
+            New, access to fullscreen properties and methods.
+
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+            Declare methods needed for fullscreen API.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen):
+            Return false if a movie does not have video.
+
+        * page/DOMWindow.h:
+            Add webkitbeginfullscreen and webkitendfullscreen.
+
+2009-11-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Sify compose button alerts error
+        https://bugs.webkit.org/show_bug.cgi?id=31394
+
+        Test: http/tests/security/calling-versus-current.html
+
+        We're supposed to use the calling context for security checks.  In JSC
+        land, this is the lexicalGlobalObject.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::canAccessPrivate):
+
+2009-11-12  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30291
+
+        Fixes an issue where the returned drop effect is incorrect when
+        effectAllowed == "uninitialized".
+
+        According to section 7.9.2 of the HTML 5 spec.
+        <http://dev.w3.org/html5/spec/Overview.html#the-dragevent-and-datatransfer-interfaces>
+        when effectAllowed = "uninitialized" the resulting dropEffect should be the
+        user-specified dropEffect (i.e. "copy", "move", "link") and "none" for any
+        other case.
+        
+        No test cases are included because we have an existing test case from
+        bug #24731.
+
+        * dom/Clipboard.cpp:
+        (WebCore::dragOpFromIEOp): Added case for op == "uninitialized".
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not highlight node on refresh.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31419
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+
+2009-11-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Minor timeline fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31417
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype._updateDetails):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        SnowLeopard build fix.
+
+        Renamed initWithClient to initWithAuthenticationClient.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (-[WebCoreAuthenticationClientAsChallengeSender initWithAuthenticationClient:]):
+        (WebCore::AuthenticationChallenge::setAuthenticationClient):
+
+2009-11-12  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA: add alert type roles
+        https://bugs.webkit.org/show_bug.cgi?id=31392
+
+        Test: platform/mac/accessibility/aria-alerts.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2009-11-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31386
+        Make Mac AuthenticationChallenge usable from cross-platform code
+
+        No change in behavior, so no tests.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Don't store m_currentCFChallenge, which was only used for a single assertion. Unlike the
+        NSURLConnection case, CF challenge doesn't carry a sender with it, so the copy in web challenge
+        is identical.
+
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Added a setter to match the new
+        Mac interface. Previously, one had to create a new AuthenticationChallenge to replace client.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Fixed assertions after removal
+        of m_currentCFChallenge. Also, there is no need to set client now, as it's guaranteed to
+        be already set.
+
+        * platform/network/mac/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::m_sender): Explained the existence of this member to the
+        best of my understanding.
+        (WebCore::AuthenticationChallenge::m_nsChallenge): Renamed from m_macChallenge to prevent
+        confusion with "mac" and "web" challenges in ResourceHandleInternal.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCoreAuthenticationClientAsChallengeSender): Added a Obj-C wrapper for AuthenticationClient,
+        making it possible to use the latter with NSURLAuthenticationChallenge.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge): Updated for m_macChallenge ->
+        m_nsChallenge renaming.
+        (WebCore::AuthenticationChallenge::setAuthenticationClient): Wrap the client in Obj-C and
+        set it as sender (or unset, if client is null).
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreResourceHandleAsDelegate) WebCoreResourceHandleAsDelegate no longer doubles as
+        authentication challenge sender.
+        (WebCore::ResourceHandle::~ResourceHandle): A navigation can happen underneath an
+        authentication sheet.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Form m_currentWebChallenge
+        using the new setAuthenticationClient() method.
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Fixed an incorrect assertion.
+        Since didCancelAuthenticationChallenge is called by connection, the passed challenge is
+        the original Mac one, not the one we created for use with authentication sheet. I don't
+        know when a connection would cancel authentication in practice, so I haven't tested this.
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoint sidebar entries should allow click over entire list item
+        https://bugs.webkit.org/show_bug.cgi?id=31411
+
+        No new tests; no new functionality, small usability change. 
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement):
+        (WebInspector.BreakpointsSidebarPane.prototype._appendBreakpointElement.breakpointClicked):
+
+2009-11-12  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: breakpoints in named evals are not restored after a reload
+        https://bugs.webkit.org/show_bug.cgi?id=31375
+
+        Manual test added
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+        * manual-tests/inspector/bp-in-named-eval-after-reload.html: Added.
+
+2009-11-12  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Custom printing shrink factors
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        This reverts commit r49769. The public API for this needs to be reviewed
+        before its inclusion in Qt.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Resource errors/warnings not shown in the Resource tree.
+
+        Error/Warning bubbles are not displayed next to the resource in the 
+        Resources panel if those occur before the resource is attached to the tree.
+        https://bugs.webkit.org/show_bug.cgi?id=31404
+
+        Test: manual-tests/inspector/styled-error-bubbles-in-scripts.html
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Follow-up of r50726, don't block the UI thread when calling
+        gst_element_get_state(). Also fixed a compilation warning and some
+        static casts.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::playbackPosition):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setRate):
+
+2009-11-12  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        don't pause pipeline if already paused, same for play()
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+
+2009-11-12  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support Gtk scrollwheel behavior for horizontal scrollbars on Linux
+        Chromium too.
+        https://bugs.webkit.org/show_bug.cgi?id=31292
+
+        No new tests. (Corresponding test for Gtk+ is
+        platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html)
+
+        * page/EventHandler.cpp:
+        * page/chromium/EventHandlerChromium.cpp:
+
+2009-11-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent text inside a multi-column block from being split into columns.
+        
+        If the tentative height of a multi-column block was too small, we need to
+        expand the block height and try to layout again, in order to prevent text
+        from being split into different columns.
+
+        CSS Multicolumn text is split awkwardly
+        https://bugs.webkit.org/show_bug.cgi?id=22249
+
+        Test: fast/multicol/single-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBlock.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setTruncatedAt):
+        (WebCore::RenderView::setMinimumColumnHeight):
+        (WebCore::RenderView::minimumColumnHeight):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that RenderFileUploadControl isn't initialized with multiple files.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        Test: fast/forms/input-file-re-render.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing Chromium's POSIX VFS implementation, by adding the required
+        "used file descriptors" logic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31275
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+
+2009-11-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        need to implement aria tree roles
+        https://bugs.webkit.org/show_bug.cgi?id=31284
+
+        Tests: platform/mac/accessibility/aria-multiselectable.html
+               platform/mac/accessibility/aria-tree.html
+
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaTreeRows):
+        (WebCore::AccessibilityObject::ariaTreeItemContent):
+        (WebCore::AccessibilityObject::ariaTreeItemDisclosedRows):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isTree):
+        (WebCore::AccessibilityObject::isTreeItem):
+        (WebCore::AccessibilityObject::setIsExpanded):
+        (WebCore::AccessibilityObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityObject::hierarchicalLevel):
+        (WebCore::AccessibilityObject::setSelectedRows):
+        (WebCore::AccessibilityObject::performDefaultAction):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::hierarchicalLevel):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::AccessibilityRenderObject::setElementAttributeValue):
+        (WebCore::AccessibilityRenderObject::elementAttributeValue):
+        (WebCore::AccessibilityRenderObject::setIsExpanded):
+        (WebCore::AccessibilityRenderObject::isSelected):
+        (WebCore::AccessibilityRenderObject::setSelected):
+        (WebCore::AccessibilityRenderObject::setSelectedRows):
+        (WebCore::createARIARoleMap):
+        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute):
+        (WebCore::AccessibilityRenderObject::ariaTreeSelectedRows):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        (WebCore::AccessibilityRenderObject::selectedChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper subrole]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix after @r50760 with ENABLE_FILTERS.
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply): Supply ColorSpace to fillRect.
+        * svg/graphics/filters/SVGFEFlood.cpp: Supply ColorSpace argument
+          to fillRect.
+
+2009-11-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix WebSocket frame parser of frame_type with high-order bit set.
+        https://bugs.webkit.org/show_bug.cgi?id=30668
+
+        If buffer is smaller than frame's length, it should break the loop
+        instead of reading next byte.
+
+        Tests: websocket/tests/frame-length-longer-than-buffer.html
+               websocket/tests/frame-length-skip.html
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-11-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Remove t2embed.dll functions from FontCustomPlatformData.cpp for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=31345
+
+        Remove dependency on t2embed.dll so that Chromium for Windows can start even if t2embed.dll cannot be accessed.
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Remove TTDeleteEmbeddedFont() call. Always use RemoveFontMemResourceEx().
+        (WebCore::FontCustomPlatformData::fontPlatformData): Remove TTGetNewFontName() call.
+        (WebCore::createFontCustomPlatformData): Remove TTLoadEmbeddedFont() call. Always use AddFontMemResourceEx() via renameAndActivateFont() in opentype/OpenTypeUtility.h. Remove EOTStream class as well.
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Build fix. No review needed.
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Windows build fix. No review needed. 
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31382
+        Make -webkit-color-correction work with shadows
+
+        From canvas, just send DeviceColorSpace to setShadow() for now. 
+        Will fix soon when I address https://bugs.webkit.org/show_bug.cgi?id=31319
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+
+        setShadow() and setPlatformShadow() now take a ColorSpace.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadow):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::createCGColorWithColorSpace): New helper to create a 
+        color in a ColorSpace.
+        (WebCore::setCGFillColor): Call new helper.
+        (WebCore::setCGStrokeColor): Call new helper.
+        (WebCore::GraphicsContext::setPlatformShadow): Call new helper.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Send appropriate ColorSpace to setShadow().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paintDecoration):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Attempt to keep ports building.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-11-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Print the file text of a file upload control in DumpRenderTree for ease of tests.
+        https://bugs.webkit.org/show_bug.cgi?id=31195
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        (WebCore::RenderFileUploadControl::fileTextValue):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::isFileUploadControl):
+        (WebCore::toRenderFileUploadControl):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFileUploadControl):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM Wrappers for some nodes may not be marked.
+        https://bugs.webkit.org/show_bug.cgi?id=31380
+
+        Some markChildren methods are calling getCachedDOMNodeWrapper, which will find
+        the wrapper for the current world only.  This means that wrappers may be GC'ed
+        prematurely, and properties lost.
+
+        Move to a model more like markDOMObjectWrapper, mark wrappers for all worlds.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markDOMNodeWrapper):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::markChildren):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren):
+
+2009-11-11  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        bindings/js/ScriptObject.cpp is missing and ENABLE(INSPECTOR) guard.
+        https://bugs.webkit.org/show_bug.cgi?id=31384
+
+        No functionality change so no tests required.
+
+        * bindings/js/ScriptObject.cpp: Add ENABLE(INSPECTOR) guard around the JSInspectorBackend.h include.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        The Big De-Inlining. 450k code size reduction (32-bit x86.)
+        - Various inline functions in V8Binding.h made non-inline.
+        - Some renaming for consistency.
+        - New function createRawTemplate().
+        https://bugs.webkit.org/show_bug.cgi?id=31383
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8DOMWrapperToNative):
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toInt32):
+        (WebCore::toWebCoreString):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::v8Boolean):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8ExternalString):
+        (WebCore::createRawTemplate):  New function.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8DOMWrapperTo):
+        (WebCore::v8DOMWrapperToNode):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        More V8 de-inlining (outlining?) Abstracted a chunk of boilerplate code from every
+        event-listener setter into a new subroutine transferHiddenDependency().
+        https://bugs.webkit.org/show_bug.cgi?id=31377
+
+        * bindings/scripts/CodeGeneratorV8.pm:  Replace boilerplate with call to transferHiddenDependency().
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::transferHiddenDependency):  New.
+        * bindings/v8/V8Utilities.h:  Declaration of transferHiddenDependency.
+
+2009-11-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        If we are on Windows, don't try and get the kCGColorSpaceSRGB ColorSpace,
+        because there is a CG bug preventing this from working.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that if Storage panel exists before calling its methods
+
+        https://bugs.webkit.org/show_bug.cgi?id=31343
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+        (WebInspector.addCookieDomain):
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        De-inline convertNodeToV8Object(), which expands to a lot of asm code and is inlined 136
+        times in the generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=31368
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object):  Moved body here from .h file
+        * bindings/v8/V8DOMWrapper.h:  Removed inline method body.
+
+2009-11-11  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Display the correct summary in the web inspector for the shorthands
+        border-color, border-width, border-style, margin, and padding.
+        https://bugs.webkit.org/show_bug.cgi?id=7987
+
+        Test: fast/css/shorthands-four-values.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::get4Values):
+        Display the summary information in the same way the shorthand would be
+        specified in a css rule.
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make V8 bindings return NULL handles instead of calling v8::Undefined(). This has equivalent
+        meaning to the caller, saves code, and appears to save a few cycles at runtime too.
+        https://bugs.webkit.org/show_bug.cgi?id=31367
+
+        * bindings/scripts/CodeGeneratorV8.pm: Change "v8::Undefined()" to "v8::Handle<v8::Value>()"
+
+2009-11-11  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Optimize V8 getDOMNodeMap(), a hot function in Dromaeo DOM tests, by increasing inlining.
+
+        * bindings/v8/DOMData.cpp:
+        (WebCore::DOMData::getCurrent):  Moved getCurrentMainThread to MainThreadDOMData::getCurrent
+            so it can be inlined by its caller.
+        * bindings/v8/DOMData.h:
+        * bindings/v8/MainThreadDOMData.cpp:
+        (WebCore::MainThreadDOMData::getCurrent):  Moved here from DOMData.cpp.
+        (WebCore::MainThreadDOMData::getMainThreadStore):  Added UNLIKELY macro to improve codegen.
+        (WebCore::MainThreadDOMData::getCurrentMainThreadStore):  Combination of getCurrentMainThread
+            and getStore, which inline both calls together.
+        * bindings/v8/MainThreadDOMData.h:
+        (WebCore::MainThreadDOMData::getStore):  Broke out nonvirtual getMainThreadStore for inlineability.
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::getDOMNodeMap):  Call new getCurrentMainThreadStore, which is faster.
+
+2009-11-11  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add methods to KURLGoogle.cpp declared in http://trac.webkit.org/changeset/50784 but not defined when using KURLGoogle.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31357
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::isSchemeFirstChar):
+        (WebCore::isSchemeChar):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::removePort):
+        (WebCore::protocolIsValid):
+
+2009-11-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no reviewed.
+
+        Correct setPlatformFillColor and setPlatformStrokeColor calls
+        to match new ColorSpace-supporting signatures.
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:  Add the
+          color space to the set[...]Color calls.
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31327
+        Clean up SocketStreamHandleClient interface
+
+        No change in behavior.
+
+        * platform/network/SocketStreamHandleClient.h: Removed willOpenStream and willSendData.
+        (WebCore::SocketStreamHandleClient::willOpenStream): Removed. This is currently not used by
+        the only client (WebSocketChannel), and it's not clear what this callback's semantics
+        should be.
+        (WebCore::SocketStreamHandleClient::willSendData): Ditto.
+        (WebCore::SocketStreamHandleClient::receivedCancellation): Removed, because it was misplaced.
+        For ResourceHandle, this method is called when the user cancels authentication sheet,
+        not when something happens with the stream.
+
+        * websockets/WebSocketChannel.h: Some WebSocketChannel methods were virtual without any
+        reason. Also, added didReceiveAuthenticationChallenge/didCancelAuthenticationChallenge.
+
+        * websockets/WebSocketChannel.cpp: Adjusted for the above change. Authentication-related
+        callbacks have no real implementation yet.
+
+2009-11-11  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for the part of page directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31350
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class DragController         - instantiated at: WebCore/page/Page.cpp:107
+        class FocusController        - instantiated at: WebCore/page/Page.cpp:109
+        class Settings               - instantiated at: WebCore/page/Page.cpp:116
+        class PluginHalter           - instantiated at: WebCore/page/Page.cpp:160
+        struct ScheduledEvent        - instantiated at: WebCore/page/FrameView.cpp:1275
+        class UserScript             - instantiated at: WebCore/page/PageGroup.cpp:208
+        struct EventHandlerDragState - instantiated at: WebCore/page/EventHandler.cpp:182
+        class XSSAuditor             - instantiated at: WebCore/bindings/js/ScriptController.cpp:70
+        class UserStyleSheet         - instantiated at: WebCore/page/PageGroup.cpp:222
+
+        Inherits PropertyWrapperBase class from Noncopyable because (its child class) 
+        PropertyWrapper is instantiated by 'new' in 
+        WebCore/page/animation/AnimationBase.cpp:564 it is no need to be copyable.
+
+        * page/DragController.h:
+        * page/EventHandler.h:
+        * page/FocusController.h:
+        * page/FrameView.cpp:
+        * page/PluginHalter.h:
+        * page/Settings.h:
+        * page/UserScript.h:
+        * page/UserStyleSheet.h:
+        * page/XSSAuditor.h:
+        * page/animation/AnimationBase.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31323
+        Fix a few compiler warnings
+
+        No new tests as there is no new functionality.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Use explicit
+        parentheses to silence gcc 4.4 -Wparentheses warnings
+
+2009-11-11  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Set m_hasPendingGeometryChange to true by default, so that
+        at least one call to NPP_SetWindow is executed, which is
+        needed by the DRT plugin testing framework.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+
+2009-11-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31348
+        [Qt] Remove unnecessary LUT creator from WebCore.pro
+
+        * WebCore.pro:
+
+2009-11-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce a function for querying the input method status
+        in QWebPageClient.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-11-11  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Black artifacts in youtube.com/html5
+
+        Paint the video to the given size. It's the job of the callers to keep
+        track of aspect ratio. RenderVideo.cpp does it for the <video>
+        element.
+        https://bugs.webkit.org/show_bug.cgi?id=30925
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-11-11  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Cleaned up some missed capitalization style-guideline violations.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Make the default style background color valid.
+        Currently the color is transparent but invalid, this causes
+        list boxes in QtWebKit to be drawn with a black background
+        since r49242.
+        https://bugs.webkit.org/show_bug.cgi?id=31295
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialBackgroundColor):
+        * rendering/style/StyleBackgroundData.cpp:
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Simplify the ownership model for worlds - rather than having a pair of weak references
+        between DOMWrapperWorld and ScriptController/ScriptCachedFrameData, give the latter an
+        ref pointer to the former.  This reduces complexity & cost of the caching entries in the
+        back forward cache.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::forgetDocument):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        rename counter to makeCounterNode in RenderCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=31289
+
+        No new test because this is just a small refactoring.
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::makeCounterNode):
+        (WebCore::RenderCounter::originalText):
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 2 of 2.
+
+        Removed method EventHandler::dragSourceMovedTo, since it is no longer
+        needed. This method fired a drag event whenever the mouse moved, but
+        section 7.9.4 of the HTML 5 spec. defines the drag-and-drop processing
+        model independent of when the mouse moves. See "Among other changes..."
+        in the change log for patch 1 for more details.
+
+        * WebCore.DragSupport.exp:
+        * page/EventHandler.cpp: Removed method EventHandler::dragSourceMovedTo.
+        (WebCore::EventHandler::handleDrag): Updated comment about reentrancy issue.
+        * page/EventHandler.h:
+
+2009-11-10  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30754
+
+        Patch 1 of 2.
+
+        As per Section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>,
+        the drag event should always fire before the dragover event.
+
+        In fixing this bug, this patch also makes our drag processing model
+        conform to the HTML 5 spec.
+
+        Among the changes, this patch ensures that the drag event isn't fired outside
+        of the drag-and-drop processing loop, WebCore::EventHandler::updateDragAndDrop.
+        Currently, the drag event is fired whenever the mouse button is down and the OS
+        detects the mouse moved. But, as per the spec, the drag event should
+        fire approx. every 350ms so long as the mouse button is down.
+
+        Test: fast/events/drag-and-drop-fire-drag-dragover.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::canHandleDragAndDropForTarget): Formerly named handleDragAndDropForTarget.
+        Modified to determine when we are in the correct instance of EventHandler to service the drag
+        and drop operation.
+        (WebCore::EventHandler::updateDragAndDrop): Moved code from WebCore::EventHandler::dragSourceMovedTo
+        into this method.
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::clearDragState):
+        * page/EventHandler.h: Added field m_shouldOnlyFireDragOverEvent to determine whether
+        we should fire both drag and dragover events or only the dragover event.
+
+2009-11-10  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix crash in V8CustomXPathNSResolver (http://crbug.com/26726).
+        https://bugs.webkit.org/show_bug.cgi?id=31301
+
+        Tested by new fast/xpath/xpath-detached-iframe-resolver-crash.html.
+
+        Allowed passing V8Proxy for the calling JS context:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::create):
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver):
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8CustomXPathNSResolver.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement URL decomposition IDL attributes for HTMLAnchorElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29972.
+
+        Add methods for setting different parts of the URL in href attribute.
+
+        Tests: fast/dom/HTMLAnchorElement/set-href-attribute-hash.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-host.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-hostname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-port.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-protocol.html
+               fast/dom/HTMLAnchorElement/set-href-attribute-search.html
+
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setPort):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::parsePortFromStringPosition):
+        (WebCore::HTMLAnchorElement::setHash):
+        (WebCore::HTMLAnchorElement::setHost):
+        (WebCore::HTMLAnchorElement::setHostname):
+        (WebCore::HTMLAnchorElement::setPathname):
+        (WebCore::HTMLAnchorElement::setPort):
+        (WebCore::HTMLAnchorElement::setProtocol):
+        (WebCore::HTMLAnchorElement::setSearch):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        * platform/KURL.cpp:
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::prettyURL):
+        (WebCore::protocolIsValid):
+        * platform/KURL.h:
+        (WebCore::KURL::canSetHostOrPort):
+        (WebCore::KURL::canSetPathname):
+        (WebCore::KURL::hasPort):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+
+2009-11-10  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, fix Chromium build after http://trac.webkit.org/changeset/50760.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+
+2009-11-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Repro crash saving pcmag.com article as a webarchive.
+        <rdar://problem/7381219> and https://webkit.org/b/31322
+
+        Test: http/tests/webarchive/cross-origin-stylesheet-crash.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Walk the stylesheet itself instead
+          of creating a CSSRuleList (and subjecting ourselves to the security origin check)
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempt 2 to fix Tiger build. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::deviceRGBColorSpaceRef):
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Changes needed after r50760.
+
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Qt build fix.
+
+        * platform/network/ResourceHandle.h: Only inherit from AuthenticationClient on platforms
+        that use ResourceHandle as a delegate (Mac, CFNetwork, Curl).
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Tiger build fix. No review needed.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef):
+
+2009-11-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31312
+        Decouple authentication panel callbacks from ResourceHandle
+
+        No change in functionality.
+
+        SocketStreamHandle also needs to request credentials, so it's not appropriate to store
+        ResourceHandle as delegate.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/AuthenticationClient.h: Added.
+        Added a new interface for listening to authentication panel notifications.
+
+        * WebCore.xcodeproj/project.pbxproj: Added AuthenticationClient.h. Let Visual Studio do what
+        it wants with the project file.
+
+        (WebCore::AuthenticationClient::ref): Using our usual method of exposing refcounting on an
+        interface class.
+        (WebCore::AuthenticationClient::deref): Ditto.
+
+        * platform/network/ResourceHandle.h:
+        (WebCore::ResourceHandle::refAuthenticationClient): Ditto.
+        (WebCore::ResourceHandle::derefAuthenticationClient): Ditto.
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/cf/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/chromium/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        * platform/network/curl/AuthenticationChallenge.h:
+        (WebCore::AuthenticationChallenge::authenticationClient):
+        Keeping a reference to AuthenticationClient, not to ResourceHandle.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+       Second attempted gtk build fix. No review needed.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+
+2009-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix back/forwards cache with JSC isolated worlds.
+        https://bugs.webkit.org/show_bug.cgi?id=31310
+        <rdar://problem/7328111> Cached back navigation doesn't restore global object in extension isolated world
+
+        Store the global object for all worlds, not just the normal world.
+        Also maintain bidirectional weak references between the ScriptCachedFrameData and the DOMWrapperWorld,
+        so we can forget global objects if a world goes away.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMWrapperWorld::~DOMWrapperWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMWrapperWorld::rememberScriptCachedFrameData):
+        (WebCore::DOMWrapperWorld::forgetScriptCachedFrameData):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::forgetWorld):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h:
+        * bindings/js/ScriptController.h:
+
+2009-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix after r50760.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix. (No review needed.)
+
+        * GNUmakefile.am: Adding ColorSpace.h
+
+2009-11-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by NOBODY - Build Fix.
+
+        Updated function calls to take a ColorSpace argument, passing
+        in DeviceColorSpace for now - this should be fixed. Also added
+        ColorSpace.h to WebCore project.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-11-10  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimizations to Element::getAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=30926
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):  User case-insensitive compare instead of lowercasing the name.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem):  Avoid redundant compares, and do fast/likely compares first.
+        * platform/text/PlatformString.h:
+        (WebCore::equalPossiblyIgnoringCase):  New inline method, used by both of the above.
+
+2009-11-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7059710> 
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=31196 Implement -webkit-
+        color-correction for CSS colors
+
+        New exported symbol for GraphicsContext::fillColor() which now 
+        accepts a ColorSpace as an optional parameter.
+        * WebCore.base.exp:
+
+        Added a new file, ColorSpace.h, to define the ColorSpace enum.
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Computed Style for -webkit-color-correction
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Parse -webkit-color-correction
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+       Map CSS identifiers to the appropriate values of the ColorSpace enum
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+
+        New property -webkit-color-correction
+        * css/CSSPropertyNames.in:
+
+        Map -webkit-color-correction into the RenderStyle.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add new value sRGB.
+        * css/CSSValueKeywords.in:
+
+        Comment out the reference to sRGB since it will now be inherited as 
+        a value from CSSValueKeywords.
+        * css/SVGCSSValueKeywords.in:
+
+        Definition of the ColorSpace enum.
+        * platform/graphics/ColorSpace.h: Added.
+        (WebCore::):
+
+        These functions all now take a ColorSpace as a parameter.
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::drawHighlightForText):
+
+        Return the appropriate ColorSpace.
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+
+        These functions all call other functions which require a ColorSpace 
+        as a parameter.
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+
+        All of the GraphicsContext functions that take a Color should now 
+        also take a ColorSpace.
+        * platform/graphics/GraphicsContext.h:
+
+        Added new member variables stokeColorSpace and fillColorSpace.
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+
+        Attempt to keep the Cairo port building with all of the massive 
+        changes to GraphicsContext.        
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+        
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::sRGBColorSpaceRef): New static function that returns a 
+        CGColorSpaceRef for the sRGB color space.
+        (WebCore::deviceRGBColorSpaceRef): New static function that returns 
+        a CGColorSpaceRef for the device RGB color space.
+
+        (WebCore::setCGFillColor): Now takes a ColorSpace parameter and 
+        sets the fill color to the specified color in the given ColorSpace.
+        (WebCore::setCGStrokeColor): Same, but for stroke.
+
+        (WebCore::setCGFillColorSpace): New static to set the 
+        CGFillColorSpace to the given ColorSpace
+        (WebCore::setCGStrokeColorSpace): Same, but for stroke.
+
+        Send ColorSpaces when appropriate, set ColorSpaces when 
+        appropriate, and check ColorSpaces when appropriate.
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Haiku building.
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep QT building.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Attempt to keep Wince building.
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+        Attempt to keep WX building.
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+
+        Added functions colorSpace() and setColorSpace()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::colorSpace):
+        (WebCore::InheritedFlags::setColorSpace):
+
+        The ColorSpace is stored here.
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+        All of these call sites call GraphicsContext functions which now 
+        require ColorSpaces.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::fillWithSolidColor):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::updateGraphicsContext):
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillHorizontalSelectionGap):
+        (WebCore::RenderBlock::fillVerticalSelectionGap):
+        (WebCore::RenderBlock::fillLeftSelectionGap):
+        (WebCore::RenderBlock::fillRightSelectionGap):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paintColumnBorder):
+        (WebCore::RenderFrameSet::paintRowBorder):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2009-11-10  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Speed up syntax highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=31291
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine): Replace the line content node.
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        (WebInspector.JavaScriptSourceSyntaxHighlighter):
+
+2009-11-09  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove session storage setting
+        https://bugs.webkit.org/show_bug.cgi?id=31279
+
+        Remove session storage from Settings.  It was added temporarily so we could
+        disable it by default at runtime in Chromium.  We now disable these things in a
+        different way, so it's time to remove it.  Qt also depended on this setting for
+        a short period of time, but after talking to them we agreed that it should be
+        removed.
+
+        This bug is the second half of https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Carlson and Darin Adler.
+
+        WebCore part of making full-screen video pause during scrubbing.
+
+        * WebCore.Video.exp: Sorted and added HTMLMediaElement::beginScrubbing()
+        and HTMLMediaElement::endScrubbing().
+
+2009-11-10  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reapply 50562 reverted by 50588 due to issues with sandboxing (should be fine now).
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        WebKit coding style fixes.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::mimeTypeCache):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Remove build failure introduced by earlier build fix.
+
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Is this the last build fix? grep tells me yes.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Hopefully the last one.  Why aren't these autogenerated?
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Another chrome build fix.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Yet another chrome buildfix
+
+        * bindings/v8/custom/V8WebGLArrayBufferCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebGLArrayCustom.h:
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8WebGLByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLFloatArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8WebGLShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Chrome build fix.
+
+        * bindings/v8/V8Index.h:
+
+2009-11-10  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30901
+        [Gtk] Need to de-lint the Atk a11y code
+
+        Removal of various and sundry style-violating nits.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-11-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31047
+        [GTK] Failing test media/video-played-ranges-1.html
+
+        Fix playback rate setter by remembering the rate was changed. Also
+        correctly handle reverse playback by doing a seek from end to
+        beginning of the media.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename 3D Canvas related classes to use WebGL prefix
+        https://bugs.webkit.org/show_bug.cgi?id=29095
+
+        Automatic rename of all WebGL related types from Canvas* to
+        WebGL* per more recent version of the WebGL spec.
+
+        Due to the automatic rename I've removed the 600+ line change list.
+
+2009-11-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feDisplacementMap is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=31255]
+
+        This is the implementation of the SVG filter effect
+        feDisplacementMap. 
+
+        Test: svg/filters/feDisplacementMap.svg
+
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+
+2009-11-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add a comment about null strings and hash functions.
+        https://bugs.webkit.org/show_bug.cgi?id=29118
+
+        * platform/text/StringHash.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Compiler warnings in InspectorResource.h
+        https://bugs.webkit.org/show_bug.cgi?id=29231
+
+        Fix compilation warnings by removing addition operation on an enum type.
+
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::):
+        (WebCore::InspectorResource::Changes::hasChange):
+        (WebCore::InspectorResource::Changes::set):
+        (WebCore::InspectorResource::Changes::setAll):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved macro MMP_RULES (LINKEROPTION) into symbian instead of symbian-sbsv2,
+        since adjustment of RW-section base address will be needed for all new symbian
+        tool chains, specifically for arm and gcc compilation targets.
+        Also, change target address to 0xE00000 to be sufficient for all targets.
+
+        * WebCore.pro:
+
+2009-11-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash when inspecting
+        WebCore\manual-tests\inspector\dom-mutation.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=31259
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Few classes have virtual functions but non-virtual destructor
+        https://bugs.webkit.org/show_bug.cgi?id=31269
+
+        No new tests as there is no functional change.
+
+        * platform/qt/QWebPageClient.h:
+        (QWebPageClient::~QWebPageClient): Add virtual destructor.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Allow setting HTTP headers with empty value in XMLHTTPRequest
+        https://bugs.webkit.org/show_bug.cgi?id=31140
+
+        QtNetwork interprets null string as request to remove the header, not add it.
+        Replace null values with empty values before passing them to QtNetwork.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-09  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Fix handling of alpha channel when using wxWidgets 2.9: it was
+        simply ignored before resulting in transparent areas being black in PNG
+        images for example.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30823
+
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        No new tests as there is no functional change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyleSelector):
+        * editing/TextIterator.cpp:
+        (WebCore::pushFullyClippedState):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * svg/SVGAnimateElement.cpp:
+        (WebCore::parseNumberValueAndUnit):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::startedActiveInterval):
+        * svg/SVGPreserveAspectRatio.cpp:
+        (WebCore::SVGPreserveAspectRatio::getCTM):
+
+2009-11-09  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Win chromium is slow to draw transparent texts
+        https://bugs.webkit.org/show_bug.cgi?id=31258
+
+        Clip graphics context to reduce calculation.
+
+        No new tests because this change only affects performance.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+
+2009-11-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        showTree(CounterNode*) generates too little info and has too many spaces.
+        https://bugs.webkit.org/show_bug.cgi?id=31212
+
+        No new tests as the change has no functional effect it is just for
+        improved debugging.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+        Changed to also show addresses of parent, next and previous
+        siblings.
+
+2009-11-09  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Moves Mac implementation of setUseSecureKeyboardEntry to Frame.cpp and
+        enables it PLATFORM(CHROMIUM) in addition to PLATFORM(MAC).
+
+        https://bugs.webkit.org/show_bug.cgi?id=31083
+
+        No new tests; implementation is unchanged.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setUseSecureKeyboardEntry):
+        * page/mac/FrameMac.mm:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Make XP_UNIX tests consistent
+        https://bugs.webkit.org/show_bug.cgi?id=31250
+
+        No new tests as there is no functional change.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Test if XP_UNIX is defined
+        instead of the value of the macro
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Test if the XP_UNIX is
+        defined instead of using the PLATFORM macro to be consistent
+        (WebCore::PluginView::getValue): Ditto.
+
+2009-11-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Thunk to the main thread from ~Database to deref Database's m_document.
+
+        If the Database was the Document's last referrer, then ~Document occurs on the
+        Database thread, and ASSERT(!m_styleRecalcTimer.isActive()) hits a main thread
+        ASSERT in debug builds.
+
+        * storage/Database.cpp:
+        (WebCore::derefDocument):
+        (WebCore::Database::~Database):
+
+2009-11-09  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Track "can have scrollbar" state within FrameView independently of the
+        individual scrollbar states in ScrollView.
+
+        rdar://problem/7215132, https://bugs.webkit.org/show_bug.cgi?id=29167
+        REGRESSION (r48064): mint.com loses scrollbars after coming out of
+        edit mode.
+
+        rdar://problem/7314421, https://bugs.webkit.org/show_bug.cgi?id=30517
+        REGRESSION (r48064): Extra scroll bars in GarageBand Lesson Store.
+
+        Test: fast/overflow/scrollbar-restored.html
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+2009-11-09  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: CSS syntax highlighter doesn't recognize negative numbers
+        https://bugs.webkit.org/show_bug.cgi?id=31257
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open
+        https://bugs.webkit.org/show_bug.cgi?id=31252
+
+        Route F1-F12 keypresses in the Console view to the current panel if there is one.
+
+        Test: manual-tests/inspector/debugger-shortcuts-with-console-opened.html
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/utilities.js:
+        ():
+        * manual-tests/inspector/debugger-shortcuts-with-console-opened.html: Added.
+
+2009-11-09  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Pass credentials provided by XMLHTTPRequest to the network request.
+        https://bugs.webkit.org/show_bug.cgi?id=31208
+
+        After r42483, the credentials are no longer passed to the network request
+        in the URL of the request.
+        Pass the credentials from XMLHTTPRequest to the network request, the same
+        way that other ports do.
+
+        After this patch LayoutTests/http/xmlhttprequest/basic-auth.html passes.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Unreviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Roll back r50657 because it breaks the MAC builds.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the part of loader directory in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31161
+
+        Inherits the following classes from Noncopyable because these are instantiated
+        by 'new' and these are no need to be copyable:
+
+        class Request - WebCore/loader/loader.cpp:100
+        struct ScheduledRedirection - WebCore/loader/RedirectScheduler.cpp:164
+        class IconDatabaseClient - WebCore/loader/icon/IconDatabase.cpp:89
+        class ApplicationCacheStorage - WebCore/loader/appcache/ApplicationCacheStorage.cpp:1121
+        class ApplicationCacheHost -  WebCore/loader/DocumentLoader.cpp:151
+        class ImageEventSender - WebCore/loader/ImageLoader.cpp:54
+        struct ProgressItem - WebCore/loader/ProgressTracker.cpp:169
+
+        Inherits ThreadableLoaderClient class from Noncopyable because (its child class) 
+        MainThreadBridge is instantiated by 'new' in 
+        WebCore/loader/WorkerThreadableLoader.cpp:59 it is no need to be copyable.
+
+        ThreadableLoaderClient's inheriting has been changed to public.
+
+        * loader/ImageLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/RedirectScheduler.cpp:
+        * loader/Request.h:
+        * loader/ThreadableLoaderClient.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DocLoader
+        https://bugs.webkit.org/show_bug.cgi?id=31163
+
+        Inherits DocLoader class from Noncopyable because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:370 and 
+        it is no need to be copyable.
+
+        * loader/DocLoader.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's Tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=31162
+
+        Inherits Tokenizer class from Noncopyable because (its child class)
+        ImageTokenizer instantiated by 'new' in WebCore/loader/ImageDocument.cpp:178 
+        and it is no need to be copyable.
+
+        * dom/Tokenizer.h:
+
+2009-11-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's DeleteButtonController
+        https://bugs.webkit.org/show_bug.cgi?id=31105
+
+        Inherits DeleteButtonController class from Noncopyable because it is 
+        instantiated by 'new' in WebCore/editing/Editor.cpp:919 and
+        it is no need to be copyable.  
+
+        * editing/DeleteButtonController.h:
+
+2009-11-09  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Expose Page::tabKeyCyclesThroughElements in the API
+        https://bugs.webkit.org/show_bug.cgi?id=30482
+
+        Expose Page::tabKeyCyclesThroughElements as a property of
+        WebKitWebView.
+
+        No new tests; fast/events/keypress-insert-tab.html is no longer skipped.
+
+        * platform/gtk/KeyEventGtk.cpp: Correct m_text for tab key presses.
+        (WebCore::singleCharacterString):
+
+2009-11-09  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Fix a crasher that occurred with text which included newline
+        chars in the markup.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (convertUniCharToUTF8):
+
+2009-11-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] The XML tokenizer reports a parse error twice if it occurs before the document element is found.
+        https://bugs.webkit.org/show_bug.cgi?id=31144
+
+        XMLTokenizer::doEnd() uses an additional logic to report a parse failure in
+        documents that end prematurely but are not considered invalid by QXmlStream.
+        This is to stay compatible with the libxml2 implementation.
+        However, that code path would be also hit in situations when it should not,
+        i.e. the error would have already been caught and handled. As a result, the
+        same error would be reported twice.
+
+        No new tests, because the problem is already covered by
+        fast/parser/xml-declaration-missing-ending-mark.html.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+
+2009-11-08  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector should support copy() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=31238
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyText): Added.
+        * inspector/InspectorBackend.h: Added copyText
+        * inspector/InspectorBackend.idl: Added copyText
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._copy): Added.
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-08  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 WorkerContextExecutionProxy does not handle SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=31226
+
+        Now checks to see what type of context is active and creates the
+        appropriate wrapper (DEDICATEDWORKERCONTEXT vs SHAREDWORKERCONTEXT).
+
+        Added support for converting to SharedWorkers and SharedWorkerContexts.
+
+        Test: Existing layout tests cover this case (start passing in Chrome).
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        Now generates the right type of DOMWrapper for SharedWorkerContexts.
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        Added support for SHAREDWORKERCONTEXT.
+        (WebCore::WorkerContextExecutionProxy::convertEventTargetToV8Object):
+        Added support for SharedWorker and SharedWorkerContext.
+
+2009-11-08  Johnny Ding  <johnnyding.webkit@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31224
+        [V8] Return StyleSheet object instead of HTMLStyleElement w/document.styleSheets named property getter.
+
+        Test: fast/dom/StyleSheet/get-stylesheet-byname.html
+
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: "Search again" on scripts panel switches
+        to the script this search started with.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31243
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.jumpToNextSearchResult):
+
+2009-11-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Simplify Icon interface.
+        https://bugs.webkit.org/show_bug.cgi?id=31154
+
+        - Remove Icon::createIconForFile().  createIconForFiles() covers
+          createIconForFile()'s role.
+        - Remove FileChooser::chooseIcon()
+        - Change the parameter types of FileChooser constructor and the
+          factory method, String -> const Vector<String>&, in order to
+          support initialization with multiple files.
+        - Remove the icon loading code in IconChromiumWin.cpp, which
+          doesn't work because of the sandbox.
+
+        No tests because it's just a refactoring.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        * platform/FileChooser.h:
+        * platform/graphics/Icon.h:
+        * platform/graphics/chromium/IconChromiumLinux.cpp:
+        * platform/graphics/chromium/IconChromiumMac.cpp:
+        * platform/graphics/chromium/IconChromiumWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/haiku/IconHaiku.cpp:
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/wx/IconWx.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
+
+2009-11-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31098
+
+        Allows same-origin plugin-based content to load.
+
+        Test: http/tests/security/xssAuditor/object-src-inject.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc): Modified to call XSSAuditor::isSameOriginResource.
+        (WebCore::XSSAuditor::canLoadObject): Ditto.
+        (WebCore::XSSAuditor::canSetBaseElementURL): Ditto. 
+        (WebCore::XSSAuditor::isSameOriginResource): Added.
+        * page/XSSAuditor.h:
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Changed this to not
+        use a date parser that needs ExecState passed.
+        
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Build fix for https://bugs.webkit.org/show_bug.cgi?id=31219
+        Clean up GraphicsContext's current concept of ColorSpace
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-11-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] committing style edit
+        clears elements panel selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31242
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-11-08  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Holger Freyther.
+
+        ResourceRequest to be class instead of struct
+        https://bugs.webkit.org/show_bug.cgi?id=30670
+
+        Started as a compilation fix for Symbian where the compiler makes a distinction between
+        class and struct in function argument signatures.
+        Changed all forward declarations of ResourceRequest to have class in the forward
+        declaration instead of struct and changed the definition of ResourceRequest to be class
+        and added access qualifiers where missing. Additionally two references of friend
+        struct ResourceRequestBase changed to class instead.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/ResourceLoadNotifier.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheHost.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/soup/ResourceRequest.h:
+        * xml/XMLHttpRequest.h:
+
+2009-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7363434> Crash inside RenderObject::localToAbsolute
+        below FrameView::layout
+        https://bugs.webkit.org/show_bug.cgi?id=31093
+
+        Test: fast/block/positioning/relative-positioned-inline-container.html
+
+        In <http://trac.webkit.org/changeset/19148>, setStaticY() was changed
+        to mark the object for layout, doing so without marking its ancestors.
+        However, RenderBlock::skipLeadingWhitespace and
+        RenderBlock::skipTrailingWhitespace() call setStaticY() on a relative-
+        positioned inline container, causing it to be marked for layout without
+        ever going back to give it layout, and thus layout could end with a
+        dirty object still in the tree, leading to all sorts of badness.
+
+        The fix is to revert setStaticY() to not marking the object dirty, and
+        instead do it in the call sites that require it, which are in
+        RenderBlock and RenderFlexibleBox.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::setStaticY):
+
+2009-11-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20780
+        
+        Fixes an issue where the onchange event handler is not fired when the 
+        input field is autocompleted.
+        
+        We cannot test this using DRT since DRT cannot emulate autocompletion.
+        So, a manual-test is included.
+
+        Tests: manual-tests/autocompletion-fire-onchange.html
+
+        * manual-tests/autocompletion-fire-onchange.html: Added.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-11-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Mark redrawn areas on image surfaces as dirty.
+
+        This is required to conform to the Cairo API, but is currently only
+        used by debugging tools like cairo-trace.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::putImageData):
+
+2009-11-07  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30878
+        [Gtk] atk_text_get_text() fails in entries when the end_offset is -1
+
+        If the end_offset is -1, use the String length as the end_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_text):
+
+2009-11-06  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=31219 Clean up 
+        GraphicsContext's current concept of ColorSpace
+
+        ColorSpace is now called ColorType. The variables on the state we 
+        appropriately re-named as well. I removed strokeColorSpace() and 
+        fillColorSpace() from GraphicsContext since they were never called. 
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokeColor):
+        (WebCore::GraphicsContext::setFillColor):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-11-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixes <http://webkit.org/b/31177>.
+        Web Inspector: Bind backspace to delete cookies and DOM Storage.
+        
+        Refactor editing code from DOMStorageDataGrid to DataGrid, so other
+        places in the inspector can use editing in DataGrid (added a FIXME for
+        some stuff that needs to be generalized).
+        
+        Also added deleting functionality to DataGrid, and implemented it for
+        Cookies and DOM Storage. The reason this patch is so big is because of
+        the refactoring of editing code, which won't be used yet in a cross-datagrid
+        way, but should be able to.
+        
+        Additionally, moved the callbacks members from DOMStorageDataGrid to
+        DOMStorageItemsView, which allowed us to delete DOMStorageDataGrid, to 
+        make the architecture of DOM Storage look a lot more like the Cookies view.
+        
+        Lastly, added a preventDefault call in ElementsTreeOutline to prevent the 
+        inspector from beeping at you when you delete an element.
+
+        * WebCore.gypi: Removed DOMStorageDataGrid.
+        * WebCore.vcproj/WebCore.vcproj: Removed DOMStorageDataGrid.
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        (WebInspector.CookieItemsView.prototype._deleteCookieCallback):
+        * inspector/front-end/DOMStorageDataGrid.js: Removed.
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        (WebInspector.DOMStorageItemsView.prototype._editingCallback):
+        (WebInspector.DOMStorageItemsView.prototype.deleteSelectedRow):
+        (WebInspector.DOMStorageItemsView.prototype._deleteCallback):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype._ondblclick): Moved from DOMStorageDataGrid to DataGrid + Refactoring.
+        (WebInspector.DataGrid.prototype._startEditingColumnOfDataGridNode): Ditto.
+        (WebInspector.DataGrid.prototype._startEditing): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted.moveToNextIfNeeded): Ditto.
+        (WebInspector.DataGrid.prototype._editingCommitted): Ditto.
+        (WebInspector.DataGrid.prototype._editingCancelled): Ditto.
+        (WebInspector.DataGrid.prototype.handleKeyEvent): Added case for delete/backspace.
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): Added preventDefault call.
+        * inspector/front-end/WebKit.qrc: Removed DOMStorageDataGrid.
+        * inspector/front-end/inspector.html: Removed DOMStorageDataGrid.
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added an ExecState parameter.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+
+        Updated for JavaScriptCore internal API change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue): Updated for namespace change.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Pass 0 for ExecState, since we don't have one.
+        (This function probably shouldn't be using a JavaScript date parser
+        to begin with, but oh well.)
+
+2009-11-06  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        The associated webkit bug is https://bugs.webkit.org/show_bug.cgi?id=31067,
+        which affects Chromium only.
+        
+        Changes to V8HTMLDocumentCustom.cpp are as below:-
+        1. The HTMLDocumentOpen function would cause a crash in Chromium if
+           there was no calling javascript context. We now check for this case
+           and pass in NULL to the HTMLDocument::open function which can handle
+           a NULL document parameter.
+        2. The other functions like HTMLDocumentWrite, HTMLDocumentWriteln, etc
+           had ASSERTS for a NULL caller frame, which was bogus as it would crash
+           anyway. We now check for this case and return a failure.
+           
+        Changes to V8DOMWindowCustom.cpp are as below:-
+        1. Instead of failing the window.open call made by NPAPI for lack of a
+           calling javascript context, we now use the entered context as the calling
+           context.
+
+        Tests: plugins/document-open.html
+               plugins/window-open.html
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Geolocation error code UNKNOWN_ERROR is deprecated.
+        https://bugs.webkit.org/show_bug.cgi?id=31184
+
+        Remove this error code from PositionError, both for use from C++ code and from the JS object.
+
+        Updated fast/dom/Geolocation/error.html to test this.
+
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::): Remove ErrorCode::UNKNOWN_ERROR.
+        * page/PositionError.idl: Modified. Remove UNKNOWN_ERROR constant.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::startRequest): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::startUpdating): Replace UNKNOWN_ERROR with POSITION_UNAVAILABLE.
+
+2009-11-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        The Implementation of feMorphology.
+        
+        Test: We have allready a test for feMorphology
+              svg/W3C-SVG-1.1/filters-morph-01-f.svg
+
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+
+2009-11-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        V8DOMWindowCustom.cpp is missing WEB_SOCKETS guard on include.
+        https://bugs.webkit.org/show_bug.cgi?id=31209
+
+        Build fix only. No new tests possible.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Modified. Added WEB_SOCKETS guard on inclue of WebSockets.h.
+
+2009-11-06  Drew Wilson  <atwilson@chromium.org>
+
+        Reviewed by David Levin.
+
+        V8 bindings do not support SharedWorkers as event targets
+        https://bugs.webkit.org/show_bug.cgi?id=31199
+
+        No new tests because existing layout tests suffice (they currently
+        crash on Chromium)
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        Added clause to create a DOM wrapper for SharedWorkers.
+
+2009-11-06  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not unnecessarly synchronzie in weak reference callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=31191
+
+        * bindings/v8/DOMData.h:
+        (WebCore::DOMData::handleWeakObject):
+
+2009-11-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix resource content search.
+        https://bugs.webkit.org/show_bug.cgi?id=31202
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-05  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT(currentStyle = renderStyle()).
+        https://bugs.webkit.org/show_bug.cgi?id=31152
+
+        * dom/Element.cpp:
+        (WebCore::Element::pseudoStyleCacheIsInvalid): We should have used "==" instead of "=".
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Revert 50562 because it broke Chromium. Not reviewed since this is a build fix and revert.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::V8GCController::gcEpilogue):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Cross-domain access to stylesheet text should not be allowed
+        https://bugs.webkit.org/show_bug.cgi?id=20527
+
+        Check whether whether the current document can read the cssRules from
+        the style sheet.  Firefox throws a security error here, but we return
+        null instead because that's what we usually do in these cases.
+
+        Test: http/tests/security/cannot-read-cssrules-redirect.html
+              http/tests/security/cannot-read-cssrules.html
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::cssRules):
+
+2009-11-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        If the Geolocation service fails to start, invoke the error callback asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=28276
+
+        All Geolocation callbacks must be invoked asynchronously.
+        See http://www.w3.org/TR/geolocation-API/#geolocation_interface
+
+        No new tests possible with current LayoutTestController.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::getCurrentPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::watchPosition): Modified. Asserts that startRequest returned a notifier.
+        (WebCore::Geolocation::startRequest): Modified. If the Geolocation service fails to start, set a fatal error on the notifier.
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/scripts/IDLStructure.pm:
+        * css/CSSInheritedValue.cpp:
+        * css/CSSInitialValue.cpp:
+        * css/CSSMediaRule.cpp:
+        * css/CSSNamespace.h:
+        * css/CSSProperty.cpp:
+        * css/CSSProperty.h:
+        * css/CSSRuleList.cpp:
+        * css/CSSRuleList.h:
+        * css/CSSSelector.h:
+        * css/CSSValueList.cpp:
+        * css/FontValue.cpp:
+        * css/MediaFeatureNames.cpp:
+        * css/MediaFeatureNames.h:
+        * css/Pair.h:
+        * css/SVGCSSStyleSelector.cpp:
+        * css/ShadowValue.cpp:
+        * css/StyleSheet.cpp:
+        * css/StyleSheetList.cpp:
+        * css/maketokenizer:
+        * dom/BeforeUnloadEvent.cpp:
+        * dom/BeforeUnloadEvent.h:
+        * dom/CSSMappedAttributeDeclaration.cpp:
+        * dom/EventNames.cpp:
+        * dom/EventTarget.cpp:
+        * dom/MappedAttributeEntry.h:
+        * dom/MouseRelatedEvent.h:
+        * dom/RangeException.h:
+        * dom/StyleElement.h:
+        * dom/Tokenizer.h:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageLoader.h:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTablePartElement.cpp:
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTitleElement.h:
+        * page/MouseEventWithHitTestResults.h:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicStringImpl.h:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        * rendering/AutoTableLayout.h:
+        * rendering/CounterNode.cpp:
+        * rendering/EllipsisBox.cpp:
+        * rendering/EllipsisBox.h:
+        * rendering/FixedTableLayout.cpp:
+        * rendering/FixedTableLayout.h:
+        * rendering/HitTestRequest.h:
+        * rendering/HitTestResult.h:
+        * rendering/InlineRunBox.h:
+        * rendering/PointerEventsHitRules.cpp:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFrameSet.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        * rendering/SVGInlineTextBox.h:
+        * rendering/TableLayout.h:
+        * rendering/break_lines.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        * rendering/style/SVGRenderStyleDefs.h:
+        * svg/GradientAttributes.h:
+        * svg/LinearGradientAttributes.h:
+        * svg/PatternAttributes.h:
+        * svg/RadialGradientAttributes.h:
+        * svg/SVGAElement.cpp:
+        * svg/SVGAngle.idl:
+        * svg/SVGAnimateColorElement.cpp:
+        * svg/SVGAnimateColorElement.h:
+        * svg/SVGAnimateElement.cpp:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimateTransformElement.h:
+        * svg/SVGAnimatedPathData.cpp:
+        * svg/SVGAnimatedPathData.h:
+        * svg/SVGAnimatedPoints.cpp:
+        * svg/SVGAnimatedPoints.h:
+        * svg/SVGAnimationElement.cpp:
+        * svg/SVGCircleElement.cpp:
+        * svg/SVGClipPathElement.cpp:
+        * svg/SVGColor.cpp:
+        * svg/SVGColor.idl:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGCursorElement.cpp:
+        * svg/SVGDefsElement.cpp:
+        * svg/SVGDescElement.cpp:
+        * svg/SVGDescElement.h:
+        * svg/SVGDocument.idl:
+        * svg/SVGElement.idl:
+        * svg/SVGElementInstanceList.cpp:
+        * svg/SVGElementInstanceList.h:
+        * svg/SVGEllipseElement.cpp:
+        * svg/SVGExternalResourcesRequired.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGGElement.cpp:
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGHKernElement.idl:
+        * svg/SVGLangSpace.cpp:
+        * svg/SVGLangSpace.h:
+        * svg/SVGLength.cpp:
+        * svg/SVGLength.h:
+        * svg/SVGLength.idl:
+        * svg/SVGLengthList.cpp:
+        * svg/SVGLengthList.h:
+        * svg/SVGLineElement.cpp:
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGList.h:
+        * svg/SVGListTraits.h:
+        * svg/SVGLocatable.h:
+        * svg/SVGMaskElement.cpp:
+        * svg/SVGMatrix.idl:
+        * svg/SVGMetadataElement.cpp:
+        * svg/SVGMetadataElement.h:
+        * svg/SVGMetadataElement.idl:
+        * svg/SVGNumber.idl:
+        * svg/SVGNumberList.cpp:
+        * svg/SVGNumberList.h:
+        * svg/SVGPaint.cpp:
+        * svg/SVGPathElement.cpp:
+        * svg/SVGPathSeg.h:
+        * svg/SVGPathSegArc.cpp:
+        * svg/SVGPathSegArc.h:
+        * svg/SVGPathSegClosePath.cpp:
+        * svg/SVGPathSegClosePath.h:
+        * svg/SVGPathSegCurvetoCubic.cpp:
+        * svg/SVGPathSegCurvetoCubic.h:
+        * svg/SVGPathSegCurvetoCubicSmooth.cpp:
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        * svg/SVGPathSegCurvetoQuadratic.cpp:
+        * svg/SVGPathSegCurvetoQuadratic.h:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.cpp:
+        * svg/SVGPathSegCurvetoQuadraticSmooth.h:
+        * svg/SVGPathSegLineto.cpp:
+        * svg/SVGPathSegLineto.h:
+        * svg/SVGPathSegLinetoHorizontal.cpp:
+        * svg/SVGPathSegLinetoHorizontal.h:
+        * svg/SVGPathSegLinetoVertical.cpp:
+        * svg/SVGPathSegLinetoVertical.h:
+        * svg/SVGPathSegMoveto.cpp:
+        * svg/SVGPathSegMoveto.h:
+        * svg/SVGPatternElement.cpp:
+        * svg/SVGPoint.idl:
+        * svg/SVGPointList.cpp:
+        * svg/SVGPointList.h:
+        * svg/SVGPolyElement.cpp:
+        * svg/SVGPolygonElement.cpp:
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        * svg/SVGPolylineElement.h:
+        * svg/SVGPreserveAspectRatio.cpp:
+        * svg/SVGPreserveAspectRatio.h:
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRect.idl:
+        * svg/SVGRectElement.cpp:
+        * svg/SVGRenderingIntent.h:
+        * svg/SVGSVGElement.idl:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGSetElement.cpp:
+        * svg/SVGSetElement.h:
+        * svg/SVGStopElement.cpp:
+        * svg/SVGStringList.cpp:
+        * svg/SVGStringList.h:
+        * svg/SVGStylable.cpp:
+        * svg/SVGStylable.h:
+        * svg/SVGStyleElement.cpp:
+        * svg/SVGStyleElement.h:
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledLocatableElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        * svg/SVGStyledTransformableElement.h:
+        * svg/SVGSwitchElement.cpp:
+        * svg/SVGSymbolElement.cpp:
+        * svg/SVGTRefElement.cpp:
+        * svg/SVGTSpanElement.cpp:
+        * svg/SVGTSpanElement.h:
+        * svg/SVGTests.h:
+        * svg/SVGTextElement.cpp:
+        * svg/SVGTextElement.h:
+        * svg/SVGTextPathElement.cpp:
+        * svg/SVGTextPositioningElement.cpp:
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGTitleElement.cpp:
+        * svg/SVGTitleElement.h:
+        * svg/SVGTransform.cpp:
+        * svg/SVGTransform.h:
+        * svg/SVGTransform.idl:
+        * svg/SVGTransformList.cpp:
+        * svg/SVGTransformList.h:
+        * svg/SVGTransformable.h:
+        * svg/SVGURIReference.h:
+        * svg/SVGUnitTypes.h:
+        * svg/SVGUseElement.cpp:
+        * svg/SVGViewElement.cpp:
+        * svg/SVGZoomAndPan.cpp:
+        * svg/SVGZoomAndPan.h:
+        * svg/SVGZoomEvent.cpp:
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION Clean up security origin usage in DOM Storage.
+        https://bugs.webkit.org/show_bug.cgi?id=31188
+
+        Clean up security origin usage in DOM Storage.  This fixes a bug in my
+        refactoring here: https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Instead of having StorageAreaSync's constructor (which is called in the
+        constructor for StorageAreaImpl) calling a method on StoargeAreaImpl to get the
+        database identifier, simply have StorageAreaImpl pass the identifier into
+        StorageAreaSync.
+
+        No test because there's no change in externally observable behavior.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::create):
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need notification of scrolling frame
+        https://bugs.webkit.org/show_bug.cgi?id=31145
+
+        Adds FrameLoaderClient::didChangeScrollOffset that is called when
+        the frame scrolls. This will be used to know when history state
+        needs to be updated.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didChangeScrollOffset):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::valueChanged):
+
+2009-11-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Update bindings to use new API for external arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31181
+
+        No new tests; covered by existing WebGL tests.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setIndexedPropertiesToExternalArray):
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/custom/V8CanvasArrayCustom.h:
+        (WebCore::constructCanvasArray):
+
+2009-11-05  Alpha Lam  <hclam@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        50561 introduces a custom method for SVGMatrix, we need to implement
+        this in V8.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Adding definition for V8SVGMatrixMultiply.
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Implement V8SVGMatrixMultiply according to the same method in JSC.
+
+2009-11-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50569 since it broke QT.  Build fix and just a revert, so no review.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setSessionStorageEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::sessionStorageEnabled):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Web Inspector doesn't show CSS rules properly for iframes
+
+        https://bugs.webkit.org/show_bug.cgi?id=30884
+
+        Test: inspector/styles-iframe.html
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getStyles):
+        (InjectedScript.getComputedStyle):
+        (InjectedScript.addStyleSelector):
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        (WebInspector.evaluateForTestInFrontend.invokeMethod):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-11-05  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Geoffrey Garen and Dimitri Glazkov.
+
+        Rehashing of EventListenerMap leads to loss of EvenListenerList.
+        https://bugs.webkit.org/show_bug.cgi?id=31027
+
+        Tested by new fast/events/event-listener-map-rehash-crash.html.
+
+        EventListenerMap modified to store pointers to listener vectors:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::~EventTargetData):
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+
+        Usages updated after interface changes:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+
+2009-11-05  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Add missing initialization for m_createdByParser.
+        https://bugs.webkit.org/show_bug.cgi?id=31089
+
+        Test: fast/dom/beforeload/pi-before-load.xhtml in Valgrind
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::ProcessingInstruction):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 2/2.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Bug 31108 - [V8] REGRESSION: Pause on exception is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31108
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-11-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        We should not bubble up events if we drag something to an iframe that
+        has an invalid source.
+        https://bugs.webkit.org/show_bug.cgi?id=30469
+
+        Test: http/tests/misc/bubble-drag-events.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDragAndDropForTarget):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        * page/EventHandler.h:
+        (WebCore::EventHandler::):
+
+2009-11-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: speed up Timelines Clear by a factor of thousands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31160
+
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeChildren):
+
+2009-11-05  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If high memory usage is detected, hint to V8 that it might be due
+        to external objects retained by V8 objects.
+        https://bugs.webkit.org/show_bug.cgi?id=31051
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GetMemoryUsageInMB):
+        (WebCore::V8GCController::gcEpilogue):
+        (WebCore::V8GCController::checkMemoryUsage):
+        * bindings/v8/V8GCController.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        (WebCore::V8Proxy::callFunction):
+
+2009-11-05  Jeff Schiller  <codedread@gmail.com>
+
+        Reviewed by Simon Fraser.
+
+        Correct order of matrix multiplication for SVGMatrix.
+        https://bugs.webkit.org/show_bug.cgi?id=16062
+
+        Test: svg/dom/SVGMatrix-interface.xhtml
+
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        * svg/SVGMatrix.idl:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Make resource-related records in timeline
+        actually take some time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31139
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        This is a re-submit of 50519.  LocalStorageTask should have never been ref
+        counted.  I've removed that and switched a PassRefPtr over to a PassOwnPtr.
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Calling databaseIdentifier on LocalStorage's background thread is not safe.
+        https://bugs.webkit.org/show_bug.cgi?id=31149
+
+        Calling SecurityOrigin::databaseIdentifier on LocalStorage's background thread
+        is not safe.  databaseIdentifier does a bunch of string concatenation which
+        ref-counts StringImpls in some cases.  This was caught by valgrind thread
+        sanitizer: http://code.google.com/p/chromium/issues/detail?id=25645
+
+        There's no way to test for such racyness, unfortunately.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        * storage/StorageSyncManager.h:
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Clean up StorageAreaSync
+        https://bugs.webkit.org/show_bug.cgi?id=31100
+
+        Major fixes: Break the ref count cycle for StorageArea on the main
+        thread, not the background thread since the latter is not safe.
+        Length() needs to block on the import completing.
+
+        Small fixes: setItem needs to handle the copy on write case even if it
+        has an exception.  setItem and removeItem should just bail from the
+        the function if the value hasn't changed rather than wrapping the end
+        in an if block.  Clear should only send an event if it wasn't already
+        cleared.  StorageAreaSync should assert that the final sync was
+        scheduled.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::length):
+          Forgot to block on the import.
+        (WebCore::StorageAreaImpl::key):
+        (WebCore::StorageAreaImpl::setItem):
+          Handle the copy on write case even when there's an exception.
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::performImport):
+        (WebCore::StorageAreaSync::markImported):
+        (WebCore::StorageAreaSync::blockUntilImportComplete):
+        * storage/StorageAreaSync.h:
+
+2009-11-05  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResource
+        https://bugs.webkit.org/show_bug.cgi?id=31114
+
+        Inherits CachedResource class from Noncopyable because its (its child
+        class) CachedCSSStyleSheet instantiated by 'new' in WebCore/loader/Cache.cpp:75 
+        and it is no need to be copyable.
+
+        * loader/CachedResource.h:
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Separate the difference between HAVE(CGINTERPOLATION_MEDIUM), which
+        is true when building on 10.6 or later, and USE(CGINTERPOLATION_MEDIUM)
+        which is true when targeting 10.6 or later.
+
+        HAVE(CGINTERPOLATION_MEDIUM) indicates that kCGInterpolationMedium
+        is present in the CGInterpolationQuality enum, and must be handled
+        by a switch that has cases for each enumerated value.
+
+        USE(CGINTERPOLATION_MEDIUM) indicates that the product will only run
+        on 10.6 or later, and that CoreGraphics will understand when
+        InterpolationMedium is mapped to kCGInterpolationMedium at runtime.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2009-11-04  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix buffer overrun in WebCore::Page::userStyleSheetLocationChanged()
+        https://bugs.webkit.org/show_bug.cgi?id=31138
+
+        Test: LayoutTests/platform/mac/fast/loader/user-stylesheet-fast-path.html in Valgrind
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-11-04  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Web Inspector Timeline panel to better match the mock-up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31150
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        * inspector/front-end/inspector.css:
+
+2009-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25439
+        Deleting when in front of a block image removes character from previous paragraph
+
+        Added editing/deleting/25439-{1,2,3}.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Block images, tables and HRs cannot 
+        be made inline with other content.  Instead of merging, just move the caret to just before 
+        the selection we deleted.
+        * editing/htmlediting.cpp:
+        (WebCore::firstInSpecialElement): Added a FIXME.  This function begins iterating up from pos.node(), which 
+        doesn't necessarily contain pos (suppose pos was [img, 0]).
+        (WebCore::lastInSpecialElement): Ditto.
+        (WebCore::isRenderedAsNonInlineTableImageOrHR): Moved from visible_units.cpp.  Added a check for non-inline images.
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Use moved/renamed function.  Removed FIXME.  The problem causing 
+        5027702 is now squarely in first/lastInSpecialElement
+        (WebCore::endOfParagraph): Ditto.
+        
+2009-11-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Hang in Mail on attempting to change indent level.
+        <rdar://problem/7131805>
+        https://bugs.webkit.org/show_bug.cgi?id=31127
+
+        The hang was caused by an infinite loop inside outdentRegion.
+        The code did not account for the fact that, when a list item
+        contains multiple paragraphs, outdent moves all paragraphs at
+        once, invalidating some of the positions we keep track of in the loop.
+        Some code refactoring has also been done to minimize duplicated code.
+        
+        Test: editing/execCommand/outdent-multiparagraph-list.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Moved code in common with
+        outdentRegion to doApply.
+        (WebCore::IndentOutdentCommand::outdentRegion): Fixed endless loop.
+        (WebCore::IndentOutdentCommand::doApply): Some code refactoring.
+        * editing/IndentOutdentCommand.h: Added VisiblePosition parameters to
+        indentRegion and outdentRegion.
+
+2009-11-04  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider doesn't have a thumb
+        https://bugs.webkit.org/show_bug.cgi?id=31135
+
+        Fixed an incorrect if statement that prevents volume slider
+        being updated.
+
+        The statement checks if the slider value equals to the current
+        volume value of the media control to avoid updating the volume
+        slider. Updating the volume slider control shouldn't be within
+        this condition because we explicitly set them to be equals
+        during creation of the controls and also when mouse events are
+        received on the volume control.
+
+        No new tests because existing code breaks:
+        LayoutTests/media/video-volume-slider.html
+
+        It should now start passing on Chromium.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Update the volume slider regardless of the current volume value
+        of the media control.
+
+2009-11-04  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by David Levin.
+
+        Need to properly disable applicationCache at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30417
+
+        Adding applicationCacheEnabled bit to V8 RuntimeEnabledFeatures.
+
+        No new exposed functionality, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setApplicationCacheEnabled):
+        (WebCore::RuntimeEnabledFeatures::applicationCacheEnabled):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-11-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31143
+        Assertion failure in CredentialStorage::set() when proxy credentials are being set
+
+        No test, cannot test proxy behavior.
+
+        * platform/network/CredentialStorage.cpp: (WebCore::CredentialStorage::set): Account for the
+        possibility of null url. Release mode changes are likely inconsequential - e.g. we used to
+        add "://" to origin set, which is weird, but safe.
+
+2009-11-04  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Leftover Breakpoints in the Sidebar Pane
+        https://bugs.webkit.org/show_bug.cgi?id=30659
+
+        No new tests.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-11-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Use a different method to identify the webkit port in
+        InspectorBackent::platform().
+        This corrects the inspector expected behavior with Qt on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=31116
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::platform):
+        (WebCore::InspectorBackend::port):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/InspectorControllerStub.js:
+        (.WebInspector.InspectorControllerStub.prototype.port):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.toolbarDragStart):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Update Cairo requirement to 1.6.
+
+        Also remove all conditional code and workarounds for older versions of
+        Cairo.
+        In particular, gain image quality by removing the use of
+        CAIRO_FILTER_NEAREST when rendering images and use the default
+        bilinear filter instead.
+        https://bugs.webkit.org/show_bug.cgi?id=19266
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::boundingRect):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2009-11-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Restore removed string conversion after cleanup.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Need to implement ARIA role="combobox"
+        https://bugs.webkit.org/show_bug.cgi?id=31096
+
+        Test: accessibility/aria-combobox.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isComboBox):
+        (WebCore::AccessibilityObject::isExpanded):
+        (WebCore::AccessibilityObject::expandObject):
+        (WebCore::AccessibilityObject::increment):
+        (WebCore::AccessibilityObject::decrement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::expandObject):
+        (WebCore::AccessibilityRenderObject::isExpanded):
+        (WebCore::createARIARoleMap):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        * html/HTMLAttributeNames.in:
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fixes naming inconsistencies in TimelineRecordFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=31132
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadRecord):
+        (WebCore::TimelineRecordFactory::createEvaluateScriptRecord):
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceSendRequestRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishRecord):
+        (WebCore::TimelineRecordFactory::createPaintRecord):
+        * inspector/TimelineRecordFactory.h:
+
+2009-11-04  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Followon to bug 31080, which protects Timeline
+        instrumentation in the case where InspectorTimelineAgent
+        is enabled or disabled during an event dispatch.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31121
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inspectorTimelineAgent):
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Revert 50519 while I work out what went wrong.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThreadStart):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add basic support for resource events and marks.
+        Couple of drive-by fixes. Enabling the panel!
+
+        https://bugs.webkit.org/show_bug.cgi?id=31130
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClicked):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-11-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify LocalStorageThread
+        https://bugs.webkit.org/show_bug.cgi?id=30935
+
+        On LocalStoragethread: Remove reference counting. Get rid of locking. Make some
+        of the method names a bit more clear. Assert proper thread usage. Join rather
+        than detaching the thread and doing an ad-hoc form of join. Avoid touching
+        variables on the background thread when simple to do so.  Also create a generic
+        scheduleTask function rather than one for each task.
+
+        No behavior should have changed.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::create):
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::~LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::threadEntryPointCallback):
+        (WebCore::LocalStorageThread::threadEntryPoint):
+        (WebCore::LocalStorageThread::scheduleTask):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-11-04  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Reviewed by Eric Seidel.
+
+        [wx] Small cleanup: avoid unnecessary wxString::mb_str() calls.
+
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds lightweight network resources to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31065
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceSendRequestTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseTimelineRecord):
+        (WebCore::TimelineRecordFactory::createResourceFinishTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-11-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] ASSERT failure when receiving 401 HTTP Authentication response.
+        https://bugs.webkit.org/show_bug.cgi?id=31077
+
+        Allow sending the response body under the same conditions that we
+        allow it to finish without reporting an error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-11-04  Adam Roben  <aroben@apple.com>
+
+        Sort WebCore.base.exp
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebCore.base.exp: Sorted.
+
+2009-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout.
+
+        Revert r50496 because it broke all layout tests on QtBuildBot.
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
+        (WebCore::FontPlatformDataCacheKey::):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::FontPlatformDataCacheKey::hash):
+        (WebCore::FontPlatformDataCacheKey::computeHash):
+        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize):
+        (WebCore::FontPlatformDataCacheKeyHash::hash):
+        (WebCore::FontPlatformDataCacheKeyHash::equal):
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::constructDeletedValue):
+        (WebCore::FontPlatformDataCacheKeyTraits::isDeletedValue):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        (WebCore::FontCache::getCachedFontData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::releaseFontData):
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::addClient):
+        (WebCore::FontCache::removeClient):
+        (WebCore::FontCache::invalidate):
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::pixelSize):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31044
+        [Gtk] assertion when webkit_accessible_get_index_in_parent attempts to get parent of the web view
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkParentOfWebView):
+        (webkit_accessible_get_index_in_parent):
+        (webkit_accessible_get_parent):
+
+2009-11-04  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter and Naiem Shaik.
+        Patch 2/4 - Moving TextCodecs to GLib
+        
+        Added probing for a hard-coded lists of text encodings.
+        The basis of this list is taken from the encodings supported by iconv,
+        then extended by e.g. tis-620, windows-1251, euc-kr, windows-1253 and
+        a number of Chinese ones.
+
+        Probing is necessary with the current design of text codecs
+        as iconv/GLib do not support enumerating available encodings.
+
+        * GNUmakefile.am:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * platform/text/gtk/TextCodecGtk.cpp: Added.
+        (WebCore::):
+        (WebCore::newTextCodecGtk):
+        (WebCore::TextCodecGtk::isEncodingAvailable):
+        (WebCore::TextCodecGtk::registerEncodingNames):
+        (WebCore::TextCodecGtk::registerCodecs):
+        (WebCore::TextCodecGtk::registerBaseEncodingNames):
+        (WebCore::TextCodecGtk::registerBaseCodecs):
+        (WebCore::TextCodecGtk::registerExtendedEncodingNames):
+        (WebCore::TextCodecGtk::registerExtendedCodecs):
+        (WebCore::TextCodecGtk::TextCodecGtk):
+        (WebCore::TextCodecGtk::~TextCodecGtk):
+        (WebCore::TextCodecGtk::releaseIConv):
+        (WebCore::TextCodecGtk::createIConvDecoder):
+        (WebCore::TextCodecGtk::createIConvEncoder):
+        (WebCore::TextCodecGtk::decode):
+        (WebCore::TextCodecGtk::encode):
+        * platform/text/gtk/TextCodecGtk.h: Added.
+
+2009-11-04  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Unify redudant methods which will always return the same value.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-11-04  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31035
+        [GTK] some accessibility tests hitting assertion in debug builds
+
+        Removes the assertions in webkit_accessible_ref_child; adds sanity checks.
+        Any app or AT can attempt to ref a child at a bogus index.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_ref_child):
+
+2009-11-04  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Use gst_element_class_set_details_simple()
+
+        Cosmetic change, just code simplification
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_base_init):
+2009-11-04  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds paint rectangle information to TimelineAgent's didPaint callback.
+        https://bugs.webkit.org/show_bug.cgi?id=31087
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willPaint):
+        * inspector/InspectorTimelineAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createPaintTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+2009-11-04  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        This patch adds API to the console object for annotating the
+        inspector timeline. This allows developers to mark logical
+        checkpoints in their apps and have them overlaid in the event
+        record tree.
+
+        tests updated: LayoutTests/fast/dom/Window/window-properties.html
+        https://bugs.webkit.org/show_bug.cgi?id=31082
+
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::markTimeline):
+        * inspector/InspectorController.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createMarkTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * page/Console.cpp:
+        (WebCore::Console::markTimeline):
+        * page/Console.h:
+        * page/Console.idl:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed build fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-11-02  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Handle fonts like the other ports
+
+        Remove FontFallbackListQt and rely on the common FontFallbackList
+        to handle the fonts. FontCache and FontPlatformData have been
+        updated to work with the common FontFallbackList.
+
+        In the previous implementation, FontPlatformDataCacheKey
+        was a clone of FontPlatformData with the hashing
+        capabilities added in order to use it as a key in the cache's
+        hashmap. FontPlatformData has been modified to handle the hashing
+        function directly so the data are not copied twice in memory.
+
+        FontFallbackList::fontDataAt() from FontFallbackListQt was a copy of
+        code from FontCache::getFontData() and FontFallbackList::fontDataAt().
+        The behavior is similar except currFamily->family().length() was
+        not tested and the fallback fonts selector were not used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29856
+
+        Test: svg/text/text-font-invalid.html
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        Removed. We now use the implementation from FontFallbackList.cpp
+        * platform/graphics/qt/FontPlatformData.h:
+        Add hashing capabilities to be able to use the data with the FontCache.
+        This was previously done in FontCacheQt.cpp
+        (WebCore::FontPlatformData::FontPlatformData):
+        Added a boolean to identify deleted value in the hash table.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Leopard build fix
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac):
+        (WebCore::core):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix an assertion failure in core(NSURLProtectionSpace *) by handling NTLM
+        authentication in AuthenticationMac
+
+        * platform/network/mac/AuthenticationMac.mm:
+
+2009-11-03  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes a problem where the timeline instrumentation crashes if
+        timeline profiling is enabled or disabled in the middle of an
+        event dispatch.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31080
+
+        Test: inspector/timeline-trivial.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Allow a frame to go back to copy-on-scroll when it ceases being overlapped
+
+        The code was not testing slow-scrolling frames for overlappedness, thinking the answer
+        would not matter. That is not the case if the only reason for the slow-scrolling is
+        being overlapped.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::useSlowRepaintsIfNotOverlapped): Added. Returns whether there is any
+        reason besides being overlapped that the frame would need to fully repaint on scroll.
+        * page/FrameView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Use useSlowRepaintsIfNotOverlapped().
+
+2009-11-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Qt build fix.
+
+        Need to use right capitalization for include file.
+
+        * page/Navigator.cpp:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate from top bar filters to check boxes in Timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31081
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCategoryTreeElement.prototype._onCheckboxClick):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineCategoryGraph.prototype.set dimmed):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: clear overview on Clear action and panel reset.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31078
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.prototype.reset):
+
+2009-11-03  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Imported action and rules python files that WebCore.gyp depends on. 
+        These files used to live in chromium.org and deal mostly with auto-generation
+        of code by wrapping existing webkit perl scripts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31071
+
+        * WebCore.gyp/WebCore.gyp: Fixed paths in actions and rules.
+        * WebCore.gyp/scripts/action_csspropertynames.py: Added.
+        * WebCore.gyp/scripts/action_cssvaluekeywords.py: Added.
+        * WebCore.gyp/scripts/action_makenames.py: Added.
+        * WebCore.gyp/scripts/action_maketokenizer.py: Added.
+        * WebCore.gyp/scripts/action_useragentstylesheets.py: Added.
+        * WebCore.gyp/scripts/rule_binding.py: Added.
+        * WebCore.gyp/scripts/rule_bison.py: Added.
+        * WebCore.gyp/scripts/rule_gperf.py: Added.
+
+2009-11-03  Bradley Green  <brg@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Implement window.navigator.registerProtocolHandler in webkit,
+        https://bugs.webkit.org/b/29651
+
+        Also implemented its sister API window.navigator.registerContentHandler.
+
+        These methods are as described in the HTML5 specification which can be
+        found here,
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registerprotocolhandler
+        http://dev.w3.org/html5/spec/Overview.html#dom-navigator-registercontenthandler
+
+        As specified in the document, the behavior of the browser is determined
+        by the current registered handler.  The state of a registered handler
+        can change at any time, with the user clearing a registered handler,
+        registering a different page as handler, or deferring the hander to the
+        OS.  If webkit was to track the state of the currently registered
+        handlers, it would need more APIs and complexity to keep in sync with
+        user actions reported to webkit from the UA.  For simplicity, the state
+        of protocol handlers should be kept isolated from webkit and webkit only
+        notifies the UA that a page has made the call.  The UA is then
+        responsible for correctly handling the registerProtocolHandler call and
+        the redirects which result from registration.
+
+        We do however follow the specification in insuring that the reserved
+        schemes and mimeTypes are not passed to the UA as custom handler
+        registration tests.  We also insure that the "%s" token is present as
+        required by the specification.
+
+        Updated test expectations for window.clientInformation and navigator
+        objects.
+
+        Tests: fast/dom/registerContentHandler.html
+               fast/dom/registerProtocolHandler.html
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::registerProtocolHandler):
+        (WebCore::Chrome::registerContentHandler):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::registerProtocolHandler):
+        (WebCore::ChromeClient::registerContentHandler):
+        * page/Navigator.cpp:
+        (WebCore::verifyCustomHandlerURL):
+        (WebCore::verifyProtocolHandlerScheme):
+        (WebCore::Navigator::registerProtocolHandler):
+        (WebCore::verifyProtocolHandlerMimeType):
+        (WebCore::Navigator::registerContentHandler):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+
+2009-11-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31079 - Remove #include "Page.h" from Document.h
+
+        No new tests. (No change in functionality)
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorTimelineAgent): Moved from Document.h
+        * dom/Document.h:
+
+        Include "Page.h" directly:
+        * html/HTMLVideoElement.cpp:
+        * loader/RedirectScheduler.cpp:
+        * page/History.cpp:
+        * rendering/MediaControlElements.cpp:
+        * storage/StorageAreaImpl.cpp:
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hover over JS "things" in source and see their values
+        https://bugs.webkit.org/show_bug.cgi?id=30913
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: update timeline content boundaries on timer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31072
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+
+2009-11-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31070
+        Fix <rdar://problem/7194735> Crashes at RenderText::RenderText()
+        Fix <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        Tests: plugins/attach-during-destroy.html
+               plugins/destroy-reentry.html
+
+        These crashes were caused by plug-in code running during detach(),
+        causing re-entry into RenderWidget::destroy() in one case and a call
+        into attach() in the other. The fix is to prevent plug-in code from
+        being called at certain unsafe times (during attach(), detach(), and
+        recalcStyle()) by deferring changes to the widget hierarchy.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Suspend widget hierarchy updates
+            during style recalculation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Suspend widget hierarchy updates during
+            attach().
+        (WebCore::Element::detach): Suspend widget hierarchy updates during
+            detach().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::widgetNewParentMap): Returns a static map of pending changes
+            to the widget hierarchy.
+        (WebCore::RenderWidget::suspendWidgetHierarchyUpdates): Increments the
+            suspend count.
+        (WebCore::RenderWidget::resumeWidgetHierarchyUpdates): Decrements the
+            suspend count. If the count is going to be zero, updates the widget
+            hierarchy by executing the pending changes stored in the map.
+        (WebCore::moveWidgetToParentSoon): Updates the widget hierarchy
+            immediately or makes or updates an entry in the map, depending on
+            whether updates are suspended.
+        (WebCore::RenderWidget::destroy): Removed earlier bandaid fix for
+            <rdar://problem/6937089>.
+        (WebCore::RenderWidget::setWidgetGeometry): Assert that widget updates
+            are not suspended, because this function updates the widget’s
+            bounds, which can result in arbitrary native and JavaScript code
+            execution. I think this assertion is true thanks to some deferred-
+            update mechanisms that have already been deployed in other places
+            in the code.
+        (WebCore::RenderWidget::setWidget): Call moveWidgetToParentSoon instead
+            of changing the widget hierarchy directly.
+        * rendering/RenderWidget.h: Declared suspendWidgetHierarchyUpdates()
+            and resumeWidgetHierarchyUpdates().
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: only show timeline records that contribute
+        to the current window.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31069
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.refresh):
+
+2009-11-03  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Watch expression editor should stay open after Add button was clicked
+        https://bugs.webkit.org/show_bug.cgi?id=31049
+
+        No new tests, was a regression, use existing manual test.
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+
+2009-11-03  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix an off-by-one in the CSS lexer that causes memory corruption in
+        hard-to-trigger circumstances.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30827
+
+        Test: fast/css/end-of-buffer-crash.html
+
+        * css/maketokenizer: Add comments, fix off-by-one.
+
+2009-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash due to double-destroy related to CSS run-in property
+        https://bugs.webkit.org/show_bug.cgi?id=31034
+        rdar://problem/7328458
+
+        Test: fast/css/run-in-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy): Reorder destruction so the
+        continuation is destroyed after anonymous children. See comment
+        in the code for more details of why this is right.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy): Ditto.
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix exception in ElementsPanel.js when moving pointer out of crumbs and window
+
+        There might be no new node under mouse if the pointer is moved out of the window
+        in which case we get an exception.
+        https://bugs.webkit.org/show_bug.cgi?id=31061
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+
+2009-11-03  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for the dom directory of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=31053
+
+        Inherits the following classes from Noncopyable because these are
+        instantiated by 'new' and these are no need to be copyable:
+
+        class EventNames - 'new' call: WebCore/platform/ThreadGlobalData.cpp:73
+        struct PerformTaskContext - 'new' call: WebCore/dom/Document.cpp:4581
+        class EventData - 'new' call: WebCore/dom/MessagePortChannel.cpp:38
+        struct NodeListsNodeData - 'new' call: WebCore/dom/NodeRareData.h:51 
+        struct EventTargetData - 'new' call: WebCore/dom/NodeRareData.h:100
+        class NodeRareData - 'new' call: WebCore/dom/Node.cpp:552
+
+        Inherits QualifiedName class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/editing/markup.cpp:319
+
+        * dom/Document.cpp:
+        * dom/EventNames.h:
+        * dom/EventTarget.h:
+        * dom/MessagePortChannel.h:
+        * dom/NodeRareData.h:
+        * dom/QualifiedName.h:
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement timeline summary panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31064
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelineCategoryGraph):
+        (WebInspector.TimelineCategoryGraph.prototype.get graphElement):
+        (WebInspector.TimelineCategoryGraph.prototype.addChunk):
+        (WebInspector.TimelineCategoryGraph.prototype.clearChunks):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Toggle off 'Search for node' when the Inspector window is closing
+
+        Searching for node should be toggled off when the Inspector window is closed,
+        in a platform-independent manner.
+        https://bugs.webkit.org/show_bug.cgi?id=31059
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-11-03  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Prepare for heap profiles upstreaming:
+        - pass profile type id from InspectorController;
+        - this makes WebInspector.CPUProfile redundant---removed;
+        - support multiple profile types when populating profiles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31052
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-11-03  Dan Kegel  <dank@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        UMR in WebCore::AccessibilityRenderObject::children(); m_childrenDirty uninitialized in constructor
+        https://bugs.webkit.org/show_bug.cgi?id=31063
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+
+2009-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement Timeline Window, wire it to the bottom timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31056
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.get items):
+        (WebInspector.AbstractTimelinePanel.prototype.createInterface):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.invalidateAllItems):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get itemsGraphsElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        (WebInspector.TimelineGrid.prototype.addExtraDivider):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._createOverview):
+        (WebInspector.TimelinePanel.prototype.setSidebarWidth):
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._resizeWindow):
+        (WebInspector.TimelinePanel.prototype._windowResizeDragging):
+        (WebInspector.TimelinePanel.prototype._dragWindow):
+        (WebInspector.TimelinePanel.prototype._windowDragging):
+        (WebInspector.TimelinePanel.prototype._resizeWindowLeft):
+        (WebInspector.TimelinePanel.prototype._resizeWindowRight):
+        (WebInspector.TimelinePanel.prototype._setWindowPosition):
+        (WebInspector.TimelinePanel.prototype._endWindowDragging):
+        (WebInspector.TimelineCategoryTreeElement):
+        (WebInspector.TimelineCategoryTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.get minimumBoundary):
+        (WebInspector.TimelineCalculator.prototype.get maximumBoundary):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/inspector.css:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make QWebPluginDatabase private API for now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30775
+
+        * WebCore.pro:
+
+2009-11-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Extended the conversion of the WebCore ResourceRequest to the
+        QNetworkRequest with a mandatory originating object argument,
+        which is meant to be the QWebFrame the request belongs to.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-11-03  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: monitorEvent should be monitorEvents
+        https://bugs.webkit.org/show_bug.cgi?id=31042
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        [Qt] Build fix for Windows CE
+
+        * plugins/PluginDatabase.cpp:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Levin.
+
+        fix accessibility webkit-style-check errors
+        https://bugs.webkit.org/show_bug.cgi?id=29672
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        (WebCore::AXObjectCache::removeAXID):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::enableAccessibility):
+        (WebCore::AXObjectCache::enableEnhancedUserInterfaceAccessibility):
+        (WebCore::AXObjectCache::accessibilityEnabled):
+        (WebCore::AXObjectCache::accessibilityEnhancedUserInterfaceEnabled):
+        (WebCore::AXObjectCache::isIDinUse):
+        (WebCore::AXObjectCache::objectFromAXID):
+        (WebCore::AXObjectCache::):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityImageMapLink.cpp:
+        * accessibility/AccessibilityList.h:
+        (WebCore::AccessibilityList::isList):
+        * accessibility/AccessibilityListBox.cpp:
+        * accessibility/AccessibilityListBox.h:
+        (WebCore::AccessibilityListBox::isListBox):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::isListBoxOption):
+        * accessibility/AccessibilityMediaControls.h:
+        (WebCore::AccessibilityMediaControl::~AccessibilityMediaControl):
+        (WebCore::AccessibilityMediaTimeline::~AccessibilityMediaTimeline):
+        (WebCore::AccessibilityMediaTimeline::isMediaTimeline):
+        (WebCore::AccessibilityMediaControlsContainer::~AccessibilityMediaControlsContainer):
+        (WebCore::AccessibilityMediaControlsContainer::roleValue):
+        (WebCore::AccessibilityMediaControlsContainer::accessibilityIsIgnored):
+        (WebCore::AccessibilityMediaTimeDisplay::~AccessibilityMediaTimeDisplay):
+        (WebCore::AccessibilityMediaTimeDisplay::roleValue):
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::parentObjectUnignored):
+        (WebCore::AccessibilityObject::rightLineVisiblePositionRange):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        (WebCore::AccessibilityObject::lengthForVisiblePositionRange):
+        (WebCore::AccessibilityObject::actionVerb):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::PlainTextRange::isNull):
+        (WebCore::AccessibilityObject::isAccessibilityRenderObject):
+        (WebCore::AccessibilityObject::isAnchor):
+        (WebCore::AccessibilityObject::isAttachment):
+        (WebCore::AccessibilityObject::isHeading):
+        (WebCore::AccessibilityObject::isLink):
+        (WebCore::AccessibilityObject::isImage):
+        (WebCore::AccessibilityObject::isNativeImage):
+        (WebCore::AccessibilityObject::isImageButton):
+        (WebCore::AccessibilityObject::isPasswordField):
+        (WebCore::AccessibilityObject::isTextControl):
+        (WebCore::AccessibilityObject::isNativeTextControl):
+        (WebCore::AccessibilityObject::isWebArea):
+        (WebCore::AccessibilityObject::isCheckboxOrRadio):
+        (WebCore::AccessibilityObject::isListBox):
+        (WebCore::AccessibilityObject::isFileUploadButton):
+        (WebCore::AccessibilityObject::isProgressIndicator):
+        (WebCore::AccessibilityObject::isSlider):
+        (WebCore::AccessibilityObject::isControl):
+        (WebCore::AccessibilityObject::isList):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        (WebCore::AccessibilityObject::isFieldset):
+        (WebCore::AccessibilityObject::isGroup):
+        (WebCore::AccessibilityObject::isChecked):
+        (WebCore::AccessibilityObject::isEnabled):
+        (WebCore::AccessibilityObject::isSelected):
+        (WebCore::AccessibilityObject::isFocused):
+        (WebCore::AccessibilityObject::isHovered):
+        (WebCore::AccessibilityObject::isIndeterminate):
+        (WebCore::AccessibilityObject::isLoaded):
+        (WebCore::AccessibilityObject::isMultiSelect):
+        (WebCore::AccessibilityObject::isOffScreen):
+        (WebCore::AccessibilityObject::isPressed):
+        (WebCore::AccessibilityObject::isReadOnly):
+        (WebCore::AccessibilityObject::isVisited):
+        (WebCore::AccessibilityObject::isRequired):
+        (WebCore::AccessibilityObject::canSetFocusAttribute):
+        (WebCore::AccessibilityObject::canSetTextRangeAttributes):
+        (WebCore::AccessibilityObject::canSetValueAttribute):
+        (WebCore::AccessibilityObject::hasIntValue):
+        (WebCore::AccessibilityObject::accessibilityShouldUseUniqueId):
+        (WebCore::AccessibilityObject::accessibilityIsIgnored):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isMenuRelated):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        (WebCore::AccessibilityRenderObject::doAXStringForRange):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        (WebCore::AccessibilityRenderObject::isPresentationalChildOfAriaRole):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        * accessibility/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::isAccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation):
+        * accessibility/AccessibilitySlider.h:
+        (WebCore::AccessibilitySlider::~AccessibilitySlider):
+        (WebCore::AccessibilitySlider::roleValue):
+        (WebCore::AccessibilitySlider::accessibilityIsIgnored):
+        (WebCore::AccessibilitySlider::isSlider):
+        (WebCore::AccessibilitySlider::canSetValueAttribute):
+        (WebCore::AccessibilitySliderThumb::~AccessibilitySliderThumb):
+        (WebCore::AccessibilitySliderThumb::roleValue):
+        (WebCore::AccessibilitySliderThumb::accessibilityIsIgnored):
+        (WebCore::AccessibilitySliderThumb::setParentObject):
+        (WebCore::AccessibilitySliderThumb::parentObject):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * accessibility/AccessibilityTableColumn.cpp:
+        * accessibility/AccessibilityTableHeaderContainer.cpp:
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * accessibility/AccessibilityTableRow.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.h:
+
+2009-11-02  Darin Fisher  <darin@chromium.org>
+
+        Fixing JSC build bustage.
+
+        * bindings/js/ScriptController.cpp: Added missing #include
+
+2009-10-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Give the FrameLoaderClient the ability to override Settings::isJavaScriptEnabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30967
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isEnabled):
+        * bindings/v8/V8Proxy.cpp: Move implementation of isEnabled to ScriptController
+        * bindings/v8/V8Proxy.h: Ditto
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::allowJavaScript):
+        * platform/chromium/ChromiumBridge.h: Delete uiResourceProtocol function
+
+2009-11-02  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        Fix a typo in Mark's last commit.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Re-enable support for web archives on Windows.  It was mistakenly disabled in r50438.
+
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * WebCore.pro: Add SharedBufferCF.cpp and SmartReplaceCF.cpp
+        to the Darwin build.
+        * loader/archive/ArchiveFactory.cpp: Change the support for 
+        legacy WebArchive from all CF platforms to Mac and Chromium 
+        CF platforms.
+        (WebCore::archiveMIMETypes):
+        * platform/text/AtomicString.h: Remove PLATFORM(QT) &&
+        PLATFORM(DARWIN) test as it is redundant now.
+        * platform/text/PlatformString.h: Ditto.
+        * platform/text/StringImpl.h: Ditto.
+        * platform/text/cf/StringCF.cpp: Ditto.
+        * platform/text/cf/StringImplCF.cpp: Ditto.
+
+2009-11-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Actually declare getPluginMimeTypeFromExtension in a header.
+        https://bugs.webkit.org/show_bug.cgi?id=30985
+
+        Our current code does not conform to our style guide.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp:
+        * plugins/chromium/PluginDataChromium.cpp:
+        * plugins/chromium/PluginDataChromium.h: Added.
+
+2009-11-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7038305> REGRESSION (Safari 4.0.2 - ToT): After navigating back to a known phishy page, the "Ignore warning" button appears highlighted (along with the "Go Back" button)
+
+        This bug is timing dependent, and not always reproducible.  I could not think of a way to add a 
+        layout test that would demonstrate the problem and fix.
+
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkbox): Update style.
+        (WebCore::paintCheckbox): ditto.
+        (WebCore::radio): ditto.
+        (WebCore::paintRadio): ditto.
+        (WebCore::setupButtonCell): Added convenience method.
+        (WebCore::button): Use a separate NSButtonCell for defaultButtons and regular buttons.
+        (WebCore::paintButton): Don't check for the key window here.  Consider that when deciding if the button should have the default style in RenderTheme.
+        * rendering/RenderTheme.cpp: (WebCore::RenderTheme::isDefault): Only consider a button to be default if the page is active.  This fixes 
+        a problem I noticed where the button would flicker crazily if the page with the default button was in the background.
+
+2009-11-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Minor RenderWidget clean-up in preparation for deferring widget tree
+        mutation when it is not safe.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_refCount to 1
+        instead of calling ref().
+        (WebCore::RenderWidget::destroy): Call setWidget(0) instead of
+        repeating what it does.
+        (WebCore::RenderWidget::setWidgetGeometry): Now returns a boolean
+        indicating whether the bounds have changed.
+        (WebCore::RenderWidget::setWidget): Replaced all-encompassing if
+        statement with an early return.
+        (WebCore::RenderWidget::updateWidgetPosition): Call setWidgetGeometry().
+        * rendering/RenderWidget.h:
+
+2009-11-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's DatabaseTracker and SQLTransactionClient
+        implementations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30701
+
+        * storage/chromium: Added.
+        * storage/chromium/DatabaseObserver.h: Added.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Added.
+        * storage/chromium/QuotaTracker.cpp: Added.
+        * storage/chromium/QuotaTracker.h: Added.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Added.
+
+2009-11-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson and Dan Bernstein.
+
+        Safari crashes when calling execCommand on formatted html in special case
+        <rdar://problem/7318656>
+        https://bugs.webkit.org/show_bug.cgi?id=31023
+
+        Test: editing/execCommand/align-in-span.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock): Modified comment on containingBlock returning NULL.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState): Added check for NULL return from containingBlock,
+        since it is possible when dealing with orphaned trees.
+
+2009-11-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Exception checks were being too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=31005
+
+        Several calls in CanvasRenderingContext3D are allowed to
+        have a null value passed, which indicated that the 
+        object is being unbound. Handle this case and the corresponding
+        null handling in GraphicsContext3DMac.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+
+2009-11-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Each JS execution in console adds extra item into "scripts" combo
+        https://bugs.webkit.org/show_bug.cgi?id=30212
+
+        Added manual test
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * manual-tests/inspector/hidden-evals.html: Added.
+
+2009-11-02  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds a missed case for InspectorTimeline, DOMWindow dispatch of DOM events.
+        https://bugs.webkit.org/show_bug.cgi?id=31030
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners): Checks DOMWindow for listeners.
+        (WebCore::Node::dispatchGenericEvent):
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        No new tests since no new functionality. Storage, MessagePorts and Workers tests cover this.
+
+        There are a lot of files but most changes are simply replace RefPtr and PassRefPtr with
+        OwnPtr and PassOwnPtr when dealing with Tasks.
+
+        ScriptExecutionContext::Task, DatabaseTask and WorkerRunLoop::Task are no longer
+        threadsafe refcounted, but simply Noncopyable.
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask::create):
+        * dom/ScriptExecutionContext.h:
+        * dom/default/PlatformMessagePortChannel.cpp:
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        * loader/FrameLoader.cpp:
+        (WebCore::HashChangeEventTask::create):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::create):
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::tableNames):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        (WebCore::DatabaseThread::scheduleTask):
+        (WebCore::DatabaseThread::scheduleImmediateTask):
+        (WebCore::SameDatabasePredicate::operator()):
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::localStorageThread):
+        * storage/LocalStorageThread.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        (WebCore::SharedWorkerConnectTask::create):
+        * workers/GenericWorkerTask.h:
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask8::create):
+        (WebCore::createCallbackTask):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * workers/WorkerContext.h:
+        * workers/WorkerLoaderProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerContextDestroyedTask::create):
+        (WebCore::WorkerTerminateTask::create):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::~Task):
+        (WebCore::WorkerRunLoop::Task::mode):
+
+2009-11-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Failing media/video-played-reset.html
+        https://bugs.webkit.org/show_bug.cgi?id=30589
+
+        new m_seekTime attribute to keep track of the seek position
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-11-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Remove Referer when redirecting to non-secure site
+        https://bugs.webkit.org/show_bug.cgi?id=31021
+
+        Remove referer from HTTP headers when redirecting to a non-secure
+        site.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-11-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18539
+        multipart/form-data not being parsed correctly on server due to '+' in boundary string
+
+        No test - the characters that the boundary is made of are not deterministic.
+
+        * platform/network/FormDataBuilder.cpp: (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        Don't ever put a '+' in boundary string, either. Removed a FIXME to bring '/' back once
+        GMail is fixed - I don't think we'll ever want to allow non-alphanumeric characters, as
+        they cause problems on many web sites.
+
+2009-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30969
+        A no-prefix XPath node test should not match no-namespace elements in HTML document
+
+        Test: fast/xpath/null-namespace-in-html.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::nodeMatchesBasicTest): Special case non-HTML elements
+        in HTML documents (as these are the ones that can have null namespace).
+
+2009-11-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] No timeline marks on resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31013
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+
+2009-11-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Possible crash in RenderSlider::layout.
+        https://bugs.webkit.org/show_bug.cgi?id=31016
+
+        Fix out of place line of code.
+
+        Test: scrollbars/overflow-scrollbar-combinations.html
+        This crash only seems to repro when WebKit draws the play controls,
+        so the crash repros in chromium running this test but not WebKit
+        nightlies which use QuickTime to draw the controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+
+2009-11-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Qt build on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30905
+
+        * WebCore.pro:
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::create):
+
+2009-11-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        QWebView crash fix.
+
+        The QWebView should not crash if the stop() method is called from
+        a function triggered by the loadProgress signal.
+
+        A null pointer protection was added in the ProgressTracker::incrementProgress.
+
+        New autotest was created.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29425
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::incrementProgress):
+
+2009-11-02  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leftover from profiles panel generalization.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31010
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+
+2009-11-02  Kai Koehne  <kai.koehne@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove implementation of ImageDecocerQt::clearFrameBufferCache.
+        The implementation was buggy, and will visually break repeating
+        animations anyway.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31009
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+
+2009-11-02  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to the reported content language.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_document_get_locale):
+
+2009-11-02  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Rewrite CSSSourceSyntaxHighlighter so it shares more code
+        https://bugs.webkit.org/show_bug.cgi?id=30907
+
+        Test: inspector/css-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        (WebInspector.SourceSyntaxHighlighter):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process.moveToNextLine):
+        (WebInspector.SourceSyntaxHighlighter.prototype.process):
+        (WebInspector.SourceSyntaxHighlighter.prototype.lex):
+        (WebInspector.SourceSyntaxHighlighter.prototype.appendNonToken):
+        (WebInspector.SourceSyntaxHighlighter.prototype.syntaxHighlightNode):
+        (WebInspector.CSSSourceSyntaxHighlighter):
+        * inspector/front-end/inspectorSyntaxHighlight.css:
+
+2009-11-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Support ARIA "tab" roles
+        https://bugs.webkit.org/show_bug.cgi?id=30842
+
+        Implement support for ARIA "tab", "tabpanel" and "tablist".
+        As a consequence, we also needed to implement aria-selected
+        and aria-controls.
+
+        Tests: accessibility/aria-controls-with-tabs.html
+               accessibility/aria-tab-roles.html
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * html/HTMLAttributeNames.in:
+
+2009-10-27  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        This is the WebKit-side change needed to fix canvas.getImageData() for
+        Chromium.  The unpremultiply code in Skia assumes that unpremultiplied
+        values should be rounded, while CG does not.  In addition, the fixed
+        point inversion used by Skia introduces slight inaccuracies that make
+        us fail this test.  This change brings Chromium in line with
+        the CG path.
+        https://bugs.webkit.org/show_bug.cgi?id=30825
+
+        Covered by LayoutTests/fast/canvas/canvas-getImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds window event dispatches to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=31002
+
+        * English.lproj/localizedStrings.js:
+        * dom/Node.cpp: Updated call site to willDispatchEvent and didDispatchEvent.
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchEvent): Renamed.
+        (WebCore::InspectorTimelineAgent::didDispatchEvent): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEventDispatchRecord): Renamed.
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+
+2009-11-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Convert script tag event into a more generic
+        script eval event in timeline.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30999
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createEvaluateScriptTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype._getRecordDetails):
+
+2009-11-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix for loop to use an size_t instead of unsigned and some spacing
+        style fixes.
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+
+2009-11-01  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Does not send DOM dispatches to the InspectorTimelineAgent if there
+        are no event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=30995
+
+        * dom/Node.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::Node::dispatchGenericEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-11-01  Roland Steiner  <rolandsteiner@chromium.org>
+
+        No review (build fix).
+
+        Add missing files for Ruby implementation to WebCore.vcproj
+        (Fix build break after 50397)
+        https://bugs.webkit.org/show_bug.cgi?id=31001
+
+        No new tests. (No functional change)
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-11-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        First rudimentary implementation of HTML5 ruby rendering support.
+
+        Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+        bases with their respective ruby texts looks as follows:
+
+        1 RenderRuby object, corresponding to the whole <ruby> HTML element
+             1+ RenderRubyRun (anonymous)
+                 0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+                     0-n inline object(s)
+                 0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+                     1-n inline object(s)
+
+        Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+        
+        New layout tests will be committed in a follow-up patch under fast/ruby.
+
+        Makefiles, etc.
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS
+        * css/html.css: Added <ruby> and <rt>
+
+        Existing render files:
+        * rendering/RenderBlock.cpp: make moveChild a member function moveChildTo
+        (WebCore::RenderBlock::moveChildTo):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): instantiate ruby renderers based on element name
+        * rendering/RenderObject.h: add query methods for ruby renderers
+        (WebCore::RenderObject::isRuby):
+        (WebCore::RenderObject::isRubyBase):
+        (WebCore::RenderObject::isRubyRun):
+        (WebCore::RenderObject::isRubyText):
+
+        New ruby renderers:
+        * rendering/RenderRuby.cpp: Added.
+        (WebCore::lastRubyRun):
+        (WebCore::findRubyRunParent):
+        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::~RenderRubyAsInline):
+        (WebCore::RenderRubyAsInline::isChildAllowed):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::~RenderRubyAsBlock):
+        (WebCore::RenderRubyAsBlock::isChildAllowed):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+        * rendering/RenderRuby.h: Added.
+        (WebCore::RenderRubyAsInline::renderName):
+        (WebCore::RenderRubyAsInline::isRuby):
+        (WebCore::RenderRubyAsBlock::renderName):
+        (WebCore::RenderRubyAsBlock::isRuby):
+        * rendering/RenderRubyBase.cpp: Added.
+        (WebCore::RenderRubyBase::RenderRubyBase):
+        (WebCore::RenderRubyBase::~RenderRubyBase):
+        (WebCore::RenderRubyBase::isChildAllowed):
+        (WebCore::RenderRubyBase::splitToLeft):
+        (WebCore::RenderRubyBase::mergeWithRight):
+        * rendering/RenderRubyBase.h: Added.
+        (WebCore::RenderRubyBase::renderName):
+        (WebCore::RenderRubyBase::isRubyBase):
+        * rendering/RenderRubyRun.cpp: Added.
+        (WebCore::RenderRubyRun::RenderRubyRun):
+        (WebCore::RenderRubyRun::~RenderRubyRun):
+        (WebCore::RenderRubyRun::hasRubyText):
+        (WebCore::RenderRubyRun::hasRubyBase):
+        (WebCore::RenderRubyRun::isEmpty):
+        (WebCore::RenderRubyRun::rubyText):
+        (WebCore::RenderRubyRun::rubyBase):
+        (WebCore::RenderRubyRun::rubyBaseSafe):
+        (WebCore::RenderRubyRun::firstLineBlock):
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        (WebCore::RenderRubyRun::isChildAllowed):
+        (WebCore::RenderRubyRun::addChild):
+        (WebCore::RenderRubyRun::removeChild):
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/RenderRubyRun.h: Added.
+        (WebCore::RenderRubyRun::renderName):
+        (WebCore::RenderRubyRun::isRubyRun):
+        * rendering/RenderRubyText.cpp: Added.
+        (WebCore::RenderRubyText::RenderRubyText):
+        (WebCore::RenderRubyText::~RenderRubyText):
+        (WebCore::RenderRubyText::isChildAllowed):
+        * rendering/RenderRubyText.h: Added.
+        (WebCore::RenderRubyText::renderName):
+        (WebCore::RenderRubyText::isRubyText):
+
+2009-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30992
+        Node.isDefaultNamespace doesn't convert empty strings to null
+
+        Test: fast/dom/Node/default-namespace-empty-argument.html
+
+        * dom/Node.cpp: (WebCore::Node::isDefaultNamespace): Per DOM 3 Core, treat empty input
+        as null.
+
+2009-11-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't add '/' to the URL path if the it does not include '/' after the protocol component
+        https://bugs.webkit.org/show_bug.cgi?id=30971
+
+        Match IE8 behaviour, that does not add '/' if there is none after the protocol component.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix layering violations in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=30986
+
+        Remove uses of HTMLImageElement and HTMLCanvasElement
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+
+2009-11-01  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Provides access to expected document attributes.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (documentAttributeValue):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+
+2009-11-03  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30964
+        [Gtk] Implemment AtkDocument
+
+        Implements what has been implemented in AT-SPI.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
+        (atk_document_interface_init):
+        (webkit_accessible_document_get_document_attribute_value):
+        (webkit_accessible_document_get_document_attributes):
+        (webkit_accessible_document_get_locale):
+
+2009-11-01  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Turn on warnings for QtWebKit for gcc
+        https://bugs.webkit.org/show_bug.cgi?id=30958
+
+        No new tests as there is no functional change.
+
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Reorder 
+        initialization list to fix compiler warnings.
+
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        [Regression] monitorEvent doesn't work
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Web Inspector: Bug with Message Bubble in Syntax Highlighter
+        https://bugs.webkit.org/show_bug.cgi?id=30990
+
+        * inspector/front-end/SourceFrame.js:
+
+2009-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30982
+        createHTMLDocument doesn't escape ampersand and less-than in title
+
+        Test: fast/dom/DOMImplementation/createHTMLDocument-title.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createHTMLDocument):
+        Set document title after creating the document, avoiding parser intricacies.
+
+2009-11-01  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Double clicking on a breakpoints should not select text
+        https://bugs.webkit.org/show_bug.cgi?id=30950
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-11-01  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix assertion falure in RenderObjectChildList::updateBeforeAfterContent().
+
+        [Crash (debug)] Combination of list-item and :after causes assertion failure
+        https://bugs.webkit.org/show_bug.cgi?id=30944
+
+        Test: fast/css/list-item-pseudo-nocrash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2009-11-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30586
+        [GTK] Failing test media/video-src-empty.html
+
+        Correctly set network/ready state depending on GStreamer errors
+        received on the bus.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete null checks from CanvasRenderingContext3DMac
+        https://bugs.webkit.org/show_bug.cgi?id=30983
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+
+2009-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebGL allows objects to be used with the wrong context
+        https://bugs.webkit.org/show_bug.cgi?id=30981
+
+        Simply add null checks and a few context guards to ensure we don't
+        deref null or attempt to use an object from a different context.
+
+        Tests: fast/canvas/webgl/incorrect-context-object-behaviour.html
+               fast/canvas/webgl/null-object-behaviour.html
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::attachShader):
+        (WebCore::CanvasRenderingContext3D::bindAttribLocation):
+        (WebCore::CanvasRenderingContext3D::bindBuffer):
+        (WebCore::CanvasRenderingContext3D::bindFramebuffer):
+        (WebCore::CanvasRenderingContext3D::bindRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::compileShader):
+        (WebCore::CanvasRenderingContext3D::detachShader):
+        (WebCore::CanvasRenderingContext3D::framebufferRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::framebufferTexture2D):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::isBuffer):
+        (WebCore::CanvasRenderingContext3D::linkProgram):
+        (WebCore::CanvasRenderingContext3D::shaderSource):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryResult
+        https://bugs.webkit.org/show_bug.cgi?id=30857
+
+        Inherits MediaQueryResult class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:5984 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryEvaluator
+        https://bugs.webkit.org/show_bug.cgi?id=30854
+
+        Inherits MediaQueryEvaluator class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:401 and   
+        it is no need to be copyable.
+
+        * css/MediaQueryEvaluator.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleSet
+        https://bugs.webkit.org/show_bug.cgi?id=30852
+
+        Inherits CSSRuleSet class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:455 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.cpp:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleData
+        https://bugs.webkit.org/show_bug.cgi?id=30851
+
+        Inherits CSSRuleData class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.h:320 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSRuleDataList
+        https://bugs.webkit.org/show_bug.cgi?id=30850
+
+        Inherits CSSRuleDataList class from Noncopyable because it has been
+        instantiated by 'new' in WebCore/css/CSSStyleSelector.cpp:2715 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSNamespace
+        https://bugs.webkit.org/show_bug.cgi?id=30849
+
+        Inherits CSSNamespace struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSStyleSheet.cpp:141 and
+        it is no need to be copyable.
+
+        * css/CSSNamespace.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor DatabaseTask in preparation for removing threadsafe refcounting from it.
+        Move the synchronizer object out of the DatabaseTask so there is no need to keep
+        the pointer to Databasetask around after passing it to MessageQueue.
+        Also pass the references to return parameters to the task so it can update them.
+        https://bugs.webkit.org/show_bug.cgi?id=30941
+
+        No new tests, since this is just moving the code around, no change in functionality.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion): Use new DatabaseTaskSynchronizer to wait for task completion.
+        (WebCore::Database::markAsDeletedAndClose): Ditto.
+        (WebCore::Database::tableNames): Ditto.
+        (WebCore::Database::stop): Use the boolean flag rather then 'killed' flag built into MessageQueue.
+        (WebCore::Database::scheduleTransaction): Transaction queue is a Deque now, change the way to fetch the transaction.
+        * storage/Database.h: Change the SQLTransaction queue to be a Deque rather then a MessageQueue.
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTaskSynchronizer::DatabaseTaskSynchronizer):
+        (WebCore::DatabaseTaskSynchronizer::waitForTaskCompletion):
+        (WebCore::DatabaseTaskSynchronizer::taskCompleted):
+        (WebCore::DatabaseTask::DatabaseTask): Ctor takes DatabaseTaskSynchronizer which can be 0.
+        (WebCore::DatabaseTask::performTask): Signal completion. m_synchronizer should still be around since main thread is waiting on it.
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask): Pass synchronizer and return parameters via constructor.
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask): Ditto.
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask): Ditto.
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask): Ditto.
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+
+2009-10-30  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: In Mail, Undo does not restore some characters I have deleted at the end of a line
+        https://bugs.webkit.org/show_bug.cgi?id=30955
+        <rdar://problem/7067033>
+        
+        When the command is deleteWordBackward or deleteWordForward
+        we should not add to the open typing command, but
+        create a new one.
+        
+        Test: editing/undo/undo-deleteWord.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Always start a new command if the granularity is
+        not CharacterGranularity. 
+
+2009-10-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make MediaPlayer constructor private
+        https://bugs.webkit.org/show_bug.cgi?id=30965
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): 
+        (WebCore::HTMLMediaElement::finishParsingChildren): Use MediaPlayer::create.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::create): New.
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of headings is not correct
+
+        https://bugs.webkit.org/show_bug.cgi?id=30937
+
+        Reviewed by Alice Liu.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::stringRoleForMSAA):
+        (WebCore::AccessibilityObject::descriptionForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::shouldReturnTagNameAsRoleForMSAA):
+        If the element's tag name is one of h1, h2, h3, h4, h5, h6, return
+        true.
+        (WebCore::AccessibilityRenderObject::stringRoleForMSAA):
+        If the element should return its tag name as the role, return the tag
+        name.
+        (WebCore::AccessibilityRenderObject::positionalDescriptionForMSAA):
+        If the object is a heading, return the string "L" followed by the
+        heading level.
+        (WebCore::AccessibilityRenderObject::descriptionForMSAA):
+        If the object has a positional description, return it. Otherwise, get
+        the accessibility description, and prefix it with "Description" so that
+        MSAA clients know that it's not a positional description.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Accessibility of links is wrong
+
+        https://bugs.webkit.org/show_bug.cgi?id=30928
+
+        Reviewed by Darin Adler.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::stringValueForMSAA):
+        Return the URL.
+        (WebCore::AccessibilityImageMapLink::nameForMSAA):
+        Return the alt text.
+
+        * accessibility/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isLinked):
+        Return true.
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isLinked):
+        (WebCore::AccessibilityObject::stringValueForMSAA):
+        (WebCore::AccessibilityObject::nameForMSAA):
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::isLinkable):
+        Return true if the element is considered "linkable" with respect to
+        accessibility.
+        (WebCore::AccessibilityRenderObject::stringValueForMSAA):
+        If the element is linkable, check whether it has a parent anchor
+        element. If so, return the anchor element's href.
+        (WebCore::AccessibilityRenderObject::isLinked):
+        Return true if the element is linkable and if it's parent anchor tag's
+        href is non-empty.
+        (WebCore::AccessibilityRenderObject::nameForMSAA):
+        For text nodes, return the text.
+
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-10-30  Evan Stade  <estade@chromium.org>
+
+        Reviewed by David Levin.
+
+        Notify the chrome when the focused node has changed.
+        https://bugs.webkit.org/show_bug.cgi?id=30832
+
+        This is similar to AX code that is already in place, except that this also informs the
+        chrome when there stops being a focused node. This is needed for a browser to show the
+        anchor for links that have keyboard focus.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::focusedNodeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::focusedNodeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+
+2009-10-30  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        openDatabase() with empty version sets db version up incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=28417
+
+        Test: storage/open-database-set-empty-version.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Raise an exception if the current database version does not match the expected version when the current version is the empty string.
+
+2009-10-30  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        Moving the notificationsEnabled bit from NotificationCenter
+        to the new V8 RuntimeEnabledFeatures object.
+
+        Just moving a bit around, so no new tests.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setNotificationsEnabled):
+        (WebCore::RuntimeEnabledFeatures::notificationsEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        * notifications/NotificationCenter.h:
+
+2009-10-30  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] More cleanup after r49949: remove ListenerGuard.
+        ListenerGuard is no longer needed since EventListeners do not depend on frame or v8 context.
+        https://bugs.webkit.org/show_bug.cgi?id=30943
+
+        Covered by fast/events/add-event-without-document.html which will now pass in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-30  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        counterValueForElementById should return space-separated string for multiple counters
+        https://bugs.webkit.org/show_bug.cgi?id=30939
+
+        Test: fast/css/counters/counterValueForElementById.html
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+
+2009-10-30  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Add some comments to explain what is happening here.
+
+2009-10-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix Web Inspector crash on the errors/warnings counter click
+
+        RenderObject::createVisiblePosition(const Position& position)
+        understands "null Positions", so we can construct such a Position manually.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30499
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Third part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (nameFromChildren):
+        (webkit_accessible_get_name):
+        New convenience function to construct an object's name using the name(s) of
+        any children it has.
+
+        (atk_table_interface_init):
+        (webkit_accessible_table_get_column_description):
+        (webkit_accessible_table_get_row_description):
+        Implemented.
+
+        (webkit_accessible_table_get_column_header):
+        Stub function added so that webkit_accessible_table_get_column_description
+        could be implemented in the meantime.
+
+2009-10-30  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Second part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (cellAtIndex):
+        (webkit_accessible_table_get_column_at_index):
+        (webkit_accessible_table_get_row_at_index):
+        (webkit_accessible_table_get_caption):
+        (atk_table_interface_init):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+        * inspector/front-end/inspector.js:
+        (WebInspector.showTimelinePanel):
+
+2009-10-30  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        If the owner widget of the page has a palette set, we
+        should use that one. This was only working when the
+        owner was a QWebView. This patch fixes that.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-10-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Wire CookieJarChromium to the cookies
+        backend. This is a final step of a 3-steps raw cookies
+        access implementation in Chromium.
+
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-10-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Fix Chromium crash in console.log in "deeply recursive" function 
+
+        Check that result of 'frameSourceName' is not null handle
+        before casting it to String. 
+      
+        Allow V8Proxy::sourceName/sourceLineNumber() to report
+        that they have failed due to JavaScript stack overflow.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30904
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::create):
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::sourceLineNumber):
+        (WebCore::V8Proxy::sourceName):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQuery
+        https://bugs.webkit.org/show_bug.cgi?id=30856
+
+        Inherits MediaQuery class from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4905 and
+        it is no need to be copyable.
+
+        * css/CSSStyleSelector.h:
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's MediaQueryExp
+        https://bugs.webkit.org/show_bug.cgi?id=30855
+
+        Inherits MediaQueryExp class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4874.
+
+        * css/MediaQueryExp.h:
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-10-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Removed test for an impossible condition (a glyph in a right-to-left run not having
+        the RTL flag 0x800)
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make links mouse focusable only on GTK and QT.
+
+        Links are now always mouse focusable on GTK and QT. On other platforms
+        the link needs a tabIndex or it needs to be contentEditable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Complete the fix for hit-testing and selection highlighting in ligatures for the ATSUI
+        code path.
+
+        * platform/graphics/mac/ComplexTextController.h: Added m_ltr member to ComplexTextRun.
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): Skip over deleted
+        glyphs, but update indexes and advances correctly.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Initialize m_ltr.
+
+2009-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(3.2.3 - 4.0.2): Message composing: when I undo a color change to text in Mail, undo/redo behaves strangely
+        <rdar://problem/7115041>
+        https://bugs.webkit.org/show_bug.cgi?id=30892
+
+        This problem shows in any scenario where it is necessary to split a text
+        node to apply a style. SplitElementCommand and WrapContentsInDummySpanCommand both
+        have member variables initialized in the constructor to keep reference to elements
+        they need to operate upon. These reference are not updated when reapplying the command.
+        For this reason it is necessary to guarantee that unapply doesn not delete the references
+        and that these commands implement doReapply to correctly reuse the existing
+        elements.
+
+        Test: editing/undo/redo-style.html
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply): Added.
+        (WebCore::SplitElementCommand::doApply): Modified to call executeApply. 
+        (WebCore::SplitElementCommand::doUnapply): Doesn't release m_element1.
+        (WebCore::SplitElementCommand::doReapply): Added.
+        * editing/SplitElementCommand.h: Added doReapply and executeApply.
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::executeApply): Added.
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Modified to call executeApply.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Doesn't release m_dummySpan.
+        (WebCore::WrapContentsInDummySpanCommand::doReapply): Added.
+        * editing/WrapContentsInDummySpanCommand.h: Added doReapply and executeApply.
+
+2009-10-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DOM Storage's condition variable needs to handle spurious wakeups
+        https://bugs.webkit.org/show_bug.cgi?id=30920
+
+        Add a boolean to keep track of whether it's been terminated.  Clean
+        up the locking code a tiny bit to make it easier to read.  There's
+        no way to reproduce this reliably in a LayoutTest.
+
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::terminate):
+        (WebCore::LocalStorageThread::performTerminate):
+        * storage/LocalStorageThread.h:
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Include ComplextTextController into Chromium Mac project.
+
+        * WebCore.gyp/WebCore.gyp: Added include rule for ComplextText* files.
+
+2009-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Fix tabbing through element attributes in the Web Insector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30429
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted): Don't call _updateTitle,
+        it is called for us when removeAttribute succeeds in the back-end.
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted): Ditto except for nodeValue.
+        (WebInspector.ElementsTreeElement.prototype._editingCancelled): Don't call _updateTitle, editing code reverts.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Return early if we are editing.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Problem editing or selecting text containing ligatures
+        https://bugs.webkit.org/show_bug.cgi?id=30025
+
+        Test: platform/mac/fast/text/ligature-subdivision.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize
+        m_characterInCurrentGlyph.
+        (WebCore::ComplexTextController::offsetForPosition): If the hit glyph spans multiple
+        characters, compute the hit character based on dividing the glyph’s total advance into
+        a number of equal intervals equal to the number of characters and assigning the hit to the
+        character corresponding to the hit interval.
+        (WebCore::ComplexTextController::advance): If the final offset occurs mid-glyph, advance
+        by a fraction of the glyph’s total advance.
+        * platform/graphics/mac/ComplexTextController.h: Added m_characterInCurrentGlyph.
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30918>.
+        Web Inspector: Datagrid Rows on Windows not properly aligned.
+        
+        Use line-height for the table rows to make sure the height
+        of our text and the height of the table rows are consistent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r50296.
+        http://trac.webkit.org/changeset/50296
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Out-of-memory crash in isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=30906
+
+        We need to handle the fact that creating a V8:Context might fail.  I
+        don't know how to test this change because creating a context usually
+        only fails when V8 decides it's using too much memory.
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Remove build warning introduced by r50284.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Remove random crashes by removing retrieval of V8 context during garbage collection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30919
+
+        Unfortunately, I haven't been able to trigger this crash explicitly, so no test :(.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::jsWrapperForDOMObject): Added new "assume-it's-there" getter.
+        * bindings/v8/V8DOMWrapper.h: Added getter decl.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GCPrologueVisitor::visitDOMWrapper): Changed to use explicit getter.
+
+2009-10-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Adjust the project files to sync up with
+        http://trac.webkit.org/changeset/50259
+
+        * WebCore.gypi: Renamed and added files.
+
+2009-10-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Implement DELETE HTTP method for XmlHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=30894
+
+        No new tests as this functionality is already tested by the 
+        xmlhttprequest LayoutTests. As this patch depends on an unreleased
+        version of the dependent QtNetwork library and the tests will be
+        enabled later once the dependent library is released (and the
+        buildbot is updated).
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Part of <http://webkit.org/b/30483>.
+        Web Inspector: Always show the Local and Session Storage Views.
+        
+        Even if the length of the DOM Storage entry array is 0, still
+        generate the Datagrid because users can add things storage items
+        through the UI, so we should allow them to even if there isn't
+        anything there currently.
+
+        * English.lproj/localizedStrings.js: Removed "This Storage is Empty".
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add TimelinePanel into the panels enum.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30915
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+
+2009-10-29  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Threading problems with some of the tests
+        https://bugs.webkit.org/show_bug.cgi?id=30814
+
+        Create strings shared among threads with crossThreadString
+        constructor method.
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-29  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30308
+        
+        Add support for ARGB videos.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        Create the Cairo image surface for ARGB32 or RGB24
+        depending on the buffer's caps.
+        
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        Handle ARGB video and convert GStreamer's ARGB to
+        Cairo's for displaying.
+
+2009-10-29  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] expose a method to access memory usage information in ChromiumBridge
+        Declare a static method to be implemented by http://codereview.chromium.org/332010/
+        https://bugs.webkit.org/show_bug.cgi?id=30829
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Implements the AtkSelection interface and enables the corresponding
+        (and expected) object:selection-changed event.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (optionFromList):
+        (optionFromSelection):
+        (atk_selection_interface_init):
+        (webkit_accessible_selection_add_selection):
+        (webkit_accessible_selection_clear_selection):
+        (webkit_accessible_selection_ref_selection):
+        (webkit_accessible_selection_get_selection_count):
+        (webkit_accessible_selection_is_child_selected):
+        (webkit_accessible_selection_remove_selection):
+        (webkit_accessible_selection_select_all_selection):
+        (GetAtkInterfaceTypeFromWAIType):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (AXObjectCache::postPlatformNotification):
+
+2009-10-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 30655 - Only plain text should be copied to clipboard for TextArea.
+        https://bugs.webkit.org/show_bug.cgi?id=30655
+
+        * editing/Editor.cpp:
+        (WebCore::nodeIsInTextFormControl):
+        (WebCore::Editor::cut):
+        (WebCore::Editor::copy):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: hide timeline for now - not yet ready.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30912
+
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: deploy Web Inspector's images in WebCore.gypi.
+
+        * WebCore.gypi:
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: get rid of timelineProfilerEnabled method.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30911
+
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        * inspector/InspectorController.h:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClicked):
+
+2009-10-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Create stub methods for raw cookies access in ChromiumBridge.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=30910
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's RareData
+        https://bugs.webkit.org/show_bug.cgi?id=30858
+
+        Inherits RareData struct from Noncopyable because it is
+        instantiated by 'new' in WebCore/css/CSSSelector.h:259 and 
+        it is no need to be copyable.
+
+        * css/CSSSelector.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's ShorthandScope
+        https://bugs.webkit.org/show_bug.cgi?id=30859
+
+        Inherits ShorthandScope class from FastAllocBase because it is 
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:902 and 
+        it is no need to be copyable.        
+
+        * css/CSSParser.h:
+
+2009-10-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's AXObjectCache
+        https://bugs.webkit.org/show_bug.cgi?id=30848
+
+        Inherits AXObjectCache class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/dom/Document.cpp:1537 and                                
+        it is no need to be copyable.
+
+        * accessibility/AXObjectCache.h:
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't run JavaScript URLs in view source mode
+        https://bugs.webkit.org/show_bug.cgi?id=30881
+
+        Just say no.
+
+        Test: http/tests/security/view-source-no-javascript-url.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+
+2009-10-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fixes style problems pointed out by Evan Martin.
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        64-bit Leopard build fix after r50259
+        
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        Declared ATSUTextInserted in 64-bit.
+        (WebCore::fontHasMirroringInfo): Use %d format and cast to int.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Ditto.
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextController.h:
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-29  Dan Bernstein  <mitz@apple.com>
+
+        Attempted Tiger build fix after r50259
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30899
+        WebKit fails to build release on 32-bit Windows systems
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded files from project.
+        * bindings/js/JSBindingsAllInOne.cpp: Added.
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fixed typos in color names.
+
+        * inspector/front-end/Color.js:
+
+2009-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Share code between the ATSUI- and Core Text-based Font implementations by doing the
+        following:
+        - Generalize CoreTextController as ComplexTextController, keeping the Core Text-specific
+          parts in ComplexTextControllerCoreText.cpp.
+        - Generalize FontMacCoreText as FontComplexTextMac using ComplexTextController
+        - Implement ATSUI-specific parts of ComplexTextController in ComplexTextControllerATSUI.
+        - Remove FontMacATSUI.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed CoreTextController.{cpp,h}, FontMacATSUI.mm,
+        and FontMacCoreText.cpp, and added ComplexTextController.{cpp,h},
+        ComplexTextControllerATSUI.cpp, ComplexTextControllerCoreText.cpp, and
+        FontComplexTextMac.cpp.
+
+        * platform/graphics/mac/ComplexTextController.cpp: Copied from CoreTextController.cpp and
+        kept the non-Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextController): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::offsetForPosition): Updated for renames and for
+        m_complexTextRuns holding references instead of objects.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Updated for renames, including
+        its own.
+        (WebCore::ComplexTextController::advance): Updated for renames.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Updated for renames and for
+        m_complexTextRuns holding references instead of objects, and changed to use the glyphs()
+        and advances() accessors.
+
+        * platform/graphics/mac/ComplexTextController.h: Copied from CoreTextController.h and
+        renamed CoreTextController to ComplexTextController and CoreTextRun to ComplexTextRun. Made
+        the latter RefCounted, added ATSUI-specific members to it, and made some other members
+        Core Text-specific. Renamed m_coreTextRuns to m_complexTextRuns and made it hold references
+        rather than objects.
+        (WebCore::ComplexTextController::ComplexTextRun::create):
+        (WebCore::ComplexTextController::ComplexTextRun::glyphs):
+        (WebCore::ComplexTextController::ComplexTextRun::advances):
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp: Added. Includes ATSUI-specific
+        parts of the ComplexTextController implementation. 
+        (WebCore::ComplexTextController::ComplexTextRun::overrideLayoutOperation): This ATSUI
+        callback populates the ComplexTextRun’s glyphs, advances and indices vectors. It is invoked
+        when the ComplexTextRun constructor calls ATSUGetGlyphBounds().
+        (WebCore::isArabicLamWithAlefLigature): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::shapeArabic): Helper function, adapted from FontMacATSUI.mm.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Sets up the
+        ATSUTextLayout, substituting the text buffer if necessary for things like shaping Arabic,
+        mirroring glyphs or directionality overrides, then calls ATSUGetGlyphBounds() in order to
+        get the glyphs, advances and indices vectors populated.
+        (WebCore::fontHasMirroringInfo): Helper function, copied from FontMacATSUI.mm.
+        (WebCore::disableLigatures): Ditto.
+        (WebCore::initializeATSUStyle): Ditto, somewhat cleaned up and simplified.
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Constructs
+        ComplexTextRuns, either missing-glyphs ones or ATSUTextLayout-based ones.
+
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp: Copied from
+        CoreTextController.cpp and kept the Core Text-specific bits.
+        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Updated for renames,
+        including its own, and moved the code to initialize m_glyphs and m_advances here. Previously
+        this was done in adjustGlyphsAndAdvances().
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Updated for renames,
+        including its own.
+        * platform/graphics/mac/CoreTextController.cpp: Removed.
+        * platform/graphics/mac/CoreTextController.h: Removed.
+        * platform/graphics/mac/FontComplexTextMac.cpp: Renamed FontMacCoreText.cpp to this.
+        (WebCore::Font::selectionRectForComplexText): Changed to use ComplexTextController instead
+        of CoreTextController.
+        (WebCore::Font::drawComplexText): Ditto.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        * platform/graphics/mac/FontMacATSUI.mm: Removed.
+        * platform/graphics/mac/FontMacCoreText.cpp: Removed.
+
 2009-10-27  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Darin Adler.
@@ -44,7 +16715,7 @@
         * xml/XPathFunctions.cpp:
         (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
 
-2009-10-28  Adam Barth  <abarth@webkit.org>
+2009-10-29  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 42aa3cf..cd462d6 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -44,14 +44,13 @@ ENABLE_DATAGRID = ENABLE_DATAGRID;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
-ENABLE_FILTERS = ;
+ENABLE_FILTERS = ENABLE_FILTERS;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
 ENABLE_MATHML = ;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
-ENABLE_RUBY = ENABLE_RUBY;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
@@ -67,4 +66,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index fabc009..b3bf41d 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 4;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index 1edbf7d..e96b606 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -34,7 +34,7 @@
 #include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
 #if ENABLE(3D_CANVAS)    
-#include "JSCanvasRenderingContext3D.cpp"
+#include "JSWebGLRenderingContext.cpp"
 #endif
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
@@ -42,6 +42,7 @@
 #include "JSClientRectList.cpp"
 #include "JSClipboard.cpp"
 #include "JSComment.cpp"
+#include "JSCompositionEvent.cpp"
 #include "JSConsole.cpp"
 #include "JSCounter.cpp"
 #include "JSCSSCharsetRule.cpp"
@@ -180,6 +181,7 @@
 #include "JSPageTransitionEvent.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
+#include "JSPopStateEvent.cpp"
 #include "JSProcessingInstruction.cpp"
 #include "JSProgressEvent.cpp"
 #include "JSRange.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index fd38707..8191222 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -70,32 +70,34 @@ DOM_CLASSES = \
     CSSValueList \
     CSSVariablesRule \
     CSSVariablesDeclaration \
-    CanvasActiveInfo \
-    CanvasArray \
-    CanvasArrayBuffer \
-    CanvasBuffer \
-    CanvasByteArray \
-    CanvasFloatArray \
-    CanvasFramebuffer \
+    WebGLActiveInfo \
+    WebGLArray \
+    WebGLArrayBuffer \
+    WebGLBuffer \
+    WebGLByteArray \
+    WebGLFloatArray \
+    WebGLFramebuffer \
     CanvasGradient \
-    CanvasIntArray \
+    WebGLIntArray \
     CanvasPattern \
-    CanvasProgram \
-    CanvasRenderbuffer \
+    WebGLProgram \
+    WebGLRenderbuffer \
     CanvasRenderingContext \
     CanvasRenderingContext2D \
-    CanvasRenderingContext3D \
-    CanvasShader \
-    CanvasShortArray \
-    CanvasTexture \
-    CanvasUnsignedByteArray \
-    CanvasUnsignedIntArray \
-    CanvasUnsignedShortArray \
+    WebGLRenderingContext \
+    WebGLShader \
+    WebGLShortArray \
+    WebGLTexture \
+    WebGLUniformLocation \
+    WebGLUnsignedByteArray \
+    WebGLUnsignedIntArray \
+    WebGLUnsignedShortArray \
     CharacterData \
     ClientRect \
     ClientRectList \
     Clipboard \
     Comment \
+    CompositionEvent \
     Console \
     Coordinates \
     Counter \
@@ -198,7 +200,9 @@ DOM_CLASSES = \
     HTMLVideoElement \
     History \
     ImageData \
+    InjectedScriptHost \
     InspectorBackend \
+    InspectorFrontendHost \
     KeyboardEvent \
     Location \
     Media \
@@ -224,6 +228,7 @@ DOM_CLASSES = \
     PageTransitionEvent \
     Plugin \
     PluginArray \
+    PopStateEvent \
     PositionError \
     ProcessingInstruction \
     ProgressEvent \
@@ -616,10 +621,6 @@ ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO=1
 endif
 
-ifeq ($(findstring ENABLE_RUBY,$(FEATURE_DEFINES)), ENABLE_RUBY)
-    HTML_FLAGS := $(HTML_FLAGS) ENABLE_RUBY=1
-endif
-
 ifdef HTML_FLAGS
 
 HTMLElementFactory.cpp HTMLNames.cpp : dom/make_names.pl html/HTMLTagNames.in html/HTMLAttributeNames.in
@@ -806,9 +807,12 @@ ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Pla
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.NPAPI.exp
 endif
 
-ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
+# FIXME: WTF_USE_PLUGIN_HOST_PROCESS is only true when building for x86_64, but we shouldn't have to know about that here.
+ifeq ($(findstring x86_64,$(ARCHS)) $(findstring x86_64,$(VALID_ARCHS)), x86_64 x86_64)
+ifeq ($(shell gcc -arch x86_64 -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.PluginHostProcess.exp
 endif
+endif
 
 ifeq ($(findstring ENABLE_3D_RENDERING,$(FEATURE_DEFINES)), ENABLE_3D_RENDERING)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.3DRendering.exp
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index 0e150f0..e18a163 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index c4560ab..f8fa302 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -115,6 +115,7 @@ IDL_BINDINGS += \
 	WebCore/dom/ClientRectList.idl \
 	WebCore/dom/Clipboard.idl \
 	WebCore/dom/Comment.idl \
+	WebCore/dom/CompositionEvent.idl \
 	WebCore/dom/DOMCoreException.idl \
 	WebCore/dom/DOMImplementation.idl \
 	WebCore/dom/Document.idl \
@@ -140,6 +141,7 @@ IDL_BINDINGS += \
 	WebCore/dom/Notation.idl \
 	WebCore/dom/OverflowEvent.idl \
 	WebCore/dom/PageTransitionEvent.idl \
+	WebCore/dom/PopStateEvent.idl \
 	WebCore/dom/ProcessingInstruction.idl \
 	WebCore/dom/ProgressEvent.idl \
 	WebCore/dom/Range.idl \
@@ -151,20 +153,20 @@ IDL_BINDINGS += \
 	WebCore/dom/WebKitAnimationEvent.idl \
 	WebCore/dom/WebKitTransitionEvent.idl \
 	WebCore/dom/WheelEvent.idl \
-	WebCore/html/canvas/CanvasArray.idl \
-	WebCore/html/canvas/CanvasArrayBuffer.idl \
-	WebCore/html/canvas/CanvasByteArray.idl \
-	WebCore/html/canvas/CanvasFloatArray.idl \
+	WebCore/html/canvas/WebGLArray.idl \
+	WebCore/html/canvas/WebGLArrayBuffer.idl \
+	WebCore/html/canvas/WebGLByteArray.idl \
+	WebCore/html/canvas/WebGLFloatArray.idl \
 	WebCore/html/canvas/CanvasGradient.idl \
-	WebCore/html/canvas/CanvasIntArray.idl \
+	WebCore/html/canvas/WebGLIntArray.idl \
 	WebCore/html/canvas/CanvasPattern.idl \
 	WebCore/html/canvas/CanvasRenderingContext.idl \
 	WebCore/html/canvas/CanvasRenderingContext2D.idl \
-	WebCore/html/canvas/CanvasRenderingContext3D.idl \
-	WebCore/html/canvas/CanvasShortArray.idl \
-	WebCore/html/canvas/CanvasUnsignedByteArray.idl \
-	WebCore/html/canvas/CanvasUnsignedIntArray.idl \
-	WebCore/html/canvas/CanvasUnsignedShortArray.idl \
+	WebCore/html/canvas/WebGLRenderingContext.idl \
+	WebCore/html/canvas/WebGLShortArray.idl \
+	WebCore/html/canvas/WebGLUnsignedByteArray.idl \
+	WebCore/html/canvas/WebGLUnsignedIntArray.idl \
+	WebCore/html/canvas/WebGLUnsignedShortArray.idl \
 	WebCore/html/DataGridColumn.idl \
 	WebCore/html/DataGridColumnList.idl \
 	WebCore/html/File.idl \
@@ -245,7 +247,9 @@ IDL_BINDINGS += \
 	WebCore/html/ValidityState.idl \
 	WebCore/html/VoidCallback.idl \
 	WebCore/inspector/JavaScriptCallFrame.idl \
+	WebCore/inspector/InjectedScriptHost.idl \
 	WebCore/inspector/InspectorBackend.idl \
+	WebCore/inspector/InspectorFrontendHost.idl \
 	WebCore/notifications/Notification.idl \
 	WebCore/notifications/NotificationCenter.idl \
 	WebCore/page/BarInfo.idl \
@@ -372,7 +376,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSExceptionBase.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
 	WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
- 	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
+	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.h \
 	WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
@@ -397,7 +401,8 @@ webcore_sources += \
 	WebCore/bindings/js/JSImageConstructor.cpp \
 	WebCore/bindings/js/JSImageConstructor.h \
 	WebCore/bindings/js/JSImageDataCustom.cpp \
-	WebCore/bindings/js/JSInspectorBackendCustom.cpp \
+	WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
+	WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
 	WebCore/bindings/js/JSInspectedObjectWrapper.cpp \
 	WebCore/bindings/js/JSInspectedObjectWrapper.h \
 	WebCore/bindings/js/JSInspectorCallbackWrapper.cpp \
@@ -428,6 +433,8 @@ webcore_sources += \
 	WebCore/bindings/js/JSPluginCustom.cpp \
 	WebCore/bindings/js/JSPluginElementFunctions.cpp \
 	WebCore/bindings/js/JSPluginElementFunctions.h \
+	WebCore/bindings/js/JSPopStateEventCustom.cpp \
+	WebCore/bindings/js/JSPopStateEventCustom.h \
 	WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp \
 	WebCore/bindings/js/JSQuarantinedObjectWrapper.h \
 	WebCore/bindings/js/JSStorageCustom.h \
@@ -465,8 +472,6 @@ webcore_sources += \
 	WebCore/bindings/js/ScriptInstance.h \
 	WebCore/bindings/js/ScriptObject.cpp \
 	WebCore/bindings/js/ScriptObject.h \
-	WebCore/bindings/js/ScriptObjectQuarantine.cpp \
-	WebCore/bindings/js/ScriptObjectQuarantine.h \
 	WebCore/bindings/js/ScriptSourceCode.h \
 	WebCore/bindings/js/ScriptSourceProvider.h \
 	WebCore/bindings/js/ScriptState.cpp \
@@ -663,8 +668,6 @@ webcore_sources += \
 	WebCore/dom/CheckedRadioButtons.h \
 	WebCore/dom/ChildNodeList.cpp \
 	WebCore/dom/ChildNodeList.h \
-	WebCore/dom/ClassNames.cpp \
-	WebCore/dom/ClassNames.h \
 	WebCore/dom/ClassNodeList.cpp \
 	WebCore/dom/ClassNodeList.h \
 	WebCore/dom/ClientRect.cpp \
@@ -678,6 +681,8 @@ webcore_sources += \
 	WebCore/dom/ClipboardEvent.h \
 	WebCore/dom/Comment.cpp \
 	WebCore/dom/Comment.h \
+	WebCore/dom/CompositionEvent.cpp \
+	WebCore/dom/CompositionEvent.h \
 	WebCore/dom/ContainerNode.cpp \
 	WebCore/dom/ContainerNode.h \
 	WebCore/dom/ContainerNodeAlgorithms.h \
@@ -768,6 +773,8 @@ webcore_sources += \
 	WebCore/dom/PageTransitionEvent.h \
 	WebCore/dom/Position.cpp \
 	WebCore/dom/Position.h \
+	WebCore/dom/PopStateEvent.cpp \
+	WebCore/dom/PopStateEvent.h \
 	WebCore/dom/PositionIterator.cpp \
 	WebCore/dom/PositionIterator.h \
 	WebCore/dom/ProcessingInstruction.cpp \
@@ -790,6 +797,8 @@ webcore_sources += \
 	WebCore/dom/SelectElement.h \
 	WebCore/dom/SelectorNodeList.cpp \
 	WebCore/dom/SelectorNodeList.h \
+	WebCore/dom/SpaceSplitString.cpp \
+	WebCore/dom/SpaceSplitString.h \
 	WebCore/dom/StaticNodeList.cpp \
 	WebCore/dom/StaticNodeList.h \
 	WebCore/dom/StyleElement.cpp \
@@ -1126,6 +1135,8 @@ webcore_sources += \
 	WebCore/html/HTMLUListElement.h \
 	WebCore/html/HTMLViewSourceDocument.cpp \
 	WebCore/html/HTMLViewSourceDocument.h \
+	WebCore/html/ISODateTime.cpp \
+	WebCore/html/ISODateTime.h \
 	WebCore/html/ImageData.cpp \
 	WebCore/html/ImageData.h \
 	WebCore/html/MediaError.h \
@@ -1164,6 +1175,8 @@ webcore_sources += \
 	WebCore/icu/unicode/uversion.h \
 	WebCore/inspector/ConsoleMessage.cpp \
 	WebCore/inspector/ConsoleMessage.h \
+	WebCore/inspector/InjectedScriptHost.cpp \
+	WebCore/inspector/InjectedScriptHost.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1177,6 +1190,8 @@ webcore_sources += \
 	WebCore/inspector/InspectorController.h \
 	WebCore/inspector/InspectorFrontend.cpp \
 	WebCore/inspector/InspectorFrontend.h \
+	WebCore/inspector/InspectorFrontendHost.cpp \
+	WebCore/inspector/InspectorFrontendHost.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
 	WebCore/inspector/InspectorTimelineAgent.cpp \
@@ -1303,6 +1318,7 @@ webcore_sources += \
 	WebCore/page/ContextMenuClient.h \
 	WebCore/page/ContextMenuController.cpp \
 	WebCore/page/ContextMenuController.h \
+	WebCore/page/ContextMenuSelectionHandler.h \
 	WebCore/page/Coordinates.h \
 	WebCore/page/DOMSelection.cpp \
 	WebCore/page/DOMSelection.h \
@@ -1484,6 +1500,7 @@ webcore_sources += \
 	WebCore/platform/graphics/BitmapImage.h \
 	WebCore/platform/graphics/Color.cpp \
 	WebCore/platform/graphics/Color.h \
+	WebCore/platform/graphics/ColorSpace.h \
 	WebCore/platform/graphics/DashArray.h \
 	WebCore/platform/graphics/FloatPoint.cpp \
 	WebCore/platform/graphics/FloatPoint.h \
@@ -1583,6 +1600,7 @@ webcore_sources += \
 	WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
 	WebCore/platform/network/AuthenticationChallengeBase.cpp \
 	WebCore/platform/network/AuthenticationChallengeBase.h \
+	WebCore/platform/network/AuthenticationClient.h \
 	WebCore/platform/network/Credential.cpp \
 	WebCore/platform/network/Credential.h \
 	WebCore/platform/network/DNS.h \
@@ -1634,14 +1652,10 @@ webcore_sources += \
 	WebCore/platform/text/StringImpl.cpp \
 	WebCore/platform/text/StringImpl.h \
 	WebCore/platform/text/TextBoundaries.h \
-	WebCore/platform/text/TextBoundariesICU.cpp \
+	WebCore/platform/text/TextBoundaries.cpp \
 	WebCore/platform/text/TextBreakIterator.h \
-	WebCore/platform/text/TextBreakIteratorICU.cpp \
-	WebCore/platform/text/TextBreakIteratorInternalICU.h \
 	WebCore/platform/text/TextCodec.cpp \
 	WebCore/platform/text/TextCodec.h \
-	WebCore/platform/text/TextCodecICU.cpp \
-	WebCore/platform/text/TextCodecICU.h \
 	WebCore/platform/text/TextCodecLatin1.cpp \
 	WebCore/platform/text/TextCodecLatin1.h \
 	WebCore/platform/text/TextCodecUTF16.cpp \
@@ -1775,6 +1789,14 @@ webcore_sources += \
 	WebCore/rendering/RenderReplaced.h \
 	WebCore/rendering/RenderReplica.cpp \
 	WebCore/rendering/RenderReplica.h \
+	WebCore/rendering/RenderRuby.cpp \
+	WebCore/rendering/RenderRuby.h \
+	WebCore/rendering/RenderRubyBase.cpp \
+	WebCore/rendering/RenderRubyBase.h \
+	WebCore/rendering/RenderRubyRun.cpp \
+	WebCore/rendering/RenderRubyRun.h \
+	WebCore/rendering/RenderRubyText.cpp \
+	WebCore/rendering/RenderRubyText.h \
 	WebCore/rendering/RenderScrollbar.cpp \
 	WebCore/rendering/RenderScrollbar.h \
 	WebCore/rendering/RenderScrollbarPart.cpp \
@@ -1845,6 +1867,7 @@ webcore_sources += \
 	WebCore/rendering/style/FillLayer.h \
 	WebCore/rendering/style/KeyframeList.cpp \
 	WebCore/rendering/style/KeyframeList.h \
+	WebCore/rendering/style/LineClampValue.h \
 	WebCore/rendering/style/NinePieceImage.cpp \
 	WebCore/rendering/style/NinePieceImage.h \
 	WebCore/rendering/style/OutlineValue.h \
@@ -2010,9 +2033,31 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
 	WebCore/platform/network/soup/ResourceResponse.h \
-	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp \
 	WebCore/workers/SharedWorkerRepository.h
 
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+webcoregtk_sources += \
+	WebCore/platform/text/TextCodecICU.cpp \
+	WebCore/platform/text/TextCodecICU.h \
+	WebCore/platform/text/TextBreakIteratorICU.cpp \
+	WebCore/platform/text/TextBreakIteratorInternalICU.h \
+	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
+endif
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+webcoregtk_sources += \
+	WebCore/platform/text/gtk/TextCodecGtk.cpp \
+	WebCore/platform/text/gtk/TextCodecGtk.h \
+	WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
+endif
+
+
 # ---
 # Channel mesaging support
 # ---
@@ -2069,6 +2114,10 @@ FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 webcore_cppflags += \
 	-DENABLE_JAVASCRIPT_DEBUGGER=1
 
+else
+webcore_cppflags += \
+	-DENABLE_JAVASCRIPT_DEBUGGER=0
+
 endif # END ENABLE_JAVASCRIPT_DEBUGGER
 
 # ----
@@ -2349,16 +2398,6 @@ webcore_libadd += \
 endif # END ENABLE_VIDEO
 
 # ----
-# Ruby Support
-# ----
-if ENABLE_RUBY
-
-HTML_FEATURES += ENABLE_RUBY=1
-webcore_cppflags += -DENABLE_RUBY=1
-
-endif # END ENABLE_RUBY
-
-# ----
 # XPath Support
 # ----
 if ENABLE_XPATH
@@ -2607,6 +2646,8 @@ webcore_sources += \
 	WebCore/platform/graphics/filters/Filter.h \
 	WebCore/platform/graphics/filters/FilterEffect.cpp \
 	WebCore/platform/graphics/filters/FilterEffect.h \
+	WebCore/platform/graphics/filters/ImageBufferFilter.cpp \
+	WebCore/platform/graphics/filters/ImageBufferFilter.h \
 	WebCore/platform/graphics/filters/SourceAlpha.cpp \
 	WebCore/platform/graphics/filters/SourceAlpha.h \
 	WebCore/platform/graphics/filters/SourceGraphic.cpp \
diff --git a/WebCore/WebCore.DragSupport.exp b/WebCore/WebCore.DragSupport.exp
index 2cfd076..30786ba 100644
--- a/WebCore/WebCore.DragSupport.exp
+++ b/WebCore/WebCore.DragSupport.exp
@@ -1,5 +1,4 @@
 __ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
 __ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
 __ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
 __ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
diff --git a/WebCore/WebCore.Inspector.exp b/WebCore/WebCore.Inspector.exp
index 576994f..379b7a2 100644
--- a/WebCore/WebCore.Inspector.exp
+++ b/WebCore/WebCore.Inspector.exp
@@ -1,4 +1,4 @@
-__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
+__ZN7WebCore19InspectorController10setSettingERKNS_6StringES3_
 __ZN7WebCore19InspectorController12attachWindowEv
 __ZN7WebCore19InspectorController12detachWindowEv
 __ZN7WebCore19InspectorController14enableDebuggerEv
@@ -16,3 +16,5 @@ __ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
 __ZNK7WebCore19InspectorController7enabledEv
 __ZNK7WebCore19InspectorController7settingERKNS_6StringE
+__ZN7WebCore19InspectorController21startTimelineProfilerEv
+__ZN7WebCore19InspectorController20stopTimelineProfilerEv
diff --git a/WebCore/WebCore.Video.exp b/WebCore/WebCore.Video.exp
index 5d35698..57619b4 100644
--- a/WebCore/WebCore.Video.exp
+++ b/WebCore/WebCore.Video.exp
@@ -1,14 +1,16 @@
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZN7WebCore16HTMLMediaElement12endScrubbingEv
+__ZN7WebCore16HTMLMediaElement14beginScrubbingEv
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
 __ZN7WebCore16HTMLMediaElement4playEv
 __ZN7WebCore16HTMLMediaElement5pauseEv
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement6rewindEf
-__ZN7WebCore16HTMLMediaElement10screenRectEv
 __ZNK7WebCore16HTMLMediaElement11currentTimeEv
 __ZNK7WebCore16HTMLMediaElement13platformMediaEv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index a8bed54..8df5524 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -145,6 +145,7 @@ __ZN7WebCore10StringImplcvP8NSStringEv
 __ZN7WebCore10StringImpldlEPv
 __ZN7WebCore10handCursorEv
 __ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
 __ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
 __ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
 __ZN7WebCore11EditCommand7reapplyEv
@@ -157,7 +158,6 @@ __ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
 __ZN7WebCore11FrameLoader14detachChildrenEv
-__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
 __ZN7WebCore11FrameLoader14stopAllLoadersENS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader16detachFromParentEv
 __ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEENS_14ReferrerPolicyE
@@ -248,6 +248,7 @@ __ZN7WebCore12IconDatabase4openERKNS_6StringE
 __ZN7WebCore12IconDatabase5closeEv
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
+__ZN7WebCore12RenderWidget19showSubstituteImageEN3WTF10PassRefPtrINS_5ImageEEE
 __ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
 __ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
 __ZN7WebCore12SharedBuffer12createNSDataEv
@@ -282,7 +283,6 @@ __ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
 __ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
 __ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
 __ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
 __ZN7WebCore14DocumentLoader7requestEv
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
@@ -324,6 +324,7 @@ __ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList9goForwardEv
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
 __ZN7WebCore15BackForwardListD1Ev
+__ZN7WebCore15DOMWrapperWorldD1Ev
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKNS_6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -341,7 +342,7 @@ __ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
 __ZN7WebCore15FocusController18focusedOrMainFrameEv
 __ZN7WebCore15FocusController9setActiveEb
-__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorENS_10ColorSpaceE
 __ZN7WebCore15GraphicsContextC1EP9CGContext
 __ZN7WebCore15GraphicsContextD1Ev
 __ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
@@ -370,10 +371,10 @@ __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
 __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
 __ZN7WebCore16NavigationActionC1Ev
 __ZN7WebCore16ScriptController10initScriptEPNS_15DOMWrapperWorldE
-__ZN7WebCore16ScriptController12globalObjectEj
+__ZN7WebCore16ScriptController11createWorldEv
 __ZN7WebCore16ScriptController13executeScriptERKNS_6StringEb
 __ZN7WebCore16ScriptController18windowScriptObjectEv
-__ZN7WebCore16ScriptController28executeScriptInIsolatedWorldEjRKNS_6StringEb
+__ZN7WebCore16ScriptController20executeScriptInWorldEPNS_15DOMWrapperWorldERKNS_6StringEb
 __ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
 __ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
 __ZN7WebCore16colorFromNSColorEP7NSColor
@@ -385,16 +386,15 @@ __ZN7WebCore16threadGlobalDataEv
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
-__ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17HTMLPlugInElement11getNPObjectEv
-__ZN7WebCore21mainThreadNormalWorldEv
+__ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN7WebCore18deprecatedParseURLERKNS_6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
 __ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
-__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
-__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
 __ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
 __ZN7WebCore19SelectionController10setFocusedEb
 __ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
@@ -414,9 +414,13 @@ __ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
 __ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
+__ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJSValue
+__ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
+__ZN7WebCore21SerializedScriptValueD1Ev
 __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
+__ZN7WebCore21mainThreadNormalWorldEv
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
 __ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
 __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
@@ -424,7 +428,7 @@ __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
 __ZN7WebCore22counterValueForElementEPNS_7ElementE
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
-__ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
+__ZN7WebCore22externalRepresentationEPNS_5FrameE
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
 __ZN7WebCore23ApplicationCacheStorage16storeCopyOfCacheERKNS_6StringEPNS_20ApplicationCacheHostE
 __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
@@ -457,7 +461,6 @@ __ZN7WebCore31applicationIsMicrosoftMessengerEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
-__ZN7WebCore33DebuggerCallFrame_evaluateInWorldERKN3JSC17DebuggerCallFrameERKNS0_7UStringERNS0_7JSValueE
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
@@ -473,6 +476,8 @@ __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
+__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
+__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
 __ZN7WebCore4Page14setMediaVolumeEf
 __ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN7WebCore4Page15backForwardListEv
@@ -607,6 +612,7 @@ __ZN7WebCore8FormDataD1Ev
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
 __ZN7WebCore8Settings14setJavaEnabledEb
+__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings16setZoomsTextOnlyEb
 __ZN7WebCore8Settings17setPluginsEnabledEb
@@ -616,18 +622,21 @@ __ZN7WebCore8Settings18setFixedFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings18setSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings19setDatabasesEnabledEb
+__ZN7WebCore8Settings19setShowDebugBordersEb
 __ZN7WebCore8Settings20setCursiveFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings20setFantasyFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings20setJavaScriptEnabledEb
 __ZN7WebCore8Settings20setXSSAuditorEnabledEb
 __ZN7WebCore8Settings21setStandardFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings21setWebSecurityEnabledEb
+__ZN7WebCore8Settings21setShowRepaintCounterEb
 __ZN7WebCore8Settings22setLocalStorageEnabledEb
 __ZN7WebCore8Settings22setSansSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings22setShowsURLsInToolTipsEb
 __ZN7WebCore8Settings23setDefaultFixedFontSizeEi
 __ZN7WebCore8Settings23setEditableLinkBehaviorENS_20EditableLinkBehaviorE
 __ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
+__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
 __ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings24setApplicationChromeModeEb
 __ZN7WebCore8Settings24setTextAreasAreResizableEb
@@ -639,7 +648,6 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
 __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
-__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings27setLoadsImagesAutomaticallyEb
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
@@ -680,14 +688,15 @@ __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16adjustPageHeightEPffff
 __ZN7WebCore9FrameView18updateControlTintsEv
 __ZN7WebCore9FrameView21flushDeferredRepaintsEv
+__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
 __ZN7WebCore9FrameView23layoutIfNeededRecursiveEv
+__ZN7WebCore9FrameView23updateCanHaveScrollbarsEv
 __ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
 __ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
-__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9HTMLNames10listingTagE
 __ZN7WebCore9HTMLNames11textareaTagE
 __ZN7WebCore9HTMLNames13blockquoteTagE
@@ -726,16 +735,16 @@ __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS9_6VectorIS3_Lm0EEEEESD_NS_23UserScriptInjectionTimeE
 __ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore9PageGroup24addUserStyleSheetToWorldEPNS_15DOMWrapperWorldERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS9_6VectorIS3_Lm0EEEEESD_
+__ZN7WebCore9PageGroup25removeUserScriptFromWorldEPNS_15DOMWrapperWorldERKNS_4KURLE
+__ZN7WebCore9PageGroup26removeUserScriptsFromWorldEPNS_15DOMWrapperWorldE
 __ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup29removeUserStyleSheetFromWorldEPNS_15DOMWrapperWorldERKNS_4KURLE
+__ZN7WebCore9PageGroup30removeUserStyleSheetsFromWorldEPNS_15DOMWrapperWorldE
 __ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
-__ZN7WebCore9PageGroup25removeUserScriptFromWorldEjRKNS_4KURLE
-__ZN7WebCore9PageGroup29removeUserStyleSheetFromWorldEjRKNS_4KURLE
-__ZN7WebCore9PageGroup26removeUserScriptsFromWorldEj
-__ZN7WebCore9PageGroup24addUserStyleSheetToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_
-__ZN7WebCore9PageGroup20addUserScriptToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_NS_23UserScriptInjectionTimeE
-__ZN7WebCore9PageGroup30removeUserStyleSheetsFromWorldEj
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
@@ -884,7 +893,7 @@ __ZNK7WebCore5Frame15selectionBoundsEb
 __ZNK7WebCore5Frame16inViewSourceModeEv
 __ZNK7WebCore5Frame17firstRectForRangeEPNS_5RangeE
 __ZNK7WebCore5Frame18documentTypeStringEv
-__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
+__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEENS0_30SelectionRectRespectTransformsEb
 __ZNK7WebCore5Frame20selectionGranularityEv
 __ZNK7WebCore5Frame30applyEditingStyleToBodyElementEv
 __ZNK7WebCore5Frame31fontAttributesForSelectionStartEv
@@ -901,6 +910,7 @@ __ZNK7WebCore5Frame8documentEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore5Frame9animationEv
 __ZNK7WebCore5Frame9domWindowEv
+__ZNK7WebCore5Frame9nodeImageEPNS_4NodeE
 __ZNK7WebCore5Frame9selectionEv
 __ZNK7WebCore5Range11startOffsetERi
 __ZNK7WebCore5Range12endContainerERi
@@ -951,15 +961,12 @@ __ZNK7WebCore8Document31displayStringModifiedByEncodingERKNS_6StringE
 __ZNK7WebCore8Document4bodyEv
 __ZNK7WebCore8Document6domainEv
 __ZNK7WebCore8IntPointcv8_NSPointEv
-__ZNK7WebCore8Position10downstreamEv
 __ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore8Position8upstreamEv
+__ZNK7WebCore8Position10downstreamENS0_27EditingBoundaryCrossingRuleE
+__ZNK7WebCore8Position8upstreamENS0_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
 __ZNK7WebCore9FloatRectcv7_NSRectEv
-__ZNK7WebCore5Frame9nodeImageEPNS_4NodeE
-__ZN7WebCore12RenderWidget19showSubstituteImageEN3WTF10PassRefPtrINS_5ImageEEE
-__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
 __ZNK7WebCore9FrameTree20traverseNextWithWrapEb
@@ -975,9 +982,10 @@ __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
-__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
-__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
-__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
+__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
+__ZN7WebCore21SVGDocumentExtensions21sampleAnimationAtTimeERKNS_6StringEPNS_14SVGSMILElementEd
+__ZN7WebCore8Document19accessSVGExtensionsEv
+__ZN7WebCore8Document13svgExtensionsEv
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
@@ -986,6 +994,7 @@ _stringIsCaseInsensitiveEqualToString
 _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
 _wkCGContextGetShouldSmoothFonts
+_wkCopyCONNECTProxyResponse
 _wkCreateCustomCFReadStream
 _wkCreateNSURLConnectionDelegateProxy
 _wkCreateURLNPasteboardFlavorTypeName
@@ -1012,15 +1021,20 @@ _wkHitTestMediaUIPart
 _wkInitializeMaximumHTTPConnectionCountPerHost
 _wkIsLatchingWheelEvent
 _wkMeasureMediaUIPart
+_wkMediaControllerThemeAvailable
 _wkPopupMenu
 _wkQTIncludeOnlyModernMediaFileTypes
 _wkQTMovieDataRate
 _wkQTMovieGetType
+_wkQTMovieHasClosedCaptions
 _wkQTMovieMaxTimeLoaded
 _wkQTMovieMaxTimeLoadedChangeNotification
 _wkQTMovieMaxTimeSeekable
+_wkQTMovieSetShowClosedCaptions
 _wkQTMovieViewSetDrawSynchronously
 _wkSetCGFontRenderingMode
+_wkSetCONNECTProxyAuthorizationForStream
+_wkSetCONNECTProxyForStream
 _wkSetDragImage
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
index 055e3cb..374d01b 100644
--- a/WebCore/WebCore.gyp/WebCore.gyp
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -130,6 +130,7 @@
       '../platform/chromium',
       '../platform/graphics',
       '../platform/graphics/chromium',
+      '../platform/graphics/filters',
       '../platform/graphics/opentype',
       '../platform/graphics/skia',
       '../platform/graphics/transforms',
@@ -148,12 +149,15 @@
       '../platform/sql',
       '../platform/text',
       '../plugins',
+      '../plugins/chromium',
       '../rendering',
       '../rendering/style',
       '../storage',
+      '../storage/chromium',
       '../svg',
       '../svg/animation',
       '../svg/graphics',
+      '../svg/graphics/filters',
       '../websockets',
       '../workers',
       '../xml',
@@ -212,11 +216,6 @@
         # idl rule
         '<@(webcore_bindings_idl_files)',
       ],
-      'sources/': [
-        # SVG_FILTERS only.
-        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
-
-      ],
       'sources!': [
         # Custom bindings in bindings/v8/custom exist for these.
         '../dom/EventListener.idl',
@@ -226,13 +225,6 @@
         # JSC-only.
         '../inspector/JavaScriptCallFrame.idl',
 
-        # ENABLE_GEOLOCATION only.
-        '../page/Geolocation.idl',
-        '../page/Geoposition.idl',
-        '../page/PositionCallback.idl',
-        '../page/PositionError.idl',
-        '../page/PositionErrorCallback.idl',
-
         # Bindings with custom Objective-C implementations.
         '../page/AbstractView.idl',
 
@@ -240,7 +232,6 @@
         # Extra SVG bindings to exclude.
         '../svg/ElementTimeControl.idl',
         '../svg/SVGAnimatedPathData.idl',
-        '../svg/SVGComponentTransferFunctionElement.idl',
         '../svg/SVGExternalResourcesRequired.idl',
         '../svg/SVGFitToViewBox.idl',
         '../svg/SVGHKernElement.idl',
@@ -272,7 +263,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_csspropertynames.py',
+            'scripts/action_csspropertynames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -291,7 +282,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py',
+            'scripts/action_cssvaluekeywords.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -314,7 +305,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -341,7 +332,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -370,7 +361,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py',
+            'scripts/action_useragentstylesheets.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -388,7 +379,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -408,7 +399,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            'scripts/action_makenames.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)',
@@ -427,7 +418,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/action_maketokenizer.py',
+            'scripts/action_maketokenizer.py',
             '<@(_outputs)',
             '--',
             '<@(_inputs)'
@@ -445,7 +436,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_bison.py',
+            'scripts/rule_bison.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webkit'
           ],
@@ -468,7 +459,7 @@
           ],
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_gperf.py',
+            'scripts/rule_gperf.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webkit'
           ],
@@ -513,7 +504,7 @@
           # behavior, change the output location.
           'action': [
             'python',
-            '<(chromium_src_dir)/webkit/build/rule_binding.py',
+            'scripts/rule_binding.py',
             '<(RULE_INPUT_PATH)',
             '<(SHARED_INTERMEDIATE_DIR)/webcore/bindings',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
@@ -629,6 +620,7 @@
         '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
         '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
         '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
       ],
       'defines': [
@@ -655,6 +647,7 @@
         # filenames.
         ['exclude', '(android|cairo|cf|cg|curl|gtk|haiku|linux|mac|opentype|posix|qt|soup|symbian|win|wx)/'],
         ['exclude', '(?<!Chromium)(SVGAllInOne|Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
 
         # JSC-only.
         ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
@@ -664,13 +657,15 @@
         ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
         ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp)$'],
 
-        # SVG_FILTERS only.
-        ['exclude', '(platform|svg)/graphics/filters/'],
-        ['exclude', 'svg/Filter[^/]*\\.cpp$'],
-        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.cpp$'],
-
         # Exclude some DB-related files.
         ['exclude', 'platform/sql/SQLiteFileSystem.cpp'],
+        ['exclude', 'storage/DatabaseTracker.cpp'],
+        ['exclude', 'storage/DatabaseTrackerClient.h'],
+        ['exclude', 'storage/OriginQuotaManager.cpp'],
+        ['exclude', 'storage/OriginQuotaManager.h'],
+        ['exclude', 'storage/OriginUsageRecord.cpp'],
+        ['exclude', 'storage/OriginUsageRecord.h'],
+        ['exclude', 'storage/SQLTransactionClient.cpp'],
       ],
       'sources!': [
         # A few things can't be excluded by patterns.  List them individually.
@@ -891,6 +886,7 @@
 
             # Use native Mac font code from WebCore.
             ['include', 'platform/(graphics/)?mac/[^/]*Font[^/]*\\.(cpp|mm?)$'],
+            ['include', 'platform/graphics/mac/ComplexText[^/]*\\.(cpp|h)$'],
 
             # Cherry-pick some files that can't be included by broader regexps.
             # Some of these are used instead of Chromium platform files, see
@@ -906,7 +902,6 @@
             ['include', 'platform/mac/BlockExceptions\\.mm$'],
             ['include', 'platform/mac/LocalCurrentGraphicsContext\\.mm$'],
             ['include', 'platform/mac/PurgeableBufferMac\\.cpp$'],
-            ['include', 'platform/mac/ScrollbarThemeMac\\.mm$'],
             ['include', 'platform/mac/WebCoreSystemInterface\\.mm$'],
             ['include', 'platform/mac/WebCoreTextRenderer\\.mm$'],
             ['include', 'platform/text/mac/ShapeArabic\\.c$'],
@@ -921,8 +916,8 @@
             # platform/graphics/mac, included by regex above, instead.
             '../platform/graphics/chromium/FontCustomPlatformData.cpp',
 
-            # The Mac currently uses ScrollbarThemeMac.mm, included by regex
-            # above, instead of ScrollbarThemeChromium.cpp.
+            # The Mac currently uses ScrollbarThemeChromiumMac.mm, which is not
+            # related to ScrollbarThemeChromium.cpp.
             '../platform/chromium/ScrollbarThemeChromium.cpp',
 
             # The Mac uses ImageSourceCG.cpp from platform/graphics/cg, included
diff --git a/WebCore/WebCore.gyp/scripts/action_csspropertynames.py b/WebCore/WebCore.gyp/scripts/action_csspropertynames.py
new file mode 100644
index 0000000..60314d7
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_csspropertynames.py
@@ -0,0 +1,166 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# action_csspropertynames.py is a harness script to connect actions sections of
+# gyp-based builds to makeprop.pl.
+#
+# usage: action_makenames.py OUTPUTS -- INPUTS
+#
+# Exactly two outputs must be specified: a path to each of CSSPropertyNames.cpp
+# and CSSPropertyNames.h.
+#
+# Multiple inputs may be specified. One input must have a basename of
+# makeprop.pl; this is taken as the path to makeprop.pl. All other inputs are
+# paths to .in files that are used as input to makeprop.pl; at least one,
+# CSSPropertyNames.in, is required.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    (outputs, inputs) = SplitArgsIntoSections(args[1:])
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which one is makeprop.pl and which are
+    # inputs to that script.
+    makepropInput = None
+    inFiles = []
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'makeprop.pl':
+            assert makepropInput == None
+            makepropInput = inputAbs
+        elif inputBasename.endswith('.in'):
+            inFiles.append(inputAbsPosix)
+        else:
+            assert False
+
+    assert makepropInput != None
+    assert len(inFiles) >= 1
+
+    # Change to the output directory because makeprop.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Merge all inFiles into a single file whose name will be the same as the
+    # first listed inFile, but in the output directory.
+    mergedPath = os.path.basename(inFiles[0])
+    merged = open(mergedPath, 'wb')    # 'wb' to get \n only on windows
+
+    # Make sure there aren't any duplicate lines in the in files.
+    lineDict = {}
+    for inFilePath in inFiles:
+        inFile = open(inFilePath)
+        for line in inFile:
+            line = line.rstrip()
+            if line.startswith('#'):
+                line = ''
+            if line == '':
+                continue
+            if line in lineDict:
+                raise KeyError, 'Duplicate value %s' % line
+            lineDict[line] = True
+            print >>merged, line
+        inFile.close()
+
+    merged.close()
+
+    # Build up the command.
+    command = ['perl', makepropInput]
+
+    # Do it. checkCall is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Don't leave behind the merged file or the .gperf file created by
+    # makeprop.
+    (root, ext) = os.path.splitext(mergedPath)
+    gperfPath = root + '.gperf'
+    os.unlink(gperfPath)
+    os.unlink(mergedPath)
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py b/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py
new file mode 100644
index 0000000..ebf895b
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_cssvaluekeywords.py
@@ -0,0 +1,172 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# action_cssvaluekeywords.py is a harness script to connect actions sections of
+# gyp-based builds to makevalues.pl.
+#
+# usage: action_cssvaluekeywords.py OUTPUTS -- INPUTS
+#
+# Exactly two outputs must be specified: a path to each of CSSValueKeywords.c
+# and CSSValueKeywords.h.
+#
+# Multiple inputs may be specified. One input must have a basename of
+# makevalues.pl; this is taken as the path to makevalues.pl. All other inputs
+# are paths to .in files that are used as input to makevalues.pl; at least
+# one, CSSValueKeywords.in, is required.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    (outputs, inputs) = SplitArgsIntoSections(args[1:])
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which one is makevalues.pl and which are
+    # inputs to that script.
+    makevaluesInput = None
+    inFiles = []
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'makevalues.pl':
+            assert makevaluesInput == None
+            makevaluesInput = inputAbs
+        elif inputBasename.endswith('.in'):
+            inFiles.append(inputAbsPosix)
+        else:
+            assert False
+
+    assert makevaluesInput != None
+    assert len(inFiles) >= 1
+
+    # Change to the output directory because makevalues.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Merge all inFiles into a single file whose name will be the same as the
+    # first listed inFile, but in the output directory.
+    mergedPath = os.path.basename(inFiles[0])
+    merged = open(mergedPath, 'wb')    # 'wb' to get \n only on windows
+
+    # Make sure there aren't any duplicate lines in the in files. Lowercase
+    # everything because CSS values are case-insensitive.
+    lineDict = {}
+    for inFilePath in inFiles:
+        inFile = open(inFilePath)
+        for line in inFile:
+            line = line.rstrip()
+            if line.startswith('#'):
+                line = ''
+            if line == '':
+                continue
+            line = line.lower()
+            if line in lineDict:
+                raise KeyError, 'Duplicate value %s' % line
+            lineDict[line] = True
+            print >>merged, line
+        inFile.close()
+
+    merged.close()
+
+    # Build up the command.
+    command = ['perl', makevaluesInput]
+
+    # Do it. checkCall is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Don't leave behind the merged file or the .gperf file created by
+    # makevalues.
+    (root, ext) = os.path.splitext(mergedPath)
+    gperfPath = root + '.gperf'
+    os.unlink(gperfPath)
+    os.unlink(mergedPath)
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_makenames.py b/WebCore/WebCore.gyp/scripts/action_makenames.py
new file mode 100644
index 0000000..ecf543f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_makenames.py
@@ -0,0 +1,174 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# action_makenames.py is a harness script to connect actions sections of
+# gyp-based builds to make_names.pl.
+#
+# usage: action_makenames.py OUTPUTS -- INPUTS [-- OPTIONS]
+#
+# Multiple OUTPUTS, INPUTS, and OPTIONS may be listed. The sections are
+# separated by -- arguments.
+#
+# The directory name of the first output is chosen as the directory in which
+# make_names will run. If the directory name for any subsequent output is
+# different, those files will be moved to the desired directory.
+#
+# Multiple INPUTS may be listed. An input with a basename matching
+# "make_names.pl" is taken as the path to that script. Inputs with names
+# ending in TagNames.in or tags.in are taken as tag inputs. Inputs with names
+# ending in AttributeNames.in or attrs.in are taken as attribute inputs. There
+# may be at most one tag input and one attribute input. A make_names.pl input
+# is required and at least one tag or attribute input must be present.
+#
+# OPTIONS is a list of additional options to pass to make_names.pl. This
+# section need not be present.
+
+
+import os
+import posixpath
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2 or len(sections) == 3
+    (outputs, inputs) = sections[:2]
+    if len(sections) == 3:
+        options = sections[2]
+    else:
+        options = []
+
+    # Make all output pathnames absolute so that they can be accessed after
+    # changing directory.
+    for index in xrange(0, len(outputs)):
+        outputs[index] = os.path.abspath(outputs[index])
+
+    outputDir = os.path.dirname(outputs[0])
+
+    # Look at the inputs and figure out which ones are make_names.pl, tags, and
+    # attributes. There can be at most one of each, and those are the only
+    # input types supported. make_names.pl is required and at least one of tags
+    # and attributes is required.
+    makeNamesInput = None
+    tagInput = None
+    attrInput = None
+    for input in inputs:
+        # Make input pathnames absolute so they can be accessed after changing
+        # directory. On Windows, convert \ to / for inputs to the perl script to
+        # work around the intermix of activepython + cygwin perl.
+        inputAbs = os.path.abspath(input)
+        inputAbsPosix = inputAbs.replace(os.path.sep, posixpath.sep)
+        inputBasename = os.path.basename(input)
+        if inputBasename == 'make_names.pl':
+            assert makeNamesInput == None
+            makeNamesInput = inputAbs
+        elif inputBasename.endswith('TagNames.in') \
+             or inputBasename.endswith('tags.in'):
+            assert tagInput == None
+            tagInput = inputAbsPosix
+        elif inputBasename.endswith('AttributeNames.in') \
+             or inputBasename.endswith('attrs.in'):
+            assert attrInput == None
+            attrInput = inputAbsPosix
+        else:
+            assert False
+
+    assert makeNamesInput != None
+    assert tagInput != None or attrInput != None
+
+    # scriptsPath is a Perl include directory, located relative to
+    # makeNamesInput.
+    scriptsPath = os.path.normpath(
+        os.path.join(os.path.dirname(makeNamesInput), os.pardir, 'bindings', 'scripts'))
+
+    # Change to the output directory because make_names.pl puts output in its
+    # working directory.
+    os.chdir(outputDir)
+
+    # Build up the command.
+    command = ['perl', '-I', scriptsPath, makeNamesInput]
+    if tagInput != None:
+        command.extend(['--tags', tagInput])
+    if attrInput != None:
+        command.extend(['--attrs', attrInput])
+    command.extend(options)
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Go through the outputs. Any output that belongs in a different directory
+    # is moved. Do a copy and delete instead of rename for maximum portability.
+    # Note that all paths used in this section are still absolute.
+    for output in outputs:
+        thisOutputDir = os.path.dirname(output)
+        if thisOutputDir != outputDir:
+            outputBasename = os.path.basename(output)
+            src = os.path.join(outputDir, outputBasename)
+            dst = os.path.join(thisOutputDir, outputBasename)
+            shutil.copyfile(src, dst)
+            os.unlink(src)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_maketokenizer.py b/WebCore/WebCore.gyp/scripts/action_maketokenizer.py
new file mode 100644
index 0000000..f4a28ee
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_maketokenizer.py
@@ -0,0 +1,101 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: action_maketokenizer.py OUTPUTS -- INPUTS
+#
+# Multiple INPUTS may be listed. The sections are separated by -- arguments.
+#
+# OUTPUTS must contain a single item: a path to tokenizer.cpp.
+#
+# INPUTS must contain exactly two items. The first item must be the path to
+# maketokenizer. The second item must be the path to tokenizer.flex.
+
+
+import os
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2
+    (outputs, inputs) = sections
+
+    assert len(outputs) == 1
+    output = outputs[0]
+
+    assert len(inputs) == 2
+    maketokenizer = inputs[0]
+    flexInput = inputs[1]
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    outfile = open(output, 'wb')
+    p1 = subprocess.Popen(['flex', '-t', flexInput], stdout=subprocess.PIPE)
+    p2 = subprocess.Popen(['perl', maketokenizer], stdin=p1.stdout, stdout=outfile)
+
+    r1 = p1.wait()
+    r2 = p2.wait()
+    assert r1 == 0
+    assert r2 == 0
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py b/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py
new file mode 100644
index 0000000..6f017fc
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/action_useragentstylesheets.py
@@ -0,0 +1,102 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: action_useragentstylesheets.py OUTPUTS -- INPUTS
+#
+# Multiple OUTPUTS and INPUTS may be listed. The sections are separated by
+# -- arguments.
+#
+# OUTPUTS must contain two items, in order: a path to UserAgentStyleSheets.h
+# and a path to UserAgentStyleSheetsData.cpp.
+#
+# INPUTS must contain at least two items. The first item must be the path to
+# make-css-file-arrays.pl. The remaining items are paths to style sheets to
+# be fed to that script.
+
+
+import os
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 2
+    (outputs, inputs) = sections
+
+    assert len(outputs) == 2
+    outputH = outputs[0]
+    outputCpp = outputs[1]
+
+    makeCssFileArrays = inputs[0]
+    styleSheets = inputs[1:]
+
+    # Build up the command.
+    command = ['perl', makeCssFileArrays, outputH, outputCpp]
+    command.extend(styleSheets)
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/rule_binding.py b/WebCore/WebCore.gyp/scripts/rule_binding.py
new file mode 100644
index 0000000..24d178f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_binding.py
@@ -0,0 +1,135 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_binding.py INPUT CPPDIR HDIR -- INPUTS -- OPTIONS
+#
+# INPUT is an IDL file, such as Whatever.idl.
+#
+# CPPDIR is the directory into which V8Whatever.cpp will be placed. HDIR is
+# the directory into which V8Whatever.h will be placed.
+#
+# The first item in INPUTS is the path to generate-bindings.pl. Remaining
+# items in INPUTS are used to build the Perl module include path.
+#
+# OPTIONS are passed as-is to generate-bindings.pl as additional arguments.
+
+
+import errno
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+
+
+def SplitArgsIntoSections(args):
+    sections = []
+    while len(args) > 0:
+        if not '--' in args:
+            # If there is no '--' left, everything remaining is an entire section.
+            dashes = len(args)
+        else:
+            dashes = args.index('--')
+
+        sections.append(args[:dashes])
+
+        # Next time through the loop, look at everything after this '--'.
+        if dashes + 1 == len(args):
+            # If the '--' is at the end of the list, we won't come back through the
+            # loop again. Add an empty section now corresponding to the nothingness
+            # following the final '--'.
+            args = []
+            sections.append(args)
+        else:
+            args = args[dashes + 1:]
+
+    return sections
+
+
+def main(args):
+    sections = SplitArgsIntoSections(args[1:])
+    assert len(sections) == 3, sections
+    (base, inputs, options) = sections
+
+    assert len(base) == 3, base
+    (input, cppdir, hdir) = base
+
+    assert len(inputs) > 1, inputs
+    generateBindings = inputs[0]
+    perlModules = inputs[1:]
+
+    includeDirs = []
+    for perlModule in perlModules:
+        includeDir = os.path.dirname(perlModule)
+        if not includeDir in includeDirs:
+            includeDirs.append(includeDir)
+
+    # The defines come in as one flat string. Split it up into distinct arguments.
+    if '--defines' in options:
+        definesIndex = options.index('--defines')
+        if definesIndex + 1 < len(options):
+            splitOptions = shlex.split(options[definesIndex + 1])
+            if splitOptions:
+                options[definesIndex + 1] = ' '.join(splitOptions)
+
+    # Build up the command.
+    command = ['perl', '-w']
+    for includeDir in includeDirs:
+        command.extend(['-I', includeDir])
+    command.append(generateBindings)
+    command.extend(options)
+    command.extend(['--outputDir', cppdir, input])
+
+    # Do it. check_call is new in 2.5, so simulate its behavior with call and
+    # assert.
+    returnCode = subprocess.call(command)
+    assert returnCode == 0
+
+    # Both the .cpp and .h were generated in cppdir, but if hdir is different,
+    # the .h needs to move. Copy it instead of using os.rename for maximum
+    # portability in all cases.
+    if cppdir != hdir:
+        inputBasename = os.path.basename(input)
+        (root, ext) = os.path.splitext(inputBasename)
+        hname = 'V8%s.h' % root
+        hsrc = os.path.join(cppdir, hname)
+        hdst = os.path.join(hdir, hname)
+        shutil.copyfile(hsrc, hdst)
+        os.unlink(hsrc)
+
+    return returnCode
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/WebCore/WebCore.gyp/scripts/rule_bison.py b/WebCore/WebCore.gyp/scripts/rule_bison.py
new file mode 100644
index 0000000..eb85a4b
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_bison.py
@@ -0,0 +1,102 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_bison.py INPUT_FILE OUTPUT_DIR
+# INPUT_FILE is a path to either CSSGrammar.y or XPathGrammar.y.
+# OUTPUT_DIR is where the bison-generated .cpp and .h files should be placed.
+
+import errno
+import os
+import os.path
+import subprocess
+import sys
+
+assert len(sys.argv) == 3
+
+inputFile = sys.argv[1]
+outputDir = sys.argv[2]
+
+inputName = os.path.basename(inputFile)
+assert inputName == 'CSSGrammar.y' or inputName == 'XPathGrammar.y'
+prefix = {'CSSGrammar.y': 'cssyy', 'XPathGrammar.y': 'xpathyy'}[inputName]
+
+(inputRoot, inputExt) = os.path.splitext(inputName)
+
+# The generated .h will be in a different location depending on the bison
+# version.
+outputHTries = [
+    os.path.join(outputDir, inputRoot + '.cpp.h'),
+    os.path.join(outputDir, inputRoot + '.hpp'),
+]
+
+for outputHTry in outputHTries:
+    try:
+        os.unlink(outputHTry)
+    except OSError, e:
+        if e.errno != errno.ENOENT:
+            raise
+
+outputCpp = os.path.join(outputDir, inputRoot + '.cpp')
+
+returnCode = subprocess.call(['bison', '-d', '-p', prefix, inputFile, '-o', outputCpp])
+assert returnCode == 0
+
+# Find the name that bison used for the generated header file.
+outputHTmp = None
+for outputHTry in outputHTries:
+    try:
+        os.stat(outputHTry)
+        outputHTmp = outputHTry
+        break
+    except OSError, e:
+        if e.errno != errno.ENOENT:
+            raise
+
+assert outputHTmp != None
+
+# Read the header file in under the generated name and remove it.
+outputHFile = open(outputHTmp)
+outputHContents = outputHFile.read()
+outputHFile.close()
+os.unlink(outputHTmp)
+
+# Rewrite the generated header with #include guards.
+outputH = os.path.join(outputDir, inputRoot + '.h')
+
+outputHFile = open(outputH, 'w')
+print >>outputHFile, '#ifndef %sH' % inputRoot
+print >>outputHFile, '#define %sH' % inputRoot
+print >>outputHFile, outputHContents
+print >>outputHFile, '#endif'
+outputHFile.close()
diff --git a/WebCore/WebCore.gyp/scripts/rule_gperf.py b/WebCore/WebCore.gyp/scripts/rule_gperf.py
new file mode 100644
index 0000000..e76ed6f
--- /dev/null
+++ b/WebCore/WebCore.gyp/scripts/rule_gperf.py
@@ -0,0 +1,85 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# Copyright (c) 2009 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# usage: rule_gperf.py INPUT_FILE OUTPUT_DIR
+# INPUT_FILE is a path to DocTypeStrings.gperf, HTMLEntityNames.gperf, or
+# ColorData.gperf.
+# OUTPUT_DIR is where the gperf-generated .cpp file should be placed. Because
+# some users want a .c file instead of a .cpp file, the .cpp file is copied
+# to .c when done.
+
+import posixpath
+import shutil
+import subprocess
+import sys
+
+assert len(sys.argv) == 3
+
+inputFile = sys.argv[1]
+outputDir = sys.argv[2]
+
+gperfCommands = {
+    'DocTypeStrings.gperf': [
+        '-CEot', '-L', 'ANSI-C', '-k*', '-N', 'findDoctypeEntry',
+        '-F', ',PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards'
+    ],
+    'HTMLEntityNames.gperf': [
+        '-a', '-L', 'ANSI-C', '-C', '-G', '-c', '-o', '-t', '-k*',
+        '-N', 'findEntity', '-D', '-s', '2'
+    ],
+    'ColorData.gperf': [
+        '-CDEot', '-L', 'ANSI-C', '-k*', '-N', 'findColor', '-D', '-s', '2'
+    ],
+}
+
+inputName = posixpath.basename(inputFile)
+assert inputName in gperfCommands
+
+(inputRoot, inputExt) = posixpath.splitext(inputName)
+outputCpp = posixpath.join(outputDir, inputRoot + '.cpp')
+
+#command = ['gperf', '--output-file', outputCpp]
+command = ['gperf']
+command.extend(gperfCommands[inputName])
+command.append(inputFile)
+
+ofile = open(outputCpp, 'w')
+
+# Do it. check_call is new in 2.5, so simulate its behavior with call and
+# assert.
+returnCode = subprocess.call(command, stdout=ofile.fileno())
+assert returnCode == 0
+
+outputC = posixpath.join(outputDir, inputRoot + '.c')
+shutil.copyfile(outputCpp, outputC)
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index c0baaf4..4a37c79 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -38,6 +38,7 @@
             'dom/ClientRectList.idl',
             'dom/Clipboard.idl',
             'dom/Comment.idl',
+            'dom/CompositionEvent.idl',
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/Document.idl',
@@ -65,6 +66,7 @@
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
             'dom/PageTransitionEvent.idl',
+            'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
@@ -76,28 +78,29 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
-            'html/canvas/CanvasActiveInfo.idl',
-            'html/canvas/CanvasArray.idl',
-            'html/canvas/CanvasArrayBuffer.idl',
-            'html/canvas/CanvasBuffer.idl',
-            'html/canvas/CanvasByteArray.idl',
-            'html/canvas/CanvasFloatArray.idl',
-            'html/canvas/CanvasFramebuffer.idl',
+            'html/canvas/WebGLActiveInfo.idl',
+            'html/canvas/WebGLArray.idl',
+            'html/canvas/WebGLArrayBuffer.idl',
+            'html/canvas/WebGLBuffer.idl',
+            'html/canvas/WebGLByteArray.idl',
+            'html/canvas/WebGLFloatArray.idl',
+            'html/canvas/WebGLFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
-            'html/canvas/CanvasIntArray.idl',
+            'html/canvas/WebGLIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
-            'html/canvas/CanvasProgram.idl',
-            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/WebGLProgram.idl',
+            'html/canvas/WebGLRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/CanvasRenderingContext3D.idl',
-            'html/canvas/CanvasShader.idl',
-            'html/canvas/CanvasShortArray.idl',
-            'html/canvas/CanvasUnsignedByteArray.idl',
-            'html/canvas/CanvasUnsignedIntArray.idl',
-            'html/canvas/CanvasUnsignedShortArray.idl',
-            'html/canvas/CanvasTexture.idl',
+            'html/canvas/WebGLRenderingContext.idl',
+            'html/canvas/WebGLShader.idl',
+            'html/canvas/WebGLShortArray.idl',
+            'html/canvas/WebGLUniformLocation.idl',
+            'html/canvas/WebGLUnsignedByteArray.idl',
+            'html/canvas/WebGLUnsignedIntArray.idl',
+            'html/canvas/WebGLUnsignedShortArray.idl',
+            'html/canvas/WebGLTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -178,7 +181,9 @@
             'html/TimeRanges.idl',
             'html/ValidityState.idl',
             'html/VoidCallback.idl',
+            'inspector/InjectedScriptHost.idl',
             'inspector/InspectorBackend.idl',
+            'inspector/InspectorFrontendHost.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
             'notifications/Notification.idl',
@@ -186,6 +191,7 @@
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
+            'page/Coordinates.idl',
             'page/DOMSelection.idl',
             'page/DOMWindow.idl',
             'page/Geolocation.idl',
@@ -521,7 +527,8 @@
             'bindings/js/JSInspectedObjectWrapper.h',
             'bindings/js/JSInspectorCallbackWrapper.cpp',
             'bindings/js/JSInspectorCallbackWrapper.h',
-            'bindings/js/JSInspectorBackendCustom.cpp',
+            'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSJavaScriptCallFrameCustom.cpp',
             'bindings/js/JSLazyEventListener.cpp',
             'bindings/js/JSLazyEventListener.h',
@@ -617,8 +624,6 @@
             'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
             'bindings/js/ScriptObject.h',
-            'bindings/js/ScriptObjectQuarantine.cpp',
-            'bindings/js/ScriptObjectQuarantine.h',
             'bindings/js/ScriptSourceCode.h',
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
@@ -634,25 +639,30 @@
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
-            'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasArrayCustom.h',
-            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
-            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
-            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLArrayCustom.h',
+            'bindings/v8/custom/V8WebGLArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8WebGLByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLShortArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
-            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
+            'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8ClientRectListCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
+            'bindings/v8/custom/V8CoordinatesCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
+            'bindings/v8/custom/V8ConsoleCustom.cpp',
             'bindings/v8/custom/V8CustomBinding.cpp',
             'bindings/v8/custom/V8CustomBinding.h',
             'bindings/v8/custom/V8CustomEventListener.cpp',
             'bindings/v8/custom/V8CustomEventListener.h',
+            'bindings/v8/custom/V8CustomPositionCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionCallback.h',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.cpp',
+            'bindings/v8/custom/V8CustomPositionErrorCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementCallback.cpp',
             'bindings/v8/custom/V8CustomSQLStatementCallback.h',
             'bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp',
@@ -676,6 +686,8 @@
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8FileListCustom.cpp',
+            'bindings/v8/custom/V8GeolocationCustom.cpp',
+            'bindings/v8/custom/V8HistoryCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
@@ -697,7 +709,8 @@
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCustom.h',
-            'bindings/v8/custom/V8InspectorBackendCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
@@ -767,8 +780,6 @@
             'bindings/v8/ScriptInstance.h',
             'bindings/v8/ScriptObject.cpp',
             'bindings/v8/ScriptObject.h',
-            'bindings/v8/ScriptObjectQuarantine.cpp',
-            'bindings/v8/ScriptObjectQuarantine.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.h',
@@ -827,6 +838,8 @@
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
             'bindings/v8/WorkerScriptController.cpp',
+            'bindings/v8/WorldContextHandle.cpp',
+            'bindings/v8/WorldContextHandle.h',
             'bindings/v8/npruntime.cpp',
             'bindings/v8/npruntime_impl.h',
             'bindings/v8/npruntime_internal.h',
@@ -987,8 +1000,6 @@
             'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
-            'dom/ClassNames.cpp',
-            'dom/ClassNames.h',
             'dom/ClassNodeList.cpp',
             'dom/ClassNodeList.h',
             'dom/ClientRect.cpp',
@@ -1002,6 +1013,8 @@
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
             'dom/Comment.h',
+            'dom/CompositionEvent.cpp',
+            'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
@@ -1088,6 +1101,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PopStateEvent.cpp',
+            'dom/PopStateEvent.h',
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
@@ -1114,6 +1129,8 @@
             'dom/SelectElement.h',
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
+            'dom/SpaceSplitString.cpp',
+            'dom/SpaceSplitString.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1268,52 +1285,56 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
-            'html/canvas/CanvasArray.cpp',
-            'html/canvas/CanvasArray.h',
-            'html/canvas/CanvasArrayBuffer.cpp',
-            'html/canvas/CanvasArrayBuffer.h',
-            'html/canvas/CanvasBuffer.cpp',
-            'html/canvas/CanvasBuffer.h',
-            'html/canvas/CanvasByteArray.cpp',
-            'html/canvas/CanvasByteArray.h',
-            'html/canvas/CanvasFloatArray.cpp',
-            'html/canvas/CanvasFloatArray.h',
-            'html/canvas/CanvasFramebuffer.cpp',
-            'html/canvas/CanvasFramebuffer.h',
+            'html/canvas/WebGLArray.cpp',
+            'html/canvas/WebGLArray.h',
+            'html/canvas/WebGLArrayBuffer.cpp',
+            'html/canvas/WebGLArrayBuffer.h',
+            'html/canvas/WebGLBuffer.cpp',
+            'html/canvas/WebGLBuffer.h',
+            'html/canvas/WebGLByteArray.cpp',
+            'html/canvas/WebGLByteArray.h',
+            'html/canvas/WebGLFloatArray.cpp',
+            'html/canvas/WebGLFloatArray.h',
+            'html/canvas/WebGLFramebuffer.cpp',
+            'html/canvas/WebGLFramebuffer.h',
+            'html/canvas/WebGLGetInfo.cpp',
+            'html/canvas/WebGLGetInfo.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
-            'html/canvas/CanvasIntArray.cpp',
-            'html/canvas/CanvasIntArray.h',
+            'html/canvas/WebGLIntArray.cpp',
+            'html/canvas/WebGLIntArray.h',
             'html/canvas/CanvasObject.cpp',
             'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
-            'html/canvas/CanvasProgram.cpp',
-            'html/canvas/CanvasProgram.h',
-            'html/canvas/CanvasRenderbuffer.cpp',
-            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/WebGLProgram.cpp',
+            'html/canvas/WebGLProgram.h',
+            'html/canvas/WebGLRenderbuffer.cpp',
+            'html/canvas/WebGLRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
-            'html/canvas/CanvasRenderingContext3D.cpp',
-            'html/canvas/CanvasRenderingContext3D.h',
-            'html/canvas/CanvasShader.cpp',
-            'html/canvas/CanvasShader.h',
-            'html/canvas/CanvasShortArray.cpp',
-            'html/canvas/CanvasShortArray.h',
+            'html/canvas/WebGLRenderingContext.cpp',
+            'html/canvas/WebGLRenderingContext.h',
+            'html/canvas/WebGLShader.cpp',
+            'html/canvas/WebGLShader.h',
+            'html/canvas/WebGLShortArray.cpp',
+            'html/canvas/WebGLShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
-            'html/canvas/CanvasTexture.cpp',
-            'html/canvas/CanvasTexture.h',
-            'html/canvas/CanvasUnsignedByteArray.cpp',
-            'html/canvas/CanvasUnsignedByteArray.h',
-            'html/canvas/CanvasUnsignedIntArray.cpp',
-            'html/canvas/CanvasUnsignedIntArray.h',
-            'html/canvas/CanvasUnsignedShortArray.cpp',
-            'html/canvas/CanvasUnsignedShortArray.h',
+            'html/canvas/WebGLTexture.cpp',
+            'html/canvas/WebGLTexture.h',
+            'html/canvas/WebGLUniformLocation.cpp',
+            'html/canvas/WebGLUniformLocation.h',
+            'html/canvas/WebGLUnsignedByteArray.cpp',
+            'html/canvas/WebGLUnsignedByteArray.h',
+            'html/canvas/WebGLUnsignedIntArray.cpp',
+            'html/canvas/WebGLUnsignedIntArray.h',
+            'html/canvas/WebGLUnsignedShortArray.cpp',
+            'html/canvas/WebGLUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1499,6 +1520,8 @@
             'html/HTMLVideoElement.h',
             'html/HTMLViewSourceDocument.cpp',
             'html/HTMLViewSourceDocument.h',
+            'html/ISODateTime.cpp',
+            'html/ISODateTime.h',
             'html/ImageData.cpp',
             'html/ImageData.h',
             'html/MediaError.h',
@@ -1513,6 +1536,8 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/InjectedScriptHost.cpp',
+            'inspector/InjectedScriptHost.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1525,6 +1550,8 @@
             'inspector/InspectorDOMStorageResource.h',
             'inspector/InspectorFrontend.cpp',
             'inspector/InspectorFrontend.h',
+            'inspector/InspectorFrontendHost.cpp',
+            'inspector/InspectorFrontendHost.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
             'inspector/InspectorTimelineAgent.cpp',
@@ -1732,6 +1759,7 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
+            'page/ContextMenuSelectionHandler.h',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1841,6 +1869,7 @@
             'platform/chromium/FramelessScrollView.cpp',
             'platform/chromium/FramelessScrollView.h',
             'platform/chromium/FramelessScrollViewClient.h',
+            'platform/chromium/GeolocationServiceChromium.cpp',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
             'platform/chromium/KeyboardCodesPosix.h',
@@ -1861,6 +1890,8 @@
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
             'platform/chromium/ScrollbarThemeChromiumLinux.cpp',
+            'platform/chromium/ScrollbarThemeChromiumMac.h',
+            'platform/chromium/ScrollbarThemeChromiumMac.mm',
             'platform/chromium/ScrollbarThemeChromiumWin.cpp',
             'platform/chromium/SearchPopupMenuChromium.cpp',
             'platform/chromium/SharedTimerChromium.cpp',
@@ -1947,6 +1978,11 @@
             'platform/graphics/filters/FEComposite.h',
             'platform/graphics/filters/FEGaussianBlur.cpp',
             'platform/graphics/filters/FEGaussianBlur.h',
+            'platform/graphics/filters/Filter.h',
+            'platform/graphics/filters/FilterEffect.cpp',
+            'platform/graphics/filters/FilterEffect.h',
+            'platform/graphics/filters/ImageBufferFilter.cpp',
+            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -1974,17 +2010,18 @@
             'platform/graphics/gtk/VideoSinkGStreamer.h',
             'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
-            'platform/graphics/mac/CoreTextController.cpp',
-            'platform/graphics/mac/CoreTextController.h',
+            'platform/graphics/mac/ComplexTextController.cpp',
+            'platform/graphics/mac/ComplexTextController.h',
+            'platform/graphics/mac/ComplexTextControllerATSUI.cpp',
+            'platform/graphics/mac/ComplexTextControllerCoreText.cpp',
             'platform/graphics/mac/FloatPointMac.mm',
             'platform/graphics/mac/FloatRectMac.mm',
             'platform/graphics/mac/FloatSizeMac.mm',
             'platform/graphics/mac/FontCacheMac.mm',
+            'platform/graphics/mac/FontComplexTextMac.cpp',
             'platform/graphics/mac/FontCustomPlatformData.cpp',
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
-            'platform/graphics/mac/FontMacATSUI.mm',
-            'platform/graphics/mac/FontMacCoreText.cpp',
             'platform/graphics/mac/FontPlatformData.h',
             'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
@@ -2005,6 +2042,8 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/MediaPlayer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.cpp',
+            'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
             'platform/graphics/qt/ColorQt.cpp',
@@ -2441,6 +2480,7 @@
             'platform/network/win/ResourceHandleWin.h',
             'platform/network/AuthenticationChallengeBase.cpp',
             'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
@@ -2575,7 +2615,7 @@
             'platform/text/StringImpl.cpp',
             'platform/text/StringImpl.h',
             'platform/text/TextBoundaries.h',
-            'platform/text/TextBoundariesICU.cpp',
+            'platform/text/TextBoundaries.cpp',
             'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
             'platform/text/TextBreakIteratorInternalICU.h',
@@ -2775,6 +2815,7 @@
             'platform/Widget.cpp',
             'platform/Widget.h',
             'plugins/chromium/PluginDataChromium.cpp',
+            'plugins/chromium/PluginDataChromium.h',
             'plugins/gtk/PluginDataGtk.cpp',
             'plugins/gtk/PluginPackageGtk.cpp',
             'plugins/gtk/PluginViewGtk.cpp',
@@ -2980,6 +3021,14 @@
             'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
+            'rendering/RenderRuby.cpp',
+            'rendering/RenderRuby.h',
+            'rendering/RenderRubyBase.cpp',
+            'rendering/RenderRubyBase.h',
+            'rendering/RenderRubyRun.cpp',
+            'rendering/RenderRubyRun.h',
+            'rendering/RenderRubyText.cpp',
+            'rendering/RenderRubyText.h',
             'rendering/RenderSVGBlock.cpp',
             'rendering/RenderSVGBlock.h',
             'rendering/RenderSVGContainer.cpp',
@@ -3088,6 +3137,11 @@
             'rendering/break_lines.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
+            'storage/chromium/DatabaseObserver.h',
+            'storage/chromium/DatabaseTrackerChromium.cpp',
+            'storage/chromium/QuotaTracker.cpp',
+            'storage/chromium/QuotaTracker.h',
+            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/Database.cpp',
             'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
@@ -3173,8 +3227,10 @@
             'svg/graphics/filters/SVGFETile.h',
             'svg/graphics/filters/SVGFETurbulence.cpp',
             'svg/graphics/filters/SVGFETurbulence.h',
-            'svg/graphics/filters/SVGFilterEffect.cpp',
-            'svg/graphics/filters/SVGFilterEffect.h',
+            'svg/graphics/filters/SVGFilter.cpp',
+            'svg/graphics/filters/SVGFilter.h',
+            'svg/graphics/filters/SVGFilterBuilder.cpp',
+            'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/filters/SVGLightSource.cpp',
             'svg/graphics/filters/SVGLightSource.h',
             'svg/graphics/filters/SVGPointLightSource.h',
@@ -3207,12 +3263,6 @@
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
-            'svg/Filter.cpp',
-            'svg/Filter.h',
-            'svg/FilterBuilder.h',
-            'svg/FilterBuilder.cpp',
-            'svg/FilterEffect.cpp',
-            'svg/FilterEffect.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
             'svg/PatternAttributes.h',
@@ -3595,7 +3645,9 @@
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/ChangesView.js',
             'inspector/front-end/Color.js',
+            'inspector/front-end/ConsolePanel.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
@@ -3603,7 +3655,6 @@
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMStorage.js',
-            'inspector/front-end/DOMStorageDataGrid.js',
             'inspector/front-end/DOMStorageItemsView.js',
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
@@ -3611,7 +3662,8 @@
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
-            'inspector/front-end/InspectorControllerStub.js',
+            'inspector/front-end/InspectorBackendStub.js',
+            'inspector/front-end/InspectorFrontendHostStub.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3648,6 +3700,8 @@
             'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelineOverviewPane.js',
+            'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
@@ -3664,6 +3718,7 @@
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/consoleIcon.png',
             'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
             'inspector/front-end/Images/databaseTable.png',
@@ -3687,6 +3742,7 @@
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
             'inspector/front-end/Images/errorIcon.png',
             'inspector/front-end/Images/errorMediumIcon.png',
+            'inspector/front-end/Images/errorRedDot.png',            
             'inspector/front-end/Images/excludeButtonGlyph.png',
             'inspector/front-end/Images/focusButtonGlyph.png',
             'inspector/front-end/Images/forward.png',
@@ -3749,6 +3805,7 @@
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
             'inspector/front-end/Images/storageIcon.png',
+            'inspector/front-end/Images/successGreenDot.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3789,6 +3846,7 @@
             'inspector/front-end/Images/userInputPreviousIcon.png',
             'inspector/front-end/Images/userInputResultIcon.png',
             'inspector/front-end/Images/warningIcon.png',
+            'inspector/front-end/Images/warningOrangeDot.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
             'inspector/front-end/Images/whiteConnectorPoint.png'
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index c1040e2..3144ec1 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -19747,8 +19747,6 @@ __ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierER
 __ZN7WebCore13MimeTypeArray4itemEj
 __ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8MimeType4typeEv
-__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
-__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
 __ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
 __ZN7WebCore10ClientRectC1Ev
 __ZN7WebCore10ClientRectC2Ev
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 9a4e9d8..bfeee61 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -12,10 +12,13 @@ symbian: {
     DEPLOYMENT += webkitlibs
 
     TARGET.UID3 = 0x200267C2
+    # Need to guarantee that these come before system includes of /epoc32/include
+    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE platform/text"
+    # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
+    # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
+    MMP_RULES += "LINKEROPTION  armcc --rw-base 0xE00000"
 }
-# RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
-# base address to start from 0x800000 instead of the toolchain default 0x400000.
-symbian-sbsv2: MMP_RULES += "LINKEROPTION  armcc --rw-base 0x800000"
 
 include($$PWD/../WebKit.pri)
 
@@ -47,7 +50,6 @@ GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
 
 unix {
     QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
-    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
@@ -128,7 +130,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 }
 
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
-!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=1
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
 !contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
@@ -150,9 +152,6 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
 }
 
-# HTML5 ruby support
-!contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-
 # HTML5 media support
 !contains(DEFINES, ENABLE_VIDEO=.) {
     contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
@@ -180,7 +179,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     else:DEFINES += ENABLE_XSLT=0
 }
 
-DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
+DEFINES += WTF_CHANGES=1
 
 # Used to compute defaults for the build-webkit script
 CONFIG(compute_defaults) {
@@ -253,7 +252,6 @@ INCLUDEPATH = \
     $$INCLUDEPATH
 
 QT += network
-lessThan(QT_MINOR_VERSION, 4): QT += xml
 
 QMAKE_EXTRA_TARGETS += generated_files
 
@@ -299,10 +297,6 @@ STYLESHEETS_EMBED = \
     $$PWD/css/mediaControls.css \
     $$PWD/css/mediaControlsQt.css
 
-DOMLUT_FILES += \
-    bindings/js/JSDOMWindowBase.cpp \
-    bindings/js/JSWorkerContextBase.cpp
-
 IDL_BINDINGS += \
     css/Counter.idl \
     css/CSSCharsetRule.idl \
@@ -338,6 +332,7 @@ IDL_BINDINGS += \
     dom/Clipboard.idl \
     dom/CDATASection.idl \
     dom/Comment.idl \
+    dom/CompositionEvent.idl \
     dom/DocumentFragment.idl \
     dom/Document.idl \
     dom/DocumentType.idl \
@@ -365,6 +360,7 @@ IDL_BINDINGS += \
     dom/Notation.idl \
     dom/OverflowEvent.idl \
     dom/PageTransitionEvent.idl \
+    dom/PopStateEvent.idl \
     dom/ProcessingInstruction.idl \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
@@ -376,20 +372,20 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
-    html/canvas/CanvasArray.idl \
-    html/canvas/CanvasArrayBuffer.idl \
-    html/canvas/CanvasByteArray.idl \
-    html/canvas/CanvasFloatArray.idl \
+    html/canvas/WebGLArray.idl \
+    html/canvas/WebGLArrayBuffer.idl \
+    html/canvas/WebGLByteArray.idl \
+    html/canvas/WebGLFloatArray.idl \
     html/canvas/CanvasGradient.idl \
-    html/canvas/CanvasIntArray.idl \
+    html/canvas/WebGLIntArray.idl \
     html/canvas/CanvasPattern.idl \
     html/canvas/CanvasRenderingContext.idl \
     html/canvas/CanvasRenderingContext2D.idl \
-    html/canvas/CanvasRenderingContext3D.idl \
-    html/canvas/CanvasShortArray.idl \
-    html/canvas/CanvasUnsignedByteArray.idl \
-    html/canvas/CanvasUnsignedIntArray.idl \
-    html/canvas/CanvasUnsignedShortArray.idl \
+    html/canvas/WebGLRenderingContext.idl \
+    html/canvas/WebGLShortArray.idl \
+    html/canvas/WebGLUnsignedByteArray.idl \
+    html/canvas/WebGLUnsignedIntArray.idl \
+    html/canvas/WebGLUnsignedShortArray.idl \
     html/DataGridColumn.idl \
     html/DataGridColumnList.idl \
     html/File.idl \
@@ -470,7 +466,9 @@ IDL_BINDINGS += \
     html/TimeRanges.idl \
     html/ValidityState.idl \
     html/VoidCallback.idl \
+    inspector/InjectedScriptHost.idl \
     inspector/InspectorBackend.idl \
+    inspector/InspectorFrontendHost.idl \
     inspector/JavaScriptCallFrame.idl \
     loader/appcache/DOMApplicationCache.idl \
     page/BarInfo.idl \
@@ -499,6 +497,30 @@ IDL_BINDINGS += \
     storage/SQLResultSet.idl \
     storage/SQLResultSetRowList.idl \
     storage/SQLTransaction.idl \
+    websockets/WebSocket.idl \
+    workers/AbstractWorker.idl \
+    workers/DedicatedWorkerContext.idl \
+    workers/SharedWorker.idl \
+    workers/SharedWorkerContext.idl \
+    workers/Worker.idl \
+    workers/WorkerContext.idl \
+    workers/WorkerLocation.idl \
+    xml/DOMParser.idl \
+    xml/XMLHttpRequest.idl \
+    xml/XMLHttpRequestException.idl \
+    xml/XMLHttpRequestProgressEvent.idl \
+    xml/XMLHttpRequestUpload.idl \
+    xml/XMLSerializer.idl \
+    xml/XPathNSResolver.idl \
+    xml/XPathException.idl \
+    xml/XPathExpression.idl \
+    xml/XPathResult.idl \
+    xml/XPathEvaluator.idl \
+    xml/XSLTProcessor.idl
+
+contains(DEFINES, ENABLE_SVG=1) {
+
+  IDL_BINDINGS += \
     svg/SVGZoomEvent.idl \
     svg/SVGAElement.idl \
     svg/SVGAltGlyphElement.idl \
@@ -631,28 +653,9 @@ IDL_BINDINGS += \
     svg/SVGTSpanElement.idl \
     svg/SVGUnitTypes.idl \
     svg/SVGUseElement.idl \
-    svg/SVGViewElement.idl \
-    websockets/WebSocket.idl \
-    workers/AbstractWorker.idl \
-    workers/DedicatedWorkerContext.idl \
-    workers/SharedWorker.idl \
-    workers/SharedWorkerContext.idl \
-    workers/Worker.idl \
-    workers/WorkerContext.idl \
-    workers/WorkerLocation.idl \
-    xml/DOMParser.idl \
-    xml/XMLHttpRequest.idl \
-    xml/XMLHttpRequestException.idl \
-    xml/XMLHttpRequestProgressEvent.idl \
-    xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XPathNSResolver.idl \
-    xml/XPathException.idl \
-    xml/XPathExpression.idl \
-    xml/XPathResult.idl \
-    xml/XPathEvaluator.idl \
-    xml/XSLTProcessor.idl
+    svg/SVGViewElement.idl
 
+}
 
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
@@ -723,8 +726,9 @@ SOURCES += \
     bindings/js/JSHTMLSelectElementCustom.cpp \
     bindings/js/JSImageConstructor.cpp \
     bindings/js/JSImageDataCustom.cpp \
+    bindings/js/JSInjectedScriptHostCustom.cpp \
     bindings/js/JSInspectedObjectWrapper.cpp \
-    bindings/js/JSInspectorBackendCustom.cpp \
+    bindings/js/JSInspectorFrontendHostCustom.cpp \
     bindings/js/JSInspectorCallbackWrapper.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
@@ -757,6 +761,7 @@ SOURCES += \
     bindings/js/JSEventListener.cpp \
     bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
+    bindings/js/JSPopStateEventCustom.cpp \
     bindings/js/ScriptArray.cpp \
     bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
@@ -765,7 +770,6 @@ SOURCES += \
     bindings/js/ScriptEventListener.cpp \
     bindings/js/ScriptFunctionCall.cpp \
     bindings/js/ScriptObject.cpp \
-    bindings/js/ScriptObjectQuarantine.cpp \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
@@ -852,13 +856,13 @@ SOURCES += \
     dom/CharacterData.cpp \
     dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
-    dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
     dom/ClientRect.cpp \
     dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
+    dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
     dom/Document.cpp \
@@ -898,6 +902,7 @@ SOURCES += \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/PageTransitionEvent.cpp \
+    dom/PopStateEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -909,6 +914,7 @@ SOURCES += \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
+    dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
@@ -1073,16 +1079,19 @@ SOURCES += \
     html/HTMLTokenizer.cpp \
     html/HTMLUListElement.cpp \
     html/HTMLViewSourceDocument.cpp \
+    html/ISODateTime.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/InjectedScriptHost.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontend.cpp \
+    inspector/InspectorFrontendHost.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/TimelineRecordFactory.cpp \
@@ -1188,8 +1197,8 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
-    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
+    platform/graphics/FontFallbackList.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
     platform/graphics/Color.cpp \
@@ -1200,6 +1209,7 @@ SOURCES += \
     platform/graphics/FloatSize.cpp \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
+    platform/graphics/FontCache.cpp \
     platform/graphics/GeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1311,6 +1321,10 @@ SOURCES += \
     rendering/RenderPartObject.cpp \
     rendering/RenderReplaced.cpp \
     rendering/RenderReplica.cpp \
+    rendering/RenderRuby.cpp \
+    rendering/RenderRubyBase.cpp \
+    rendering/RenderRubyRun.cpp \
+    rendering/RenderRubyText.cpp \
     rendering/RenderScrollbar.cpp \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
@@ -1437,7 +1451,6 @@ HEADERS += \
     bindings/js/ScriptEventListener.h \
     bindings/js/ScriptFunctionCall.h \
     bindings/js/ScriptObject.h \
-    bindings/js/ScriptObjectQuarantine.h \
     bindings/js/ScriptSourceCode.h \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
@@ -1529,7 +1542,6 @@ HEADERS += \
     dom/CharacterData.h \
     dom/CheckedRadioButtons.h \
     dom/ChildNodeList.h \
-    dom/ClassNames.h \
     dom/ClassNodeList.h \
     dom/ClientRect.h \
     dom/ClientRectList.h \
@@ -1586,6 +1598,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectElement.h \
     dom/SelectorNodeList.h \
+    dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
     dom/StyleElement.h \
@@ -1749,16 +1762,19 @@ HEADERS += \
     html/HTMLUListElement.h \
     html/HTMLVideoElement.h \
     html/HTMLViewSourceDocument.h \
+    html/ISODateTime.h \
     html/ImageData.h \
     html/PreloadScanner.h \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/InjectedScriptHost.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
+    inspector/InspectorFrontendHost.h \
     inspector/InspectorResource.h \
     inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
@@ -1824,6 +1840,7 @@ HEADERS += \
     page/Chrome.h \
     page/Console.h \
     page/ContextMenuController.h \
+    page/ContextMenuSelectionHandler.h \
     page/Coordinates.h \
     page/DOMSelection.h \
     page/DOMTimer.h \
@@ -1919,6 +1936,7 @@ HEADERS += \
     platform/Logging.h \
     platform/MIMETypeRegistry.h \
     platform/network/AuthenticationChallengeBase.h \
+    platform/network/AuthenticationClient.h \
     platform/network/Credential.h \
     platform/network/FormDataBuilder.h \
     platform/network/FormData.h \
@@ -2025,6 +2043,10 @@ HEADERS += \
     rendering/RenderPath.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
+    rendering/RenderRuby.h \
+    rendering/RenderRubyBase.h \
+    rendering/RenderRubyRun.h \
+    rendering/RenderRubyText.h \
     rendering/RenderScrollbar.h \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
@@ -2327,6 +2349,7 @@ HEADERS += \
     xml/XSLTExtensions.h \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
+    $$PWD/../WebKit/qt/Api/qwebplugindatabase_p.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
@@ -2342,7 +2365,6 @@ SOURCES += \
     platform/graphics/qt/TransformationMatrixQt.cpp \
     platform/graphics/qt/ColorQt.cpp \
     platform/graphics/qt/FontQt.cpp \
-    platform/graphics/qt/FontQt43.cpp \
     platform/graphics/qt/FontPlatformDataQt.cpp \
     platform/graphics/qt/FloatPointQt.cpp \
     platform/graphics/qt/FloatRectQt.cpp \
@@ -2376,7 +2398,6 @@ SOURCES += \
     platform/qt/SharedBufferQt.cpp \
     platform/graphics/qt/FontCacheQt.cpp \
     platform/graphics/qt/FontCustomPlatformData.cpp \
-    platform/graphics/qt/FontFallbackListQt.cpp \
     platform/graphics/qt/GlyphPageTreeNodeQt.cpp \
     platform/graphics/qt/SimpleFontDataQt.cpp \
     platform/qt/KURLQt.cpp \
@@ -2398,7 +2419,7 @@ SOURCES += \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
     platform/qt/TemporaryLinkStubs.cpp \
-    platform/text/qt/TextBoundaries.cpp \
+    platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
     platform/qt/WheelEventQt.cpp \
@@ -2432,7 +2453,9 @@ SOURCES += \
     mac {
         SOURCES += \
             platform/text/cf/StringCF.cpp \
-            platform/text/cf/StringImplCF.cpp
+            platform/text/cf/StringImplCF.cpp \
+            platform/cf/SharedBufferCF.cpp \
+            editing/SmartReplaceCF.cpp
         LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
@@ -2443,20 +2466,6 @@ SOURCES += \
     }
     wince*: LIBS += -lmmtimer
 
-    # Files belonging to the Qt 4.3 build
-    lessThan(QT_MINOR_VERSION, 4) {
-        HEADERS += \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface.h \
-            $$PWD/../WebKit/qt/Api/qwebnetworkinterface_p.h \
-            $$PWD/../WebKit/qt/Api/qcookiejar.h
-
-        SOURCES += \
-            ../WebKit/qt/Api/qwebnetworkinterface.cpp \
-            ../WebKit/qt/Api/qcookiejar.cpp
-
-        DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
-     }
-
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2500,13 +2509,15 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         }
     
         win32-* {
-            INCLUDEPATH += $$PWD/plugins/win
+            INCLUDEPATH += $$PWD/plugins/win \
+                           $$PWD/platform/win
     
             SOURCES += page/win/PageWin.cpp \
                        plugins/win/PluginDatabaseWin.cpp \
                        plugins/win/PluginPackageWin.cpp \
                        plugins/win/PluginMessageThrottlerWin.cpp \
-                       plugins/win/PluginViewWin.cpp
+                       plugins/win/PluginViewWin.cpp \
+                       platform/win/BitmapInfo.cpp
     
             LIBS += \
                 -ladvapi32 \
@@ -3175,14 +3186,6 @@ idl.depends = $$PWD/bindings/scripts/generate-bindings.pl \
 idl.CONFIG += target_predeps
 addExtraCompilerWithHeader(idl)
 
-# GENERATOR 2-A: LUT creator
-domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
-domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
-domlut.depend = ${QMAKE_FILE_NAME}
-domlut.input = DOMLUT_FILES
-domlut.CONFIG += no_link
-addExtraCompiler(domlut)
-
 # GENERATOR 3: tokenizer (flex)
 tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
diff --git a/WebCore/WebCore.qrc b/WebCore/WebCore.qrc
index 69f860a..6da93c6 100644
--- a/WebCore/WebCore.qrc
+++ b/WebCore/WebCore.qrc
@@ -12,5 +12,6 @@
     <file alias="copyCursor.png">Resources/copyCursor.png</file>
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
+    <file alias="deleteButton.png">Resources/deleteButton.png</file>
 </qresource>
 </RCC>
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 714f6ee..901d24d 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -39,7 +39,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -57,7 +57,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -112,7 +112,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -130,7 +130,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -184,7 +184,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -202,7 +202,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

@@ -256,7 +256,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QTInternalSDK\CIncludes&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

 				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

 				DisableSpecificWarnings="4819"

 			/>

@@ -274,7 +274,7 @@
 				Name="VCLinkerTool"

 				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

 				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QTInternalSDK\Libraries&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

 				IgnoreDefaultLibraryNames="LIBCMT"

 				DelayLoadDLLs=""

 			/>

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index d5ef6f4..09945f5 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -38,7 +38,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -67,7 +68,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -94,7 +95,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -123,7 +125,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -149,7 +151,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -178,7 +181,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -204,7 +207,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -233,7 +237,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -260,7 +264,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -289,7 +294,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -315,7 +320,8 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories=""

+				AdditionalIncludeDirectories="$(DXSDK_DIR)\Include"

+				PreprocessorDefinitions="QUARTZCORE_DLL"

 				ForcedIncludeFiles=""

 			/>

 			<Tool

@@ -344,7 +350,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -1281,6 +1287,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCompositionEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCompositionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSConsole.cpp"

 				>

 				<FileConfiguration

@@ -7669,118 +7731,30 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.cpp"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.h"

 				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Internal|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

 				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Internal|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_Cairo|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					ExcludedFromBuild="true"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-					/>

-				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.h"

 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSJavaScriptCallFrame.cpp"

 				>

 				<FileConfiguration

@@ -9237,6 +9211,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

 				>

 				<FileConfiguration

@@ -20497,6 +20527,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\ContextMenuSelectionHandler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Coordinates.h"

 				>

 			</File>

@@ -21992,6 +22026,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\TextRenderingMode.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\win\WCDataObject.cpp"

 					>

 					<FileConfiguration

@@ -22054,6 +22092,68 @@
 					>

 				</File>

 				<File

+					RelativePath="..\WebCorePrefix.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="1"

+							DisableSpecificWarnings="4819"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\WebCorePrefix.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\win\WebCoreTextRenderer.cpp"

 					>

 				</File>

@@ -22126,6 +22226,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ColorPath.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\FloatPoint.cpp"

 					>

 				</File>

@@ -22334,6 +22438,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\GraphicsLayer.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\graphics\GraphicsLayer.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\graphics\GraphicsLayerClient.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\GraphicsTypes.cpp"

 					>

 				</File>

@@ -22833,6 +22949,14 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\win\GraphicsLayerCACF.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\GraphicsLayerCACF.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\win\IconWin.cpp"

 						>

 					</File>

@@ -23028,6 +23152,30 @@
 						RelativePath="..\platform\graphics\win\UniscribeController.h"

 						>

 					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFContextFlusher.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFContextFlusher.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayer.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayerRenderer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\win\WKCACFLayerRenderer.h"

+						>

+					</File>

 				</Filter>

 				<Filter

 					Name="cg"

@@ -23937,6 +24085,14 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\filters\ImageBufferFilter.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\ImageBufferFilter.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\filters\SourceAlpha.cpp"

 						>

 					</File>

@@ -23966,6 +24122,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\AuthenticationClient.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\Credential.cpp"

 					>

 				</File>

@@ -24157,6 +24317,26 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\network\cf\CredentialStorageCFNet.cpp"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\network\cf\DNSCFNet.cpp"

 						>

 						<FileConfiguration

@@ -24217,6 +24397,14 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\network\cf\LoaderRunLoopCF.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\LoaderRunLoopCF.h"

+						>

+					</File>

+					<File

 						RelativePath="..\platform\network\cf\ResourceError.h"

 						>

 						<FileConfiguration

@@ -25102,11 +25290,11 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextBoundaries.h"

+					RelativePath="..\platform\text\TextBoundaries.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\TextBoundariesICU.cpp"

+					RelativePath="..\platform\text\TextBoundaries.h"

 					>

 				</File>

 				<File

@@ -27015,6 +27203,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderLayerBacking.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerBacking.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerCompositor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderLayerCompositor.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderLineBoxList.cpp"

 				>

 			</File>

@@ -27167,6 +27371,38 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderRuby.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRuby.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyBase.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyBase.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyRun.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyRun.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyText.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderRubyText.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderScrollbar.cpp"

 				>

 			</File>

@@ -28207,14 +28443,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\dom\ClassNames.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\dom\ClassNames.h"

-				>

-			</File>

-			<File

 				RelativePath="..\dom\ClassNodeList.cpp"

 				>

 			</File>

@@ -28267,6 +28495,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\CompositionEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\CompositionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\ContainerNode.cpp"

 				>

 			</File>

@@ -28611,6 +28847,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\PopStateEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\PopStateEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Position.cpp"

 				>

 			</File>

@@ -28707,6 +28951,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\SpaceSplitString.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\SpaceSplitString.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\StaticNodeList.cpp"

 				>

 			</File>

@@ -33691,6 +33943,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\ISODateTime.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\ISODateTime.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\MediaError.h"

 				>

 			</File>

@@ -33744,6 +34004,54 @@
 				<File

 					RelativePath="..\bindings\js\GCController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\GCController.h"

@@ -33752,22 +34060,218 @@
 				<File

 					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAttrCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAudioConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSAudioConstructor.h"

 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSBindingsAllInOne.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCallbackData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCallbackData.h"

@@ -33776,42 +34280,522 @@
 				<File

 					RelativePath="..\bindings\js\JSCanvasRenderingContext2DCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCanvasRenderingContextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCDATASectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSClipboardCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSConsoleCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCoordinatesCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSRuleCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSRuleListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSStyleDeclarationCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCSSValueCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomPositionCallback.cpp"

@@ -33824,6 +34808,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementCallback.h"

@@ -33832,6 +34864,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementErrorCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementErrorCallback.h"

@@ -33840,6 +34920,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionCallback.h"

@@ -33848,6 +34976,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionErrorCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLTransactionErrorCallback.h"

@@ -33856,6 +35032,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomVoidCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomVoidCallback.h"

@@ -33864,6 +35088,54 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomXPathNSResolver.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomXPathNSResolver.h"

@@ -33872,42 +35144,470 @@
 				<File

 					RelativePath="..\bindings\js\JSDatabaseCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDataGridColumnListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDataGridDataSource.cpp"

 					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSDataGridDataSource.cpp"

-					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDedicatedWorkerContextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDesktopNotificationsCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDocumentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDocumentFragmentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMApplicationCacheCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMBinding.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMBinding.h"

@@ -33916,6 +35616,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMGlobalObject.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMGlobalObject.h"

@@ -33924,6 +35672,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowBase.h"

@@ -33932,6 +35728,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowCustom.h"

@@ -33940,6 +35784,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMWindowShell.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMWindowShell.h"

@@ -33948,14 +35840,158 @@
 				<File

 					RelativePath="..\bindings\js\JSElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventListener.h"

@@ -33964,6 +36000,54 @@
 				<File

 					RelativePath="..\bindings\js\JSEventSourceConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventSourceConstructor.h"

@@ -33972,10 +36056,106 @@
 				<File

 					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventTarget.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSEventTarget.h"

@@ -33984,6 +36164,54 @@
 				<File

 					RelativePath="..\bindings\js\JSExceptionBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSExceptionBase.h"

@@ -33996,58 +36224,730 @@
 				<File

 					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLAllCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLAppletElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLDataGridElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLDocumentCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLEmbedElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFormElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFrameElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLFrameSetElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLIFrameElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLInputElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLInputElementCustom.h"

@@ -34056,14 +36956,158 @@
 				<File

 					RelativePath="..\bindings\js\JSHTMLObjectElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLOptionsCollectionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.h"

@@ -34072,6 +37116,54 @@
 				<File

 					RelativePath="..\bindings\js\JSImageConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSImageConstructor.h"

@@ -34080,18 +37172,214 @@
 				<File

 					RelativePath="..\bindings\js\JSImageDataCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectedObjectWrapper.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectedObjectWrapper.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSInspectorBackendCustom.cpp"

+					RelativePath="..\bindings\js\JSInjectedScriptHostCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSInspectorFrontendHostCustom.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSInspectorCallbackWrapper.cpp"

@@ -34104,10 +37392,106 @@
 				<File

 					RelativePath="..\bindings\js\JSJavaScriptCallFrameCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSLazyEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSLazyEventListener.h"

@@ -34116,10 +37500,106 @@
 				<File

 					RelativePath="..\bindings\js\JSLocationCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageChannelConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageChannelConstructor.h"

@@ -34128,14 +37608,158 @@
 				<File

 					RelativePath="..\bindings\js\JSMessageChannelCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessageEventCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSMessagePortCustom.h"

@@ -34144,22 +37768,262 @@
 				<File

 					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNavigatorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCondition.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCondition.h"

@@ -34168,18 +38032,210 @@
 				<File

 					RelativePath="..\bindings\js\JSNodeFilterCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeIteratorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSNodeListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSOptionConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSOptionConstructor.h"

@@ -34188,22 +38244,218 @@
 				<File

 					RelativePath="..\bindings\js\JSPluginArrayCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginElementFunctions.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSPluginElementFunctions.h"

 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSPopStateEventCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSQuarantinedObjectWrapper.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSQuarantinedObjectWrapper.h"

@@ -34212,6 +38464,54 @@
 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerConstructor.h"

@@ -34220,46 +38520,574 @@
 				<File

 					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSQLResultSetRowListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSQLTransactionCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStorageCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStyleSheetCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSStyleSheetListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGElementInstanceCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGLengthCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGMatrixCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPathSegCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPathSegListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGPODTypeWrapper.h"

@@ -34268,6 +39096,54 @@
 				<File

 					RelativePath="..\bindings\js\JSSVGPointListCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSSVGTransformListCustom.cpp"

@@ -34276,14 +39152,158 @@
 				<File

 					RelativePath="..\bindings\js\JSTextCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSTreeWalkerCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitCSSMatrixConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitCSSMatrixConstructor.h"

@@ -34292,6 +39312,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWebKitPointConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebKitPointConstructor.h"

@@ -34300,6 +39368,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWebSocketConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWebSocketConstructor.h"

@@ -34308,10 +39424,106 @@
 				<File

 					RelativePath="..\bindings\js\JSWebSocketCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.h"

@@ -34320,6 +39532,54 @@
 				<File

 					RelativePath="..\bindings\js\JSWorkerContextBase.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSWorkerContextBase.h"

@@ -34328,14 +39588,106 @@
 				<File

 					RelativePath="..\bindings\js\JSWorkerContextCustom.cpp"

 					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSWorkerCustom.cpp"

-					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestConstructor.h"

@@ -34344,14 +39696,158 @@
 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXMLHttpRequestUploadCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorConstructor.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorConstructor.h"

@@ -34360,10 +39856,106 @@
 				<File

 					RelativePath="..\bindings\js\JSXSLTProcessorCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScheduledAction.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScheduledAction.h"

@@ -34372,6 +39964,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptArray.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptArray.h"

@@ -34380,6 +40020,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCachedFrameData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCachedFrameData.h"

@@ -34388,6 +40076,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCallFrame.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCallFrame.h"

@@ -34396,6 +40132,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptCallStack.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptCallStack.h"

@@ -34404,6 +40188,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptController.h"

@@ -34412,10 +40244,106 @@
 				<File

 					RelativePath="..\bindings\js\ScriptControllerWin.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptEventListener.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptEventListener.h"

@@ -34424,6 +40352,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptFunctionCall.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptFunctionCall.h"

@@ -34442,14 +40418,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\ScriptObjectQuarantine.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\ScriptObjectQuarantine.h"

-					>

-				</File>

-				<File

 					RelativePath="..\bindings\js\ScriptSourceCode.h"

 					>

 				</File>

@@ -34460,6 +40428,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptState.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptState.h"

@@ -34480,6 +40496,54 @@
 				<File

 					RelativePath="..\bindings\js\SerializedScriptValue.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\SerializedScriptValue.h"

@@ -34492,6 +40556,54 @@
 				<File

 					RelativePath="..\bindings\js\WorkerScriptController.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\WorkerScriptController.h"

@@ -36155,6 +42267,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InjectedScriptHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InjectedScriptHost.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorBackend.cpp"

 				>

 			</File>

@@ -36207,6 +42327,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorFrontendHost.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorFrontendHost.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorResource.cpp"

 				>

 			</File>

@@ -36302,10 +42430,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ConsolePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ConsoleView.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ContextMenu.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\Database.js"

 					>

 				</File>

@@ -36330,10 +42466,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\DOMStorageDataGrid.js"

-					>

-				</File>

-				<File

 					RelativePath="..\inspector\front-end\DOMStorageItemsView.js"

 					>

 				</File>

@@ -36518,6 +42650,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TimelineGrid.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\TimelineOverviewPane.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TimelinePanel.js"

 					>

 				</File>

@@ -36919,72 +43059,6 @@
 			RelativePath="..\config.h"

 			>

 		</File>

-		<File

-			RelativePath="..\platform\graphics\TextRenderingMode.h"

-			>

-		</File>

-		<File

-			RelativePath="..\WebCorePrefix.cpp"

-			>

-			<FileConfiguration

-				Name="Debug|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Release|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_Internal|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_Cairo|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Release_Cairo|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Debug_All|Win32"

-				>

-				<Tool

-					Name="VCCLCompilerTool"

-					UsePrecompiledHeader="1"

-					DisableSpecificWarnings="4819"

-				/>

-			</FileConfiguration>

-		</File>

-		<File

-			RelativePath="..\WebCorePrefix.h"

-			>

-		</File>

 	</Files>

 	<Globals>

 	</Globals>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 8727a4d..7cf70b0 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -8,9 +8,10 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
-		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
+		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_FILTERS;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
+		ProgramDataBaseFileName="$(OutDir)\$(TargetName).vc80.pdb"
 		ForcedIncludeFiles="WebCorePrefix.h"
 	/>
 	<Tool
diff --git a/WebCore/WebCore.vcproj/build-generated-files.sh b/WebCore/WebCore.vcproj/build-generated-files.sh
index 06b3c6d..f2ec855 100644
--- a/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/WebCore/WebCore.vcproj/build-generated-files.sh
@@ -59,5 +59,5 @@ mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources"
 cd "${BUILT_PRODUCTS_DIR}/DerivedSources"
 
 export WebCore="${XSRCROOT}"
-export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
+export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_FILTERS ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
 make -f "$WebCore/DerivedSources.make" -j ${NUMCPUS} || exit 1
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 7f8f811..2d0b804 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -90,10 +90,10 @@
 		087281580F26B9B600AFC596 /* OptionGroupElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087281540F26B9B600AFC596 /* OptionGroupElement.h */; };
 		08744BAA0EDB7D86004C9E63 /* WMLOnEventElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */; };
 		08744BAE0EDB7D92004C9E63 /* WMLOnEventElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */; };
-		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; };
+		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0878B1FE10874E3F00A55097 /* SynchronizablePropertyController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0878B1FA10874E3F00A55097 /* SynchronizablePropertyController.cpp */; };
-		0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */; };
-		0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */; };
+		0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		087FFA0F0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */; };
 		087FFA100EFF3ED3009DBD88 /* WMLInsertedLegendElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */; };
 		08807B760ED709AB003F6975 /* WMLGoElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08807B6A0ED709AB003F6975 /* WMLGoElement.cpp */; };
@@ -156,6 +156,11 @@
 		0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */; };
 		0B9056F90F2685F30095FF6A /* WorkerThreadableLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */; settings = {ATTRIBUTES = (); }; };
 		0BE030A20F3112FB003C1A46 /* RenderLineBoxList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BE030A10F3112FB003C1A46 /* RenderLineBoxList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */; };
+		0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */; };
+		0C3F1F5C10C8871200D72CE1 /* WebGLUniformLocation.idl in Resources */ = {isa = PBXBuildFile; fileRef = 0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */; };
+		0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */; };
+		0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */; };
 		0F11A54F0F39233100C37884 /* RenderSelectionInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */; };
 		0F15DA8A0F3AAEE70000CE47 /* AnimationControllerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */; };
 		0F500AAF0F54DB1B00EEF928 /* TransformState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F500AAE0F54DB1B00EEF928 /* TransformState.h */; };
@@ -205,6 +210,14 @@
 		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE5109AE37500DED655 /* RenderRuby.cpp */; };
+		1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAE6109AE37500DED655 /* RenderRuby.h */; };
+		1479FAEF109AE37500DED655 /* RenderRubyBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */; };
+		1479FAF0109AE37500DED655 /* RenderRubyBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAE8109AE37500DED655 /* RenderRubyBase.h */; };
+		1479FAF1109AE37500DED655 /* RenderRubyRun.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */; };
+		1479FAF2109AE37500DED655 /* RenderRubyRun.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAEA109AE37500DED655 /* RenderRubyRun.h */; };
+		1479FAF3109AE37500DED655 /* RenderRubyText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1479FAEB109AE37500DED655 /* RenderRubyText.cpp */; };
+		1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479FAEC109AE37500DED655 /* RenderRubyText.h */; };
 		148AFDA50AF58360008CC700 /* ExceptionHandlers.h in Headers */ = {isa = PBXBuildFile; fileRef = 148AFDA30AF58360008CC700 /* ExceptionHandlers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148AFDA60AF58360008CC700 /* ExceptionHandlers.mm in Sources */ = {isa = PBXBuildFile; fileRef = 148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */; };
 		14993BE50B2F2B1C0050497F /* FocusController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14993BE30B2F2B1C0050497F /* FocusController.cpp */; };
@@ -530,6 +543,7 @@
 		1CB4214B0AF2B2CA0085AD91 /* DOMElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711490AC5D5340053270F /* DOMElementInternal.h */; };
 		1CB4214C0AF2B2CA0085AD91 /* DOMHTMLElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711580AC5D5340053270F /* DOMHTMLElementInternal.h */; };
 		1CB4214D0AF2B2CA0085AD91 /* DOMRangeInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 8538F05A0AD722F1006A81D1 /* DOMRangeInternal.h */; };
+		1CCA732210ADD44A00FD440D /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */; };
 		1CDC14050DD3934C006EACD3 /* localizedStrings.js in Resources */ = {isa = PBXBuildFile; fileRef = BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */; };
 		1CE24F970D7CAF0E007E04C2 /* SchedulePairMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1CE24F960D7CAF0E007E04C2 /* SchedulePairMac.mm */; };
 		1CE83AC30ADAFFD7009354F6 /* DeleteButtonController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1C4C8EFF0AD85D87009475CE /* DeleteButtonController.cpp */; };
@@ -664,10 +678,6 @@
 		371F53E90D2704F900ECE0D5 /* CSSUnicodeRangeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */; };
 		371F53EA0D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */; };
 		37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37202198106213C600F25C4B /* FontSmoothingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 3724CA540E68A7E400DB4384 /* CoreTextController.h */; };
-		3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA550E68A7E400DB4384 /* CoreTextController.cpp */; };
-		3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */; };
-		3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */; };
 		3744570F0DB05FA500AE0992 /* SVGGlyphMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */; };
 		3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		377C4CDF1014E9F600B9AE42 /* PlaceholderDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */; };
@@ -677,6 +687,11 @@
 		37919C240B7D188600A56998 /* PositionIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 37919C220B7D188600A56998 /* PositionIterator.h */; settings = {ATTRIBUTES = (); }; };
 		37ACCE420DA2980F0089E602 /* FontRenderingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37ACCE410DA2980F0089E602 /* FontRenderingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37ACCE620DA2AA960089E602 /* FontDescription.cpp */; };
+		37C2360B1097EDED00EF9F72 /* FontComplexTextMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */; };
+		37C236101097EE7700EF9F72 /* ComplexTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */; };
+		37C236111097EE7700EF9F72 /* ComplexTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 37C2360F1097EE7700EF9F72 /* ComplexTextController.h */; };
+		37C238211098C84200EF9F72 /* ComplexTextControllerATSUI.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */; };
+		37C238221098C84200EF9F72 /* ComplexTextControllerCoreText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */; };
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
@@ -685,7 +700,6 @@
 		411046410FA222A600BA436A /* ScriptEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 4110463F0FA222A600BA436A /* ScriptEventListener.h */; };
 		411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 411046400FA222A600BA436A /* ScriptEventListener.cpp */; };
 		4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */; };
-		412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */; };
 		415B7C570FF598E6006770F7 /* JSAbstractWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */; };
 		415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */; };
 		415B7C630FF5A767006770F7 /* JSSharedWorkerConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */; };
@@ -704,7 +718,6 @@
 		416F45F00ED7B311008215B6 /* ScriptString.h in Headers */ = {isa = PBXBuildFile; fileRef = 416F45EF0ED7B311008215B6 /* ScriptString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */; };
 		418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = 418F88030FF957AE0080F045 /* JSAbstractWorker.h */; };
-		419536510F68222400D0C679 /* ScriptObjectQuarantine.h in Headers */ = {isa = PBXBuildFile; fileRef = 419536500F68222400D0C679 /* ScriptObjectQuarantine.h */; };
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
 		41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */; };
 		41BF700B0FE86F49005E8DEC /* MessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */; };
@@ -764,7 +777,7 @@
 		46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DA0B0D60170028EE36 /* aliasCursor.png */; };
 		46F9D5DE0B0D60170028EE36 /* noDropCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DB0B0D60170028EE36 /* noDropCursor.png */; };
 		46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DC0B0D60170028EE36 /* progressCursor.png */; };
-		492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */; };
+		492273A31083B3B100EE5C84 /* JSWebGLArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
@@ -789,40 +802,40 @@
 		498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391560F1E776900C23782 /* WebKitCSSMatrix.h */; };
 		498391630F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */; };
 		498391640F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */; };
-		49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */; };
-		49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */; };
-		49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */; };
-		49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */; };
-		49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */; };
-		49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */; };
-		49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */; };
-		49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSCanvasProgram.h */; };
-		49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */; };
-		49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */; };
-		49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */; };
-		49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSCanvasShader.h */; };
-		49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */; };
-		49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSCanvasTexture.h */; };
-		49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */; };
-		49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* CanvasBuffer.h */; };
-		49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */; };
-		49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */; };
-		49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */; };
-		49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */; };
+		49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */; };
+		49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */; };
+		49C7B9951042D2D30009D447 /* JSWebGLByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */; };
+		49C7B9961042D2D30009D447 /* JSWebGLByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */; };
+		49C7B9971042D2D30009D447 /* JSWebGLFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */; };
+		49C7B9981042D2D30009D447 /* JSWebGLFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */; };
+		49C7B99B1042D2D30009D447 /* JSWebGLProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */; };
+		49C7B99C1042D2D30009D447 /* JSWebGLProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSWebGLProgram.h */; };
+		49C7B99D1042D2D30009D447 /* JSWebGLRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */; };
+		49C7B99E1042D2D30009D447 /* JSWebGLRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */; };
+		49C7B9A21042D2D30009D447 /* JSWebGLShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */; };
+		49C7B9A31042D2D30009D447 /* JSWebGLShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSWebGLShader.h */; };
+		49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */; };
+		49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSWebGLTexture.h */; };
+		49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */; };
+		49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* WebGLBuffer.h */; };
+		49C7B9CB1042D32F0009D447 /* WebGLByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */; };
+		49C7B9CC1042D32F0009D447 /* WebGLByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */; };
+		49C7B9CE1042D32F0009D447 /* WebGLFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */; };
+		49C7B9CF1042D32F0009D447 /* WebGLFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */; };
 		49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B41042D32F0009D447 /* CanvasObject.cpp */; };
 		49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B51042D32F0009D447 /* CanvasObject.h */; };
-		49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */; };
-		49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* CanvasProgram.h */; };
-		49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */; };
-		49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */; };
+		49C7B9D61042D32F0009D447 /* WebGLProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */; };
+		49C7B9D71042D32F0009D447 /* WebGLProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* WebGLProgram.h */; };
+		49C7B9D91042D32F0009D447 /* WebGLRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */; };
+		49C7B9DA1042D32F0009D447 /* WebGLRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */; };
 		49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */; };
 		49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */; };
-		49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */; };
-		49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */; };
-		49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* CanvasShader.cpp */; };
-		49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* CanvasShader.h */; };
-		49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */; };
-		49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* CanvasTexture.h */; };
+		49C7B9DF1042D32F0009D447 /* WebGLRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */; };
+		49C7B9E01042D32F0009D447 /* WebGLRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */; };
+		49C7B9E21042D32F0009D447 /* WebGLShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* WebGLShader.cpp */; };
+		49C7B9E31042D32F0009D447 /* WebGLShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* WebGLShader.h */; };
+		49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */; };
+		49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* WebGLTexture.h */; };
 		49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */; };
 		49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */; };
@@ -854,69 +867,69 @@
 		49E912AC0EFAC906009D0CAF /* AnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49E912A70EFAC906009D0CAF /* AnimationList.cpp */; };
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* CanvasArray.cpp */; };
-		49EECDE010503C2400099FAB /* CanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* CanvasArray.h */; };
-		49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */; };
-		49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */; };
-		49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */; };
-		49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* CanvasFloatArray.h */; };
-		49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* CanvasIntArray.cpp */; };
-		49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* CanvasIntArray.h */; };
-		49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* CanvasShortArray.cpp */; };
-		49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* CanvasShortArray.h */; };
-		49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */; };
-		49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */; };
-		49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */; };
-		49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */; };
-		49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */; };
-		49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */; };
-		49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */; };
-		49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */; };
-		49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */; };
-		49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */; };
-		49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */; };
-		49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSCanvasIntArray.h */; };
-		49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */; };
-		49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSCanvasShortArray.h */; };
-		49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */; };
-		49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */; };
-		49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */; };
-		49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */; };
-		49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */; };
-		49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */; };
-		49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSCanvasArray.cpp */; };
-		49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSCanvasArray.h */; };
-		49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */; };
-		49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */; };
-		49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */; };
-		49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */; };
-		49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */; };
-		49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */; };
-		49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */; };
-		49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */; };
-		49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */; };
-		49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */; };
-		49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */; };
-		49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */; };
-		49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */; };
-		49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */; };
-		49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */; };
-		49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */; };
-		49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */; };
-		49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */; };
-		49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */; };
-		49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */; };
-		49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */; };
-		49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */; };
-		49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */; };
+		49EECDDF10503C2400099FAB /* WebGLArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* WebGLArray.cpp */; };
+		49EECDE010503C2400099FAB /* WebGLArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* WebGLArray.h */; };
+		49EECDE210503C2400099FAB /* WebGLArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */; };
+		49EECDE310503C2400099FAB /* WebGLArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */; };
+		49EECDE510503C2400099FAB /* WebGLFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */; };
+		49EECDE610503C2400099FAB /* WebGLFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* WebGLFloatArray.h */; };
+		49EECDE810503C2400099FAB /* WebGLIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* WebGLIntArray.cpp */; };
+		49EECDE910503C2400099FAB /* WebGLIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* WebGLIntArray.h */; };
+		49EECDEB10503C2400099FAB /* WebGLShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* WebGLShortArray.cpp */; };
+		49EECDEC10503C2400099FAB /* WebGLShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* WebGLShortArray.h */; };
+		49EECDEE10503C2400099FAB /* WebGLUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */; };
+		49EECDEF10503C2400099FAB /* WebGLUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */; };
+		49EECDF110503C2400099FAB /* WebGLUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */; };
+		49EECDF210503C2400099FAB /* WebGLUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */; };
+		49EECDF410503C2400099FAB /* WebGLUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */; };
+		49EECDF510503C2400099FAB /* WebGLUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */; };
+		49EECF00105070C400099FAB /* JSWebGLArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */; };
+		49EECF01105070C400099FAB /* JSWebGLArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */; };
+		49EECF02105070C400099FAB /* JSWebGLFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */; };
+		49EECF03105070C400099FAB /* JSWebGLFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */; };
+		49EECF04105070C400099FAB /* JSWebGLIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */; };
+		49EECF05105070C400099FAB /* JSWebGLIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSWebGLIntArray.h */; };
+		49EECF06105070C400099FAB /* JSWebGLShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */; };
+		49EECF07105070C400099FAB /* JSWebGLShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSWebGLShortArray.h */; };
+		49EECF08105070C400099FAB /* JSWebGLUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */; };
+		49EECF09105070C400099FAB /* JSWebGLUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */; };
+		49EECF0A105070C400099FAB /* JSWebGLUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */; };
+		49EECF0B105070C400099FAB /* JSWebGLUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */; };
+		49EECF0C105070C400099FAB /* JSWebGLUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */; };
+		49EECF0D105070C400099FAB /* JSWebGLUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */; };
+		49EECF1B105072F300099FAB /* JSWebGLArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSWebGLArray.cpp */; };
+		49EECF1C105072F300099FAB /* JSWebGLArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSWebGLArray.h */; };
+		49EECF7810508D9C00099FAB /* JSWebGLByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */; };
+		49EECF7910508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */; };
+		49EECF7A10508D9C00099FAB /* JSWebGLIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */; };
+		49EECF7B10508D9C00099FAB /* JSWebGLShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */; };
+		49EECF7C10508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */; };
+		49EECF7D10508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */; };
+		49EECF7E10508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */; };
+		49EECFAB1050938200099FAB /* JSWebGLArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */; };
+		49EECFAC1050938200099FAB /* JSWebGLArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */; };
+		49EECFAD1050938200099FAB /* JSWebGLByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */; };
+		49EECFAE1050938200099FAB /* JSWebGLByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */; };
+		49EECFAF1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */; };
+		49EECFB01050938200099FAB /* JSWebGLFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */; };
+		49EECFB11050938200099FAB /* JSWebGLIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */; };
+		49EECFB21050938200099FAB /* JSWebGLIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */; };
+		49EECFB51050938200099FAB /* JSWebGLShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */; };
+		49EECFB61050938200099FAB /* JSWebGLShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */; };
+		49EECFB71050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */; };
+		49EECFB81050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */; };
+		49EECFB91050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */; };
+		49EECFBA1050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */; };
+		49EECFBB1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */; };
+		49EECFBC1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */; };
 		49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */; };
 		49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */; };
 		49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */; };
 		49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */; };
-		49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */; };
-		49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */; };
+		49EED1461051969400099FAB /* JSWebGLRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */; };
+		49EED1471051969400099FAB /* JSWebGLRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSWebGLRenderingContext.h */; };
 		49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */; };
-		49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */; };
+		49EED14F1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */; };
 		49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */; };
 		4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1013,6 +1026,12 @@
 		51741D100B07259A00ED442C /* BackForwardList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0C0B07259A00ED442C /* BackForwardList.cpp */; };
 		51741D110B07259A00ED442C /* HistoryItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 51741D0D0B07259A00ED442C /* HistoryItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51741D120B07259A00ED442C /* HistoryItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0E0B07259A00ED442C /* HistoryItem.cpp */; };
+		5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5174E20810A1F44F00F95E6F /* PopStateEvent.h */; };
+		5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = 5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */; };
+		5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */; };
+		5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */; };
+		5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */; };
+		5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */; };
 		518A34C11026C831001B6896 /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34BE1026C831001B6896 /* WebSocket.cpp */; };
 		518A34C21026C831001B6896 /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 518A34BF1026C831001B6896 /* WebSocket.h */; };
 		518A34C71026C8C9001B6896 /* JSWebSocketConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */; };
@@ -1082,6 +1101,8 @@
 		54C50F7B0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		599D1E3210C97D6E00E0EF12 /* jni_utility_private.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */; };
+		599D1E3310C97D6E00E0EF12 /* jni_utility_private.h in Headers */ = {isa = PBXBuildFile; fileRef = 599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */; };
 		59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59C77F2810545B3B00506104 /* GeolocationServiceMock.cpp */; };
 		59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */ = {isa = PBXBuildFile; fileRef = 59C77F2910545B3B00506104 /* GeolocationServiceMock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D15E3AB0F9E6AC1009E0E3F /* XMLTokenizerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */; };
@@ -1190,6 +1211,8 @@
 		65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323609D1DE65000BE325 /* JSCanvasPattern.h */; };
 		65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AF09D14EE6000E61D7 /* UserAgentStyleSheetsData.cpp */; };
 		65FEA86909833ADE00BED4AB /* Page.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FEA86809833ADE00BED4AB /* Page.cpp */; };
+		6E47E66010B7944B00B186C8 /* WebGLGetInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */; };
+		6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
 		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
 		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
@@ -1206,6 +1229,19 @@
 		7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7693BACF106C2DCA007B0823 /* PluginHalter.cpp */; };
 		7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD0106C2DCA007B0823 /* PluginHalter.h */; };
 		7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79AC9218109945C80021266E /* JSCompositionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79AC9216109945C80021266E /* JSCompositionEvent.cpp */; };
+		79AC9219109945C80021266E /* JSCompositionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 79AC9217109945C80021266E /* JSCompositionEvent.h */; };
+		79F2F5A11091939A000D87CB /* CompositionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79F2F59E1091939A000D87CB /* CompositionEvent.cpp */; };
+		79F2F5A21091939A000D87CB /* CompositionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 79F2F59F1091939A000D87CB /* CompositionEvent.h */; };
+		7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */; };
+		7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */; };
+		7A0E76DB10BF059800A0276E /* JSInjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */; };
+		7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */; };
+		7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */; };
+		7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */; };
+		7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */; };
+		7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */; };
+		7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */; };
 		7A1E88F5101CC384000C4DF5 /* ScriptArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */; };
 		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
@@ -1214,7 +1250,8 @@
 		7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */; };
 		7A74ECBA101839A600BF939E /* InspectorBackend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECB8101839A500BF939E /* InspectorBackend.cpp */; };
 		7A74ECBB101839A600BF939E /* InspectorBackend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A74ECB9101839A600BF939E /* InspectorBackend.h */; };
-		7A74ECBD101839DA00BF939E /* JSInspectorBackendCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */; };
+		7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */; };
+		7ADE722610CBBB9B006B3B3A /* ContextMenuSelectionHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */; };
 		7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */; };
 		7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */; };
 		84224183107E77F400766A87 /* JSSVGFEMorphologyElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */; };
@@ -2237,6 +2274,7 @@
 		938192030F87E1E600D5352A /* BinaryPropertyList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938192020F87E1E600D5352A /* BinaryPropertyList.cpp */; };
 		938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 938192040F87E1EC00D5352A /* BinaryPropertyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9382AAB40D8C386100F357A6 /* NodeWithIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = 9382AAB10D8C386100F357A6 /* NodeWithIndex.h */; };
+		9382DF5810A8D5C900925652 /* ColorSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 9382DF5710A8D5C900925652 /* ColorSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93831B570D087D6000E5C984 /* ExceptionCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93831B560D087D6000E5C984 /* ExceptionCode.cpp */; };
 		938E65F109F09840008A48EC /* JSHTMLElementWrapperFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */; };
 		938E65F709F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */; };
@@ -2404,9 +2442,9 @@
 		A7CFB3D20B7ED10A0070C32D /* DragImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CFB3D00B7ED10A0070C32D /* DragImage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7CFB3D50B7ED1180070C32D /* DragImageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */; };
 		A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */; };
-		A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */; };
-		A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */; };
-		A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */; };
+		A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */; };
+		A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */; };
+		A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */; };
 		A7D27FC40E0A599F0079AD2B /* SVGFETile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */; };
 		A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */; };
@@ -3258,6 +3296,7 @@
 		AB23A32809BBA7D00067CC53 /* BeforeTextInsertedEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */; };
 		AB247A6C0AFD6383003FA5FD /* RenderSlider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */; };
 		AB247A6D0AFD6383003FA5FD /* RenderSlider.h in Headers */ = {isa = PBXBuildFile; fileRef = AB247A6B0AFD6383003FA5FD /* RenderSlider.h */; };
+		AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */ = {isa = PBXBuildFile; fileRef = AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		AB40484D0E083FA8007D6920 /* MediaDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AB40484B0E083FA8007D6920 /* MediaDocument.cpp */; };
 		AB40484E0E083FA8007D6920 /* MediaDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = AB40484C0E083FA8007D6920 /* MediaDocument.h */; };
 		AB4261D80A2F6C9700BDD17D /* missingImage.tiff in Resources */ = {isa = PBXBuildFile; fileRef = AB4261D70A2F6C9700BDD17D /* missingImage.tiff */; };
@@ -3293,7 +3332,7 @@
 		B22279850D00BF220071B782 /* SVGAnimatedPathData.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277EF0D00BF1F0071B782 /* SVGAnimatedPathData.h */; };
 		B22279870D00BF220071B782 /* SVGAnimatedPoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F10D00BF1F0071B782 /* SVGAnimatedPoints.cpp */; };
 		B22279880D00BF220071B782 /* SVGAnimatedPoints.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F20D00BF1F0071B782 /* SVGAnimatedPoints.h */; };
-		B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */; };
+		B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B222798F0D00BF220071B782 /* SVGAnimateElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F90D00BF1F0071B782 /* SVGAnimateElement.cpp */; };
 		B22279900D00BF220071B782 /* SVGAnimateElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277FA0D00BF1F0071B782 /* SVGAnimateElement.h */; };
 		B22279920D00BF220071B782 /* SVGAnimateMotionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277FC0D00BF1F0071B782 /* SVGAnimateMotionElement.cpp */; };
@@ -3319,7 +3358,7 @@
 		B22279B30D00BF220071B782 /* SVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781D0D00BF1F0071B782 /* SVGDocument.cpp */; };
 		B22279B40D00BF220071B782 /* SVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = B222781E0D00BF1F0071B782 /* SVGDocument.h */; };
 		B22279B60D00BF220071B782 /* SVGElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278200D00BF1F0071B782 /* SVGElement.cpp */; };
-		B22279B70D00BF220071B782 /* SVGElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278210D00BF1F0071B782 /* SVGElement.h */; };
+		B22279B70D00BF220071B782 /* SVGElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278210D00BF1F0071B782 /* SVGElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B22279B90D00BF220071B782 /* SVGElementInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278230D00BF1F0071B782 /* SVGElementInstance.cpp */; };
 		B22279BA0D00BF220071B782 /* SVGElementInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278240D00BF1F0071B782 /* SVGElementInstance.h */; };
 		B22279BC0D00BF220071B782 /* SVGElementInstanceList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278260D00BF1F0071B782 /* SVGElementInstanceList.cpp */; };
@@ -3402,7 +3441,7 @@
 		B2227A2F0D00BF220071B782 /* SVGLangSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278990D00BF200071B782 /* SVGLangSpace.cpp */; };
 		B2227A300D00BF220071B782 /* SVGLangSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789A0D00BF200071B782 /* SVGLangSpace.h */; };
 		B2227A320D00BF220071B782 /* SVGLength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222789C0D00BF200071B782 /* SVGLength.cpp */; };
-		B2227A330D00BF220071B782 /* SVGLength.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789D0D00BF200071B782 /* SVGLength.h */; };
+		B2227A330D00BF220071B782 /* SVGLength.h in Headers */ = {isa = PBXBuildFile; fileRef = B222789D0D00BF200071B782 /* SVGLength.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2227A350D00BF220071B782 /* SVGLengthList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222789F0D00BF200071B782 /* SVGLengthList.cpp */; };
 		B2227A360D00BF220071B782 /* SVGLengthList.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278A00D00BF200071B782 /* SVGLengthList.h */; };
 		B2227A380D00BF220071B782 /* SVGLinearGradientElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278A20D00BF200071B782 /* SVGLinearGradientElement.cpp */; };
@@ -3664,7 +3703,7 @@
 		B27B285D0CEF0D7200D39D54 /* DOMSVGGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = B27B28300CEF0C3500D39D54 /* DOMSVGGlyphElement.h */; };
 		B27B285E0CEF0D7200D39D54 /* DOMSVGMissingGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = B27B28330CEF0C3500D39D54 /* DOMSVGMissingGlyphElement.h */; };
 		B28C6A270D00C44800334AA4 /* SVGDocumentExtensions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B28C6A1E0D00C44800334AA4 /* SVGDocumentExtensions.cpp */; };
-		B28C6A280D00C44800334AA4 /* SVGDocumentExtensions.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A1F0D00C44800334AA4 /* SVGDocumentExtensions.h */; };
+		B28C6A280D00C44800334AA4 /* SVGDocumentExtensions.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A1F0D00C44800334AA4 /* SVGDocumentExtensions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B28C6A290D00C44800334AA4 /* SVGImageLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B28C6A200D00C44800334AA4 /* SVGImageLoader.cpp */; };
 		B28C6A2A0D00C44800334AA4 /* SVGImageLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = B28C6A210D00C44800334AA4 /* SVGImageLoader.h */; };
 		B297BC700B3C14CF0045A590 /* JSSVGPathSegListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B297BC6F0B3C14CF0045A590 /* JSSVGPathSegListCustom.cpp */; };
@@ -4138,8 +4177,6 @@
 		BC4918C90BFEA050009D6316 /* JSHTMLIFrameElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4918C30BFEA050009D6316 /* JSHTMLIFrameElement.h */; };
 		BC491B780C023EFD009D6316 /* JSHTMLMarqueeElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC491B760C023EFD009D6316 /* JSHTMLMarqueeElement.cpp */; };
 		BC491B790C023EFD009D6316 /* JSHTMLMarqueeElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC491B770C023EFD009D6316 /* JSHTMLMarqueeElement.h */; };
-		BC4BF9E40D11E133007D247F /* ClassNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4BF9E20D11E133007D247F /* ClassNames.cpp */; };
-		BC4BF9E50D11E133007D247F /* ClassNames.h in Headers */ = {isa = PBXBuildFile; fileRef = BC4BF9E30D11E133007D247F /* ClassNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC4EDEF40C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */; };
 		BC5156E80C03B741008BB0EE /* DOMHTMLMarqueeElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */; };
 		BC5156E90C03B741008BB0EE /* DOMHTMLMarqueeElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC5156E60C03B741008BB0EE /* DOMHTMLMarqueeElement.mm */; };
@@ -4310,7 +4347,6 @@
 		BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC904B730D10998F00680D32 /* ClassNodeList.h */; };
 		BC926F800C0552470082776B /* JSHTMLFrameSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */; };
 		BC926F810C0552470082776B /* JSHTMLFrameSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */; };
-		BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */; };
 		BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */; };
 		BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */; };
 		BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946347107A936600857193 /* JSBeforeLoadEvent.h */; };
@@ -4554,6 +4590,8 @@
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
 		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		D01A27AD10C9BFD800026A42 /* SpaceSplitString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */; };
+		D01A27AE10C9BFD800026A42 /* SpaceSplitString.h in Headers */ = {isa = PBXBuildFile; fileRef = D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */; };
 		D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */; };
 		D06C0D8F0CFD11460065F43F /* RemoveFormatCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */; };
@@ -4593,6 +4631,7 @@
 		E10B9CCD0B747A44003ED890 /* DOMCustomXPathNSResolver.mm in Sources */ = {isa = PBXBuildFile; fileRef = E10B9CCB0B747A44003ED890 /* DOMCustomXPathNSResolver.mm */; };
 		E11C9D9B0EB3681200E409DB /* ScriptExecutionContext.h in Headers */ = {isa = PBXBuildFile; fileRef = E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E11C9DB00EB3699500E409DB /* ScriptExecutionContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */; };
+		E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = E124748310AA161D00B79493 /* AuthenticationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */ = {isa = PBXBuildFile; fileRef = E12719C60EEEC16800F61213 /* NavigatorBase.h */; };
 		E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E12719C90EEEC21300F61213 /* NavigatorBase.cpp */; };
 		E1271A0B0EEEC77A00F61213 /* WorkerNavigator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */; };
@@ -4627,6 +4666,7 @@
 		E1ADEDD50E76BD60004A1A5E /* DOMMessagePortInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADEDD40E76BD60004A1A5E /* DOMMessagePortInternal.h */; };
 		E1ADEDDA0E76BD93004A1A5E /* JSMessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADEDD80E76BD93004A1A5E /* JSMessagePort.h */; };
 		E1ADEDDB0E76BD93004A1A5E /* JSMessagePort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADEDD90E76BD93004A1A5E /* JSMessagePort.cpp */; };
+		E1B4CD2510B322E200BFFD7E /* CredentialStorageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */; };
 		E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */; };
 		E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */; };
 		E1C362EF0EAF2AA9007410BC /* JSWorkerLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = E1C362ED0EAF2AA9007410BC /* JSWorkerLocation.h */; };
@@ -4698,11 +4738,11 @@
 		E49626C30D80D94900E3405C /* PreloadScanner.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D4ABE10D7542F100F96869 /* PreloadScanner.h */; };
 		E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFCFA40DAF29A300F5F55C /* UnitBezier.h */; };
 		E4AFD00B0DAF335400F5F55C /* SMILTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0050DAF335400F5F55C /* SMILTime.cpp */; };
-		E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0060DAF335400F5F55C /* SMILTime.h */; };
+		E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0060DAF335400F5F55C /* SMILTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4AFD00D0DAF335500F5F55C /* SMILTimeContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0070DAF335400F5F55C /* SMILTimeContainer.cpp */; };
 		E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD0080DAF335400F5F55C /* SMILTimeContainer.h */; };
 		E4AFD00F0DAF335500F5F55C /* SVGSMILElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4AFD0090DAF335400F5F55C /* SVGSMILElement.cpp */; };
-		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; };
+		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
@@ -4716,6 +4756,8 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */; };
+		F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */ = {isa = PBXBuildFile; fileRef = F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */; };
 		F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */; };
 		F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */; };
 		F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */; };
@@ -4723,6 +4765,8 @@
 		F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */; };
 		F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */; };
 		F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */; };
+		F5D3A57C106B83B300545297 /* ISODateTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5D3A57A106B83B300545297 /* ISODateTime.cpp */; };
+		F5D3A57D106B83B300545297 /* ISODateTime.h in Headers */ = {isa = PBXBuildFile; fileRef = F5D3A57B106B83B300545297 /* ISODateTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F916C48D0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */; };
 		F916C48E0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */; };
 		F9F0ED7A0DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */; };
@@ -4777,6 +4821,7 @@
 			dstPath = Versions/A/PrivateHeaders;
 			dstSubfolderSpec = 1;
 			files = (
+				1CCA732210ADD44A00FD440D /* DOMHTMLInputElementPrivate.h in Copy Generated Headers */,
 				5DF7F5C20F01F92A00526B4B /* CSSPropertyNames.h in Copy Generated Headers */,
 				8538F0300AD71CDB006A81D1 /* DOMAbstractView.h in Copy Generated Headers */,
 				1C11CCBC0AA6093700DADB20 /* DOMAttr.h in Copy Generated Headers */,
@@ -5311,6 +5356,11 @@
 		0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableLoader.cpp; sourceTree = "<group>"; };
 		0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableLoader.h; sourceTree = "<group>"; };
 		0BE030A10F3112FB003C1A46 /* RenderLineBoxList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderLineBoxList.h; sourceTree = "<group>"; };
+		0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUniformLocation.cpp; path = canvas/WebGLUniformLocation.cpp; sourceTree = "<group>"; };
+		0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUniformLocation.h; path = canvas/WebGLUniformLocation.h; sourceTree = "<group>"; };
+		0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUniformLocation.idl; path = canvas/WebGLUniformLocation.idl; sourceTree = "<group>"; };
+		0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUniformLocation.cpp; sourceTree = "<group>"; };
+		0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUniformLocation.h; sourceTree = "<group>"; };
 		0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSelectionInfo.h; sourceTree = "<group>"; };
 		0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationControllerPrivate.h; path = animation/AnimationControllerPrivate.h; sourceTree = "<group>"; };
 		0F500AAE0F54DB1B00EEF928 /* TransformState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformState.h; sourceTree = "<group>"; };
@@ -5367,6 +5417,14 @@
 		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
+		1479FAE5109AE37500DED655 /* RenderRuby.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRuby.cpp; sourceTree = "<group>"; };
+		1479FAE6109AE37500DED655 /* RenderRuby.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRuby.h; sourceTree = "<group>"; };
+		1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyBase.cpp; sourceTree = "<group>"; };
+		1479FAE8109AE37500DED655 /* RenderRubyBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyBase.h; sourceTree = "<group>"; };
+		1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyRun.cpp; sourceTree = "<group>"; };
+		1479FAEA109AE37500DED655 /* RenderRubyRun.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyRun.h; sourceTree = "<group>"; };
+		1479FAEB109AE37500DED655 /* RenderRubyText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRubyText.cpp; sourceTree = "<group>"; };
+		1479FAEC109AE37500DED655 /* RenderRubyText.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRubyText.h; sourceTree = "<group>"; };
 		14813BF309EDF88E00F757E1 /* IDLParser.pm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.script.perl; name = IDLParser.pm; path = scripts/IDLParser.pm; sourceTree = "<group>"; };
 		148AFDA30AF58360008CC700 /* ExceptionHandlers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ExceptionHandlers.h; sourceTree = "<group>"; };
 		148AFDA40AF58360008CC700 /* ExceptionHandlers.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ExceptionHandlers.mm; sourceTree = "<group>"; };
@@ -5725,6 +5783,7 @@
 		1CAF347E0A6C405200ABE06E /* WebScriptObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptObject.h; sourceTree = "<group>"; };
 		1CAF347F0A6C405200ABE06E /* WebScriptObject.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebScriptObject.mm; sourceTree = "<group>"; };
 		1CAF34800A6C405200ABE06E /* WebScriptObjectPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebScriptObjectPrivate.h; sourceTree = "<group>"; };
+		1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLInputElementPrivate.h; sourceTree = "<group>"; };
 		1CD0B6200AABDB5000D0A3FF /* PublicDOMInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PublicDOMInterfaces.h; sourceTree = "<group>"; };
 		1CDD45E40BA9C84600F90147 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
 		1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = WebCore.xcconfig; sourceTree = "<group>"; };
@@ -5875,10 +5934,6 @@
 		371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSUnicodeRangeValue.h; sourceTree = "<group>"; };
 		371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSUnicodeRangeValue.cpp; sourceTree = "<group>"; };
 		37202198106213C600F25C4B /* FontSmoothingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontSmoothingMode.h; sourceTree = "<group>"; };
-		3724CA540E68A7E400DB4384 /* CoreTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CoreTextController.h; sourceTree = "<group>"; };
-		3724CA550E68A7E400DB4384 /* CoreTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CoreTextController.cpp; sourceTree = "<group>"; };
-		3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontMacATSUI.mm; sourceTree = "<group>"; };
-		3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontMacCoreText.cpp; sourceTree = "<group>"; };
 		3744570E0DB05FA500AE0992 /* SVGGlyphMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGGlyphMap.h; sourceTree = "<group>"; };
 		3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OverlapTestRequestClient.h; sourceTree = "<group>"; };
 		377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlaceholderDocument.h; sourceTree = "<group>"; };
@@ -5888,6 +5943,11 @@
 		37919C220B7D188600A56998 /* PositionIterator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PositionIterator.h; sourceTree = "<group>"; };
 		37ACCE410DA2980F0089E602 /* FontRenderingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontRenderingMode.h; sourceTree = "<group>"; };
 		37ACCE620DA2AA960089E602 /* FontDescription.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontDescription.cpp; sourceTree = "<group>"; };
+		37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontComplexTextMac.cpp; sourceTree = "<group>"; };
+		37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextController.cpp; sourceTree = "<group>"; };
+		37C2360F1097EE7700EF9F72 /* ComplexTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ComplexTextController.h; sourceTree = "<group>"; };
+		37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextControllerATSUI.cpp; sourceTree = "<group>"; };
+		37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexTextControllerCoreText.cpp; sourceTree = "<group>"; };
 		37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreURLResponse.h; sourceTree = "<group>"; };
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
@@ -5896,7 +5956,6 @@
 		4110463F0FA222A600BA436A /* ScriptEventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptEventListener.h; sourceTree = "<group>"; };
 		411046400FA222A600BA436A /* ScriptEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptEventListener.cpp; sourceTree = "<group>"; };
 		4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptState.cpp; sourceTree = "<group>"; };
-		412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObjectQuarantine.cpp; sourceTree = "<group>"; };
 		415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerConstructor.cpp; sourceTree = "<group>"; };
 		415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerConstructor.h; sourceTree = "<group>"; };
@@ -5916,7 +5975,6 @@
 		416F45EF0ED7B311008215B6 /* ScriptString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptString.h; sourceTree = "<group>"; };
 		418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorker.cpp; sourceTree = "<group>"; };
 		418F88030FF957AE0080F045 /* JSAbstractWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAbstractWorker.h; sourceTree = "<group>"; };
-		419536500F68222400D0C679 /* ScriptObjectQuarantine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptObjectQuarantine.h; sourceTree = "<group>"; };
 		41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerThread.cpp; path = workers/DedicatedWorkerThread.cpp; sourceTree = "<group>"; };
 		41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerThread.h; path = workers/DedicatedWorkerThread.h; sourceTree = "<group>"; };
 		41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MessagePortChannel.cpp; sourceTree = "<group>"; };
@@ -5991,7 +6049,7 @@
 		46F9D5DA0B0D60170028EE36 /* aliasCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = aliasCursor.png; sourceTree = "<group>"; };
 		46F9D5DB0B0D60170028EE36 /* noDropCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = noDropCursor.png; sourceTree = "<group>"; };
 		46F9D5DC0B0D60170028EE36 /* progressCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = progressCursor.png; sourceTree = "<group>"; };
-		492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayCustom.cpp; sourceTree = "<group>"; };
+		492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayCustom.cpp; sourceTree = "<group>"; };
 		49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasGradient.cpp; path = canvas/CanvasGradient.cpp; sourceTree = "<group>"; };
 		49484FB4102CF23C00187DD3 /* CanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasGradient.h; path = canvas/CanvasGradient.h; sourceTree = "<group>"; };
 		49484FB5102CF23C00187DD3 /* CanvasGradient.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasGradient.idl; path = canvas/CanvasGradient.idl; sourceTree = "<group>"; };
@@ -6022,49 +6080,49 @@
 		498391570F1E776900C23782 /* WebKitCSSMatrix.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitCSSMatrix.idl; sourceTree = "<group>"; };
 		498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSMatrixConstructor.cpp; sourceTree = "<group>"; };
 		498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSMatrixConstructor.h; sourceTree = "<group>"; };
-		49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasBuffer.cpp; sourceTree = "<group>"; };
-		49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasBuffer.h; sourceTree = "<group>"; };
-		49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArray.cpp; sourceTree = "<group>"; };
-		49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArray.h; sourceTree = "<group>"; };
-		49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFramebuffer.cpp; sourceTree = "<group>"; };
-		49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFramebuffer.h; sourceTree = "<group>"; };
-		49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasProgram.cpp; sourceTree = "<group>"; };
-		49C7B9891042D2D30009D447 /* JSCanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasProgram.h; sourceTree = "<group>"; };
-		49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderbuffer.cpp; sourceTree = "<group>"; };
-		49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderbuffer.h; sourceTree = "<group>"; };
-		49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShader.cpp; sourceTree = "<group>"; };
-		49C7B9901042D2D30009D447 /* JSCanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShader.h; sourceTree = "<group>"; };
-		49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasTexture.cpp; sourceTree = "<group>"; };
-		49C7B9921042D2D30009D447 /* JSCanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasTexture.h; sourceTree = "<group>"; };
-		49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasBuffer.cpp; path = canvas/CanvasBuffer.cpp; sourceTree = "<group>"; };
-		49C7B9A91042D32E0009D447 /* CanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasBuffer.h; path = canvas/CanvasBuffer.h; sourceTree = "<group>"; };
-		49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasBuffer.idl; path = canvas/CanvasBuffer.idl; sourceTree = "<group>"; };
-		49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasByteArray.cpp; path = canvas/CanvasByteArray.cpp; sourceTree = "<group>"; };
-		49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasByteArray.h; path = canvas/CanvasByteArray.h; sourceTree = "<group>"; };
-		49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasByteArray.idl; path = canvas/CanvasByteArray.idl; sourceTree = "<group>"; };
-		49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFramebuffer.cpp; path = canvas/CanvasFramebuffer.cpp; sourceTree = "<group>"; };
-		49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFramebuffer.h; path = canvas/CanvasFramebuffer.h; sourceTree = "<group>"; };
-		49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFramebuffer.idl; path = canvas/CanvasFramebuffer.idl; sourceTree = "<group>"; };
+		49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLBuffer.h; sourceTree = "<group>"; };
+		49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLByteArray.h; sourceTree = "<group>"; };
+		49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLProgram.cpp; sourceTree = "<group>"; };
+		49C7B9891042D2D30009D447 /* JSWebGLProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLProgram.h; sourceTree = "<group>"; };
+		49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShader.cpp; sourceTree = "<group>"; };
+		49C7B9901042D2D30009D447 /* JSWebGLShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShader.h; sourceTree = "<group>"; };
+		49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLTexture.cpp; sourceTree = "<group>"; };
+		49C7B9921042D2D30009D447 /* JSWebGLTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLTexture.h; sourceTree = "<group>"; };
+		49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLBuffer.cpp; path = canvas/WebGLBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9A91042D32E0009D447 /* WebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLBuffer.h; path = canvas/WebGLBuffer.h; sourceTree = "<group>"; };
+		49C7B9AA1042D32E0009D447 /* WebGLBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLBuffer.idl; path = canvas/WebGLBuffer.idl; sourceTree = "<group>"; };
+		49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLByteArray.cpp; path = canvas/WebGLByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLByteArray.h; path = canvas/WebGLByteArray.h; sourceTree = "<group>"; };
+		49C7B9AD1042D32E0009D447 /* WebGLByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLByteArray.idl; path = canvas/WebGLByteArray.idl; sourceTree = "<group>"; };
+		49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLFramebuffer.cpp; path = canvas/WebGLFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLFramebuffer.h; path = canvas/WebGLFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9B01042D32E0009D447 /* WebGLFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLFramebuffer.idl; path = canvas/WebGLFramebuffer.idl; sourceTree = "<group>"; };
 		49C7B9B41042D32F0009D447 /* CanvasObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasObject.cpp; path = canvas/CanvasObject.cpp; sourceTree = "<group>"; };
 		49C7B9B51042D32F0009D447 /* CanvasObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasObject.h; path = canvas/CanvasObject.h; sourceTree = "<group>"; };
-		49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasProgram.cpp; path = canvas/CanvasProgram.cpp; sourceTree = "<group>"; };
-		49C7B9B71042D32F0009D447 /* CanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasProgram.h; path = canvas/CanvasProgram.h; sourceTree = "<group>"; };
-		49C7B9B81042D32F0009D447 /* CanvasProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasProgram.idl; path = canvas/CanvasProgram.idl; sourceTree = "<group>"; };
-		49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderbuffer.cpp; path = canvas/CanvasRenderbuffer.cpp; sourceTree = "<group>"; };
-		49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderbuffer.h; path = canvas/CanvasRenderbuffer.h; sourceTree = "<group>"; };
-		49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderbuffer.idl; path = canvas/CanvasRenderbuffer.idl; sourceTree = "<group>"; };
+		49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLProgram.cpp; path = canvas/WebGLProgram.cpp; sourceTree = "<group>"; };
+		49C7B9B71042D32F0009D447 /* WebGLProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLProgram.h; path = canvas/WebGLProgram.h; sourceTree = "<group>"; };
+		49C7B9B81042D32F0009D447 /* WebGLProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLProgram.idl; path = canvas/WebGLProgram.idl; sourceTree = "<group>"; };
+		49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLRenderbuffer.cpp; path = canvas/WebGLRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLRenderbuffer.h; path = canvas/WebGLRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B9BB1042D32F0009D447 /* WebGLRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLRenderbuffer.idl; path = canvas/WebGLRenderbuffer.idl; sourceTree = "<group>"; };
 		49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext.cpp; path = canvas/CanvasRenderingContext.cpp; sourceTree = "<group>"; };
 		49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext.h; path = canvas/CanvasRenderingContext.h; sourceTree = "<group>"; };
 		49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext.idl; path = canvas/CanvasRenderingContext.idl; sourceTree = "<group>"; };
-		49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext3D.cpp; path = canvas/CanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
-		49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext3D.h; path = canvas/CanvasRenderingContext3D.h; sourceTree = "<group>"; };
-		49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext3D.idl; path = canvas/CanvasRenderingContext3D.idl; sourceTree = "<group>"; };
-		49C7B9C21042D32F0009D447 /* CanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShader.cpp; path = canvas/CanvasShader.cpp; sourceTree = "<group>"; };
-		49C7B9C31042D32F0009D447 /* CanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShader.h; path = canvas/CanvasShader.h; sourceTree = "<group>"; };
-		49C7B9C41042D32F0009D447 /* CanvasShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShader.idl; path = canvas/CanvasShader.idl; sourceTree = "<group>"; };
-		49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasTexture.cpp; path = canvas/CanvasTexture.cpp; sourceTree = "<group>"; };
-		49C7B9C61042D32F0009D447 /* CanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasTexture.h; path = canvas/CanvasTexture.h; sourceTree = "<group>"; };
-		49C7B9C71042D32F0009D447 /* CanvasTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasTexture.idl; path = canvas/CanvasTexture.idl; sourceTree = "<group>"; };
+		49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLRenderingContext.cpp; path = canvas/WebGLRenderingContext.cpp; sourceTree = "<group>"; };
+		49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLRenderingContext.h; path = canvas/WebGLRenderingContext.h; sourceTree = "<group>"; };
+		49C7B9C11042D32F0009D447 /* WebGLRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLRenderingContext.idl; path = canvas/WebGLRenderingContext.idl; sourceTree = "<group>"; };
+		49C7B9C21042D32F0009D447 /* WebGLShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLShader.cpp; path = canvas/WebGLShader.cpp; sourceTree = "<group>"; };
+		49C7B9C31042D32F0009D447 /* WebGLShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLShader.h; path = canvas/WebGLShader.h; sourceTree = "<group>"; };
+		49C7B9C41042D32F0009D447 /* WebGLShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLShader.idl; path = canvas/WebGLShader.idl; sourceTree = "<group>"; };
+		49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLTexture.cpp; path = canvas/WebGLTexture.cpp; sourceTree = "<group>"; };
+		49C7B9C61042D32F0009D447 /* WebGLTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLTexture.h; path = canvas/WebGLTexture.h; sourceTree = "<group>"; };
+		49C7B9C71042D32F0009D447 /* WebGLTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLTexture.idl; path = canvas/WebGLTexture.idl; sourceTree = "<group>"; };
 		49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContext3D.h; sourceTree = "<group>"; };
 		49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Canvas3DLayer.h; sourceTree = "<group>"; };
 		49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = Canvas3DLayer.mm; sourceTree = "<group>"; };
@@ -6096,77 +6154,77 @@
 		49E912A70EFAC906009D0CAF /* AnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AnimationList.cpp; path = animation/AnimationList.cpp; sourceTree = "<group>"; };
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
-		49EECDC710503C2300099FAB /* CanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArray.cpp; path = canvas/CanvasArray.cpp; sourceTree = "<group>"; };
-		49EECDC810503C2300099FAB /* CanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArray.h; path = canvas/CanvasArray.h; sourceTree = "<group>"; };
-		49EECDC910503C2300099FAB /* CanvasArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArray.idl; path = canvas/CanvasArray.idl; sourceTree = "<group>"; };
-		49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArrayBuffer.cpp; path = canvas/CanvasArrayBuffer.cpp; sourceTree = "<group>"; };
-		49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArrayBuffer.h; path = canvas/CanvasArrayBuffer.h; sourceTree = "<group>"; };
-		49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArrayBuffer.idl; path = canvas/CanvasArrayBuffer.idl; sourceTree = "<group>"; };
-		49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFloatArray.cpp; path = canvas/CanvasFloatArray.cpp; sourceTree = "<group>"; };
-		49EECDCE10503C2300099FAB /* CanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFloatArray.h; path = canvas/CanvasFloatArray.h; sourceTree = "<group>"; };
-		49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFloatArray.idl; path = canvas/CanvasFloatArray.idl; sourceTree = "<group>"; };
-		49EECDD010503C2300099FAB /* CanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasIntArray.cpp; path = canvas/CanvasIntArray.cpp; sourceTree = "<group>"; };
-		49EECDD110503C2300099FAB /* CanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasIntArray.h; path = canvas/CanvasIntArray.h; sourceTree = "<group>"; };
-		49EECDD210503C2300099FAB /* CanvasIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasIntArray.idl; path = canvas/CanvasIntArray.idl; sourceTree = "<group>"; };
-		49EECDD310503C2300099FAB /* CanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShortArray.cpp; path = canvas/CanvasShortArray.cpp; sourceTree = "<group>"; };
-		49EECDD410503C2300099FAB /* CanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShortArray.h; path = canvas/CanvasShortArray.h; sourceTree = "<group>"; };
-		49EECDD510503C2300099FAB /* CanvasShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShortArray.idl; path = canvas/CanvasShortArray.idl; sourceTree = "<group>"; };
-		49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedByteArray.cpp; path = canvas/CanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
-		49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedByteArray.h; path = canvas/CanvasUnsignedByteArray.h; sourceTree = "<group>"; };
-		49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedByteArray.idl; path = canvas/CanvasUnsignedByteArray.idl; sourceTree = "<group>"; };
-		49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedIntArray.cpp; path = canvas/CanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
-		49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedIntArray.h; path = canvas/CanvasUnsignedIntArray.h; sourceTree = "<group>"; };
-		49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedIntArray.idl; path = canvas/CanvasUnsignedIntArray.idl; sourceTree = "<group>"; };
-		49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedShortArray.cpp; path = canvas/CanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
-		49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedShortArray.h; path = canvas/CanvasUnsignedShortArray.h; sourceTree = "<group>"; };
-		49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedShortArray.idl; path = canvas/CanvasUnsignedShortArray.idl; sourceTree = "<group>"; };
-		49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBuffer.cpp; sourceTree = "<group>"; };
-		49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBuffer.h; sourceTree = "<group>"; };
-		49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArray.cpp; sourceTree = "<group>"; };
-		49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArray.h; sourceTree = "<group>"; };
-		49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArray.cpp; sourceTree = "<group>"; };
-		49EECEF7105070C400099FAB /* JSCanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArray.h; sourceTree = "<group>"; };
-		49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArray.cpp; sourceTree = "<group>"; };
-		49EECEF9105070C400099FAB /* JSCanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArray.h; sourceTree = "<group>"; };
-		49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
-		49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArray.h; sourceTree = "<group>"; };
-		49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
-		49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArray.h; sourceTree = "<group>"; };
-		49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
-		49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArray.h; sourceTree = "<group>"; };
-		49EECF19105072F300099FAB /* JSCanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArray.cpp; sourceTree = "<group>"; };
-		49EECF1A105072F300099FAB /* JSCanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArray.h; sourceTree = "<group>"; };
-		49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
-		49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBufferConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBufferConstructor.h; sourceTree = "<group>"; };
-		49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArrayConstructor.h; sourceTree = "<group>"; };
-		49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArrayConstructor.h; sourceTree = "<group>"; };
-		49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
-		49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
-		49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECDC710503C2300099FAB /* WebGLArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLArray.cpp; path = canvas/WebGLArray.cpp; sourceTree = "<group>"; };
+		49EECDC810503C2300099FAB /* WebGLArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLArray.h; path = canvas/WebGLArray.h; sourceTree = "<group>"; };
+		49EECDC910503C2300099FAB /* WebGLArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLArray.idl; path = canvas/WebGLArray.idl; sourceTree = "<group>"; };
+		49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLArrayBuffer.cpp; path = canvas/WebGLArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLArrayBuffer.h; path = canvas/WebGLArrayBuffer.h; sourceTree = "<group>"; };
+		49EECDCC10503C2300099FAB /* WebGLArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLArrayBuffer.idl; path = canvas/WebGLArrayBuffer.idl; sourceTree = "<group>"; };
+		49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLFloatArray.cpp; path = canvas/WebGLFloatArray.cpp; sourceTree = "<group>"; };
+		49EECDCE10503C2300099FAB /* WebGLFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLFloatArray.h; path = canvas/WebGLFloatArray.h; sourceTree = "<group>"; };
+		49EECDCF10503C2300099FAB /* WebGLFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLFloatArray.idl; path = canvas/WebGLFloatArray.idl; sourceTree = "<group>"; };
+		49EECDD010503C2300099FAB /* WebGLIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLIntArray.cpp; path = canvas/WebGLIntArray.cpp; sourceTree = "<group>"; };
+		49EECDD110503C2300099FAB /* WebGLIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLIntArray.h; path = canvas/WebGLIntArray.h; sourceTree = "<group>"; };
+		49EECDD210503C2300099FAB /* WebGLIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLIntArray.idl; path = canvas/WebGLIntArray.idl; sourceTree = "<group>"; };
+		49EECDD310503C2300099FAB /* WebGLShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLShortArray.cpp; path = canvas/WebGLShortArray.cpp; sourceTree = "<group>"; };
+		49EECDD410503C2300099FAB /* WebGLShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLShortArray.h; path = canvas/WebGLShortArray.h; sourceTree = "<group>"; };
+		49EECDD510503C2300099FAB /* WebGLShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLShortArray.idl; path = canvas/WebGLShortArray.idl; sourceTree = "<group>"; };
+		49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedByteArray.cpp; path = canvas/WebGLUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedByteArray.h; path = canvas/WebGLUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECDD810503C2300099FAB /* WebGLUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedByteArray.idl; path = canvas/WebGLUnsignedByteArray.idl; sourceTree = "<group>"; };
+		49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedIntArray.cpp; path = canvas/WebGLUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedIntArray.h; path = canvas/WebGLUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECDDB10503C2300099FAB /* WebGLUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedIntArray.idl; path = canvas/WebGLUnsignedIntArray.idl; sourceTree = "<group>"; };
+		49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLUnsignedShortArray.cpp; path = canvas/WebGLUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLUnsignedShortArray.h; path = canvas/WebGLUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECDDE10503C2400099FAB /* WebGLUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLUnsignedShortArray.idl; path = canvas/WebGLUnsignedShortArray.idl; sourceTree = "<group>"; };
+		49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArrayBuffer.h; sourceTree = "<group>"; };
+		49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArray.cpp; sourceTree = "<group>"; };
+		49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFloatArray.h; sourceTree = "<group>"; };
+		49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArray.cpp; sourceTree = "<group>"; };
+		49EECEF7105070C400099FAB /* JSWebGLIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLIntArray.h; sourceTree = "<group>"; };
+		49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArray.cpp; sourceTree = "<group>"; };
+		49EECEF9105070C400099FAB /* JSWebGLShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShortArray.h; sourceTree = "<group>"; };
+		49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECF19105072F300099FAB /* JSWebGLArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArray.cpp; sourceTree = "<group>"; };
+		49EECF1A105072F300099FAB /* JSWebGLArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArray.h; sourceTree = "<group>"; };
+		49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLArrayBufferConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLArrayBufferConstructor.h; sourceTree = "<group>"; };
+		49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLFloatArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLFloatArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
 		49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext.cpp; sourceTree = "<group>"; };
 		49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext.h; sourceTree = "<group>"; };
 		49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
 		49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
-		49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
-		49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderingContext.cpp; sourceTree = "<group>"; };
+		49EED1411051969400099FAB /* JSWebGLRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLRenderingContext.h; sourceTree = "<group>"; };
 		49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
-		49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3DCustom.cpp; sourceTree = "<group>"; };
+		49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = SelectionControllerMac.mm; path = mac/SelectionControllerMac.mm; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -6280,6 +6338,12 @@
 		51741D0C0B07259A00ED442C /* BackForwardList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardList.cpp; sourceTree = "<group>"; };
 		51741D0D0B07259A00ED442C /* HistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HistoryItem.h; sourceTree = "<group>"; };
 		51741D0E0B07259A00ED442C /* HistoryItem.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryItem.cpp; sourceTree = "<group>"; };
+		5174E20810A1F44F00F95E6F /* PopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PopStateEvent.h; sourceTree = "<group>"; };
+		5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PopStateEvent.idl; sourceTree = "<group>"; };
+		5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEventCustom.cpp; sourceTree = "<group>"; };
+		5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEvent.cpp; sourceTree = "<group>"; };
+		5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPopStateEvent.h; sourceTree = "<group>"; };
+		5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PopStateEvent.cpp; sourceTree = "<group>"; };
 		518A34BE1026C831001B6896 /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocket.cpp; sourceTree = "<group>"; };
 		518A34BF1026C831001B6896 /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocket.h; sourceTree = "<group>"; };
 		518A34C01026C831001B6896 /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebSocket.idl; sourceTree = "<group>"; };
@@ -6361,6 +6425,8 @@
 		54C50F7A0E801DF3009832A0 /* XMLTokenizerLibxml2.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerLibxml2.cpp; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = jni_utility_private.cpp; path = jsc/jni_utility_private.cpp; sourceTree = "<group>"; };
+		599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = jni_utility_private.h; path = jsc/jni_utility_private.h; sourceTree = "<group>"; };
 		59C77F2810545B3B00506104 /* GeolocationServiceMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GeolocationServiceMock.cpp; path = mock/GeolocationServiceMock.cpp; sourceTree = "<group>"; };
 		59C77F2910545B3B00506104 /* GeolocationServiceMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationServiceMock.h; path = mock/GeolocationServiceMock.h; sourceTree = "<group>"; };
 		5D15E3A90F9E6AC1009E0E3F /* XMLTokenizerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTokenizerScope.cpp; sourceTree = "<group>"; };
@@ -6480,6 +6546,8 @@
 		65DF323609D1DE65000BE325 /* JSCanvasPattern.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasPattern.h; sourceTree = "<group>"; };
 		65F80697054D9F86008BF776 /* BlockExceptions.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BlockExceptions.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65FEA86809833ADE00BED4AB /* Page.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Page.cpp; sourceTree = "<group>"; };
+		6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLGetInfo.cpp; path = canvas/WebGLGetInfo.cpp; sourceTree = "<group>"; };
+		6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLGetInfo.h; path = canvas/WebGLGetInfo.h; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
 		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
 		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
@@ -6497,6 +6565,22 @@
 		7693BACF106C2DCA007B0823 /* PluginHalter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginHalter.cpp; sourceTree = "<group>"; };
 		7693BAD0106C2DCA007B0823 /* PluginHalter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalter.h; sourceTree = "<group>"; };
 		7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalterClient.h; sourceTree = "<group>"; };
+		79AC9216109945C80021266E /* JSCompositionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCompositionEvent.cpp; sourceTree = "<group>"; };
+		79AC9217109945C80021266E /* JSCompositionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCompositionEvent.h; sourceTree = "<group>"; };
+		79F2F59E1091939A000D87CB /* CompositionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CompositionEvent.cpp; sourceTree = "<group>"; };
+		79F2F59F1091939A000D87CB /* CompositionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompositionEvent.h; sourceTree = "<group>"; };
+		79F2F5A01091939A000D87CB /* CompositionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CompositionEvent.idl; sourceTree = "<group>"; };
+		7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHostCustom.cpp; sourceTree = "<group>"; };
+		7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHost.cpp; sourceTree = "<group>"; };
+		7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInjectedScriptHost.h; sourceTree = "<group>"; };
+		7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptHost.cpp; sourceTree = "<group>"; };
+		7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptHost.h; sourceTree = "<group>"; };
+		7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InjectedScriptHost.idl; sourceTree = "<group>"; };
+		7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendHost.cpp; sourceTree = "<group>"; };
+		7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendHost.h; sourceTree = "<group>"; };
+		7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InspectorFrontendHost.idl; sourceTree = "<group>"; };
+		7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorFrontendHost.cpp; sourceTree = "<group>"; };
+		7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInspectorFrontendHost.h; sourceTree = "<group>"; };
 		7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArray.cpp; sourceTree = "<group>"; };
 		7A1E88F4101CC384000C4DF5 /* ScriptArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArray.h; sourceTree = "<group>"; };
 		7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMAgent.cpp; sourceTree = "<group>"; };
@@ -6506,7 +6590,8 @@
 		7A74ECB61018399A00BF939E /* InspectorBackend.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InspectorBackend.idl; sourceTree = "<group>"; };
 		7A74ECB8101839A500BF939E /* InspectorBackend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackend.cpp; sourceTree = "<group>"; };
 		7A74ECB9101839A600BF939E /* InspectorBackend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackend.h; sourceTree = "<group>"; };
-		7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorBackendCustom.cpp; sourceTree = "<group>"; };
+		7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorFrontendHostCustom.cpp; sourceTree = "<group>"; };
+		7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContextMenuSelectionHandler.h; sourceTree = "<group>"; };
 		7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
 		84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFEMorphologyElement.cpp; sourceTree = "<group>"; };
@@ -7481,6 +7566,7 @@
 		938192020F87E1E600D5352A /* BinaryPropertyList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BinaryPropertyList.cpp; sourceTree = "<group>"; };
 		938192040F87E1EC00D5352A /* BinaryPropertyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BinaryPropertyList.h; sourceTree = "<group>"; };
 		9382AAB10D8C386100F357A6 /* NodeWithIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeWithIndex.h; sourceTree = "<group>"; };
+		9382DF5710A8D5C900925652 /* ColorSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorSpace.h; sourceTree = "<group>"; };
 		93831B560D087D6000E5C984 /* ExceptionCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionCode.cpp; sourceTree = "<group>"; };
 		938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLElementWrapperFactory.h; sourceTree = "<group>"; };
 		938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLElementWrapperFactory.cpp; sourceTree = "<group>"; };
@@ -7624,10 +7710,10 @@
 		A7CFB3D00B7ED10A0070C32D /* DragImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DragImage.h; sourceTree = "<group>"; };
 		A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DragImageMac.mm; sourceTree = "<group>"; };
 		A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImageDataCustom.cpp; sourceTree = "<group>"; };
-		A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasActiveInfo.idl; path = canvas/CanvasActiveInfo.idl; sourceTree = "<group>"; };
-		A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasActiveInfo.cpp; sourceTree = "<group>"; };
-		A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasActiveInfo.h; sourceTree = "<group>"; };
-		A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasActiveInfo.h; path = canvas/CanvasActiveInfo.h; sourceTree = "<group>"; };
+		A7D20F3B107F373800A80392 /* WebGLActiveInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLActiveInfo.idl; path = canvas/WebGLActiveInfo.idl; sourceTree = "<group>"; };
+		A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLActiveInfo.cpp; sourceTree = "<group>"; };
+		A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLActiveInfo.h; sourceTree = "<group>"; };
+		A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLActiveInfo.h; path = canvas/WebGLActiveInfo.h; sourceTree = "<group>"; };
 		A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFETile.cpp; sourceTree = "<group>"; };
 		A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardHelper.h; sourceTree = "<group>"; };
 		A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerScriptLoader.h; path = workers/WorkerScriptLoader.h; sourceTree = "<group>"; };
@@ -8223,6 +8309,7 @@
 		AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = BeforeTextInsertedEvent.h; sourceTree = "<group>"; };
 		AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSlider.cpp; sourceTree = "<group>"; };
 		AB247A6B0AFD6383003FA5FD /* RenderSlider.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSlider.h; sourceTree = "<group>"; };
+		AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LineClampValue.h; path = style/LineClampValue.h; sourceTree = "<group>"; };
 		AB40484B0E083FA8007D6920 /* MediaDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaDocument.cpp; sourceTree = "<group>"; };
 		AB40484C0E083FA8007D6920 /* MediaDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaDocument.h; sourceTree = "<group>"; };
 		AB4261D70A2F6C9700BDD17D /* missingImage.tiff */ = {isa = PBXFileReference; lastKnownFileType = image.tiff; path = missingImage.tiff; sourceTree = "<group>"; };
@@ -9259,8 +9346,6 @@
 		BC491B4E0C023E2D009D6316 /* HTMLMarqueeElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMarqueeElement.idl; sourceTree = "<group>"; };
 		BC491B760C023EFD009D6316 /* JSHTMLMarqueeElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLMarqueeElement.cpp; sourceTree = "<group>"; };
 		BC491B770C023EFD009D6316 /* JSHTMLMarqueeElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLMarqueeElement.h; sourceTree = "<group>"; };
-		BC4BF9E20D11E133007D247F /* ClassNames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ClassNames.cpp; sourceTree = "<group>"; };
-		BC4BF9E30D11E133007D247F /* ClassNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassNames.h; sourceTree = "<group>"; };
 		BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLAppletElementCustom.cpp; sourceTree = "<group>"; };
 		BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLMarqueeElement.h; sourceTree = "<group>"; };
 		BC5156E60C03B741008BB0EE /* DOMHTMLMarqueeElement.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLMarqueeElement.mm; sourceTree = "<group>"; };
@@ -9705,6 +9790,8 @@
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
+		D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpaceSplitString.cpp; sourceTree = "<group>"; };
+		D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpaceSplitString.h; sourceTree = "<group>"; };
 		D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FormatBlockCommand.cpp; sourceTree = "<group>"; };
 		D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FormatBlockCommand.h; sourceTree = "<group>"; };
 		D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoveFormatCommand.h; sourceTree = "<group>"; };
@@ -9744,6 +9831,7 @@
 		E10B9CCB0B747A44003ED890 /* DOMCustomXPathNSResolver.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMCustomXPathNSResolver.mm; sourceTree = "<group>"; };
 		E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptExecutionContext.h; sourceTree = "<group>"; };
 		E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptExecutionContext.cpp; sourceTree = "<group>"; };
+		E124748310AA161D00B79493 /* AuthenticationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationClient.h; sourceTree = "<group>"; };
 		E12719C60EEEC16800F61213 /* NavigatorBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorBase.h; sourceTree = "<group>"; };
 		E12719C90EEEC21300F61213 /* NavigatorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorBase.cpp; sourceTree = "<group>"; };
 		E1271A0A0EEEC77A00F61213 /* WorkerNavigator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerNavigator.h; sourceTree = "<group>"; };
@@ -9780,6 +9868,7 @@
 		E1ADEDD40E76BD60004A1A5E /* DOMMessagePortInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMMessagePortInternal.h; sourceTree = "<group>"; };
 		E1ADEDD80E76BD93004A1A5E /* JSMessagePort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessagePort.h; sourceTree = "<group>"; };
 		E1ADEDD90E76BD93004A1A5E /* JSMessagePort.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessagePort.cpp; sourceTree = "<group>"; };
+		E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CredentialStorageMac.mm; sourceTree = "<group>"; };
 		E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTUnicodeSort.cpp; sourceTree = "<group>"; };
 		E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSLTUnicodeSort.h; sourceTree = "<group>"; };
 		E1C362ED0EAF2AA9007410BC /* JSWorkerLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerLocation.h; sourceTree = "<group>"; };
@@ -9879,6 +9968,8 @@
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
 		EDEC98020AED7E170059137F /* WebCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCorePrefix.h; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OpenTypeSanitizer.cpp; path = opentype/OpenTypeSanitizer.cpp; sourceTree = "<group>"; };
+		F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OpenTypeSanitizer.h; path = opentype/OpenTypeSanitizer.h; sourceTree = "<group>"; };
 		F523D23B02DE4396018635CA /* HTMLDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDocument.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23C02DE4396018635CA /* HTMLDocument.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDocument.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F523D23E02DE4396018635CA /* HTMLElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -9916,6 +10007,8 @@
 		F5C2869302846DCD018635CA /* ApplicationServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ApplicationServices.framework; path = /System/Library/Frameworks/ApplicationServices.framework; sourceTree = "<absolute>"; };
 		F5C2869402846DCD018635CA /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = /System/Library/Frameworks/Carbon.framework; sourceTree = "<absolute>"; };
 		F5C2869502846DCD018635CA /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
+		F5D3A57A106B83B300545297 /* ISODateTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ISODateTime.cpp; sourceTree = "<group>"; };
+		F5D3A57B106B83B300545297 /* ISODateTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ISODateTime.h; sourceTree = "<group>"; };
 		F8216299029F4FB501000131 /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXMLHttpRequestProgressEvent.cpp; sourceTree = "<group>"; };
 		F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
@@ -10187,6 +10280,7 @@
 		1A569CCE0D7E2B82007C3983 /* jni */ = {
 			isa = PBXGroup;
 			children = (
+				599D1E2F10C97D4C00E0EF12 /* jsc */,
 				1A569CCF0D7E2B82007C3983 /* jni_class.cpp */,
 				1A569CD00D7E2B82007C3983 /* jni_class.h */,
 				1A569CD10D7E2B82007C3983 /* jni_instance.cpp */,
@@ -10345,8 +10439,12 @@
 		1C5FAECA0DCFD8C900D58F78 /* Inspector */ = {
 			isa = PBXGroup;
 			children = (
+				7A0E76D810BF059800A0276E /* JSInjectedScriptHost.cpp */,
+				7A0E76D910BF059800A0276E /* JSInjectedScriptHost.h */,
 				41F060CB0F5EEB2B00A07EAC /* JSInspectorBackend.cpp */,
 				41F060CC0F5EEB2B00A07EAC /* JSInspectorBackend.h */,
+				7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */,
+				7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */,
 				1C5FAECF0DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp */,
 				1C5FAED00DCFD90100D58F78 /* JSJavaScriptCallFrame.h */,
 			);
@@ -10359,6 +10457,9 @@
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
+				7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */,
+				7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */,
+				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
 				7A74ECB8101839A500BF939E /* InspectorBackend.cpp */,
 				7A74ECB9101839A600BF939E /* InspectorBackend.h */,
 				7A74ECB61018399A00BF939E /* InspectorBackend.idl */,
@@ -10373,6 +10474,9 @@
 				41F061720F5F00AC00A07EAC /* InspectorDOMStorageResource.h */,
 				7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */,
 				7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */,
+				7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */,
+				7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */,
+				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
 				41F062000F5F0B6600A07EAC /* InspectorResource.cpp */,
 				41F061FF0F5F0B6600A07EAC /* InspectorResource.h */,
 				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
@@ -10583,32 +10687,34 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
-				A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */,
-				A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */,
-				49EECDC710503C2300099FAB /* CanvasArray.cpp */,
-				49EECDC810503C2300099FAB /* CanvasArray.h */,
-				49EECDC910503C2300099FAB /* CanvasArray.idl */,
-				49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */,
-				49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */,
-				49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */,
-				49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */,
-				49C7B9A91042D32E0009D447 /* CanvasBuffer.h */,
-				49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */,
-				49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */,
-				49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */,
-				49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */,
-				49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */,
-				49EECDCE10503C2300099FAB /* CanvasFloatArray.h */,
-				49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */,
-				49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */,
-				49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */,
-				49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */,
+				A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */,
+				A7D20F3B107F373800A80392 /* WebGLActiveInfo.idl */,
+				49EECDC710503C2300099FAB /* WebGLArray.cpp */,
+				49EECDC810503C2300099FAB /* WebGLArray.h */,
+				49EECDC910503C2300099FAB /* WebGLArray.idl */,
+				49EECDCA10503C2300099FAB /* WebGLArrayBuffer.cpp */,
+				49EECDCB10503C2300099FAB /* WebGLArrayBuffer.h */,
+				49EECDCC10503C2300099FAB /* WebGLArrayBuffer.idl */,
+				49C7B9A81042D32E0009D447 /* WebGLBuffer.cpp */,
+				49C7B9A91042D32E0009D447 /* WebGLBuffer.h */,
+				49C7B9AA1042D32E0009D447 /* WebGLBuffer.idl */,
+				49C7B9AB1042D32E0009D447 /* WebGLByteArray.cpp */,
+				49C7B9AC1042D32E0009D447 /* WebGLByteArray.h */,
+				49C7B9AD1042D32E0009D447 /* WebGLByteArray.idl */,
+				49EECDCD10503C2300099FAB /* WebGLFloatArray.cpp */,
+				49EECDCE10503C2300099FAB /* WebGLFloatArray.h */,
+				49EECDCF10503C2300099FAB /* WebGLFloatArray.idl */,
+				49C7B9AE1042D32E0009D447 /* WebGLFramebuffer.cpp */,
+				49C7B9AF1042D32E0009D447 /* WebGLFramebuffer.h */,
+				49C7B9B01042D32E0009D447 /* WebGLFramebuffer.idl */,
+				6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */,
+				6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */,
 				49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */,
 				49484FB4102CF23C00187DD3 /* CanvasGradient.h */,
 				49484FB5102CF23C00187DD3 /* CanvasGradient.idl */,
-				49EECDD010503C2300099FAB /* CanvasIntArray.cpp */,
-				49EECDD110503C2300099FAB /* CanvasIntArray.h */,
-				49EECDD210503C2300099FAB /* CanvasIntArray.idl */,
+				49EECDD010503C2300099FAB /* WebGLIntArray.cpp */,
+				49EECDD110503C2300099FAB /* WebGLIntArray.h */,
+				49EECDD210503C2300099FAB /* WebGLIntArray.idl */,
 				49C7B9B41042D32F0009D447 /* CanvasObject.cpp */,
 				49C7B9B51042D32F0009D447 /* CanvasObject.h */,
 				49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */,
@@ -10617,41 +10723,44 @@
 				49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */,
 				49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */,
 				49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */,
-				49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */,
-				49C7B9B71042D32F0009D447 /* CanvasProgram.h */,
-				49C7B9B81042D32F0009D447 /* CanvasProgram.idl */,
-				49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */,
-				49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */,
-				49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */,
+				49C7B9B61042D32F0009D447 /* WebGLProgram.cpp */,
+				49C7B9B71042D32F0009D447 /* WebGLProgram.h */,
+				49C7B9B81042D32F0009D447 /* WebGLProgram.idl */,
+				49C7B9B91042D32F0009D447 /* WebGLRenderbuffer.cpp */,
+				49C7B9BA1042D32F0009D447 /* WebGLRenderbuffer.h */,
+				49C7B9BB1042D32F0009D447 /* WebGLRenderbuffer.idl */,
 				49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */,
 				49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */,
 				49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */,
 				49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */,
 				49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */,
 				49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */,
-				49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */,
-				49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */,
-				49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */,
-				49C7B9C21042D32F0009D447 /* CanvasShader.cpp */,
-				49C7B9C31042D32F0009D447 /* CanvasShader.h */,
-				49C7B9C41042D32F0009D447 /* CanvasShader.idl */,
-				49EECDD310503C2300099FAB /* CanvasShortArray.cpp */,
-				49EECDD410503C2300099FAB /* CanvasShortArray.h */,
-				49EECDD510503C2300099FAB /* CanvasShortArray.idl */,
+				49C7B9BF1042D32F0009D447 /* WebGLRenderingContext.cpp */,
+				49C7B9C01042D32F0009D447 /* WebGLRenderingContext.h */,
+				49C7B9C11042D32F0009D447 /* WebGLRenderingContext.idl */,
+				49C7B9C21042D32F0009D447 /* WebGLShader.cpp */,
+				49C7B9C31042D32F0009D447 /* WebGLShader.h */,
+				49C7B9C41042D32F0009D447 /* WebGLShader.idl */,
+				49EECDD310503C2300099FAB /* WebGLShortArray.cpp */,
+				49EECDD410503C2300099FAB /* WebGLShortArray.h */,
+				49EECDD510503C2300099FAB /* WebGLShortArray.idl */,
 				49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */,
 				49484FC0102CF23C00187DD3 /* CanvasStyle.h */,
-				49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */,
-				49C7B9C61042D32F0009D447 /* CanvasTexture.h */,
-				49C7B9C71042D32F0009D447 /* CanvasTexture.idl */,
-				49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */,
-				49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */,
-				49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */,
-				49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */,
-				49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */,
-				49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */,
-				49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */,
-				49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */,
-				49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */,
+				49C7B9C51042D32F0009D447 /* WebGLTexture.cpp */,
+				49C7B9C61042D32F0009D447 /* WebGLTexture.h */,
+				49C7B9C71042D32F0009D447 /* WebGLTexture.idl */,
+				0C3F1F5710C8871200D72CE1 /* WebGLUniformLocation.cpp */,
+				0C3F1F5810C8871200D72CE1 /* WebGLUniformLocation.h */,
+				0C3F1F5910C8871200D72CE1 /* WebGLUniformLocation.idl */,
+				49EECDD610503C2300099FAB /* WebGLUnsignedByteArray.cpp */,
+				49EECDD710503C2300099FAB /* WebGLUnsignedByteArray.h */,
+				49EECDD810503C2300099FAB /* WebGLUnsignedByteArray.idl */,
+				49EECDD910503C2300099FAB /* WebGLUnsignedIntArray.cpp */,
+				49EECDDA10503C2300099FAB /* WebGLUnsignedIntArray.h */,
+				49EECDDB10503C2300099FAB /* WebGLUnsignedIntArray.idl */,
+				49EECDDC10503C2300099FAB /* WebGLUnsignedShortArray.cpp */,
+				49EECDDD10503C2400099FAB /* WebGLUnsignedShortArray.h */,
+				49EECDDE10503C2400099FAB /* WebGLUnsignedShortArray.idl */,
 			);
 			name = canvas;
 			sourceTree = "<group>";
@@ -10874,6 +10983,15 @@
 			path = websockets;
 			sourceTree = "<group>";
 		};
+		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
+			isa = PBXGroup;
+			children = (
+				599D1E3010C97D6E00E0EF12 /* jni_utility_private.cpp */,
+				599D1E3110C97D6E00E0EF12 /* jni_utility_private.h */,
+			);
+			name = jsc;
+			sourceTree = "<group>";
+		};
 		59C77F101054591C00506104 /* mock */ = {
 			isa = PBXGroup;
 			children = (
@@ -10974,6 +11092,7 @@
 				656B84E70AEA1DAE00A095B4 /* mac */,
 				934F71370D5A6EFF00018D69 /* AuthenticationChallengeBase.cpp */,
 				934F71390D5A6F1000018D69 /* AuthenticationChallengeBase.h */,
+				E124748310AA161D00B79493 /* AuthenticationClient.h */,
 				514C76580CE923A1007EF3CD /* Credential.cpp */,
 				514C76590CE923A1007EF3CD /* Credential.h */,
 				51A052321058774F00CC9E95 /* CredentialStorage.cpp */,
@@ -11017,6 +11136,7 @@
 				934F71430D5A6F5300018D69 /* AuthenticationChallenge.h */,
 				514C76420CE9234E007EF3CD /* AuthenticationMac.h */,
 				514C76430CE9234E007EF3CD /* AuthenticationMac.mm */,
+				E1B4CD2410B322E200BFFD7E /* CredentialStorageMac.mm */,
 				514C76440CE9234E007EF3CD /* FormDataStreamMac.h */,
 				514C76450CE9234E007EF3CD /* FormDataStreamMac.mm */,
 				1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */,
@@ -11121,6 +11241,7 @@
 				065AD4F20B0C2EDA005A2B1D /* ContextMenuClient.h */,
 				065AD4F30B0C2EDA005A2B1D /* ContextMenuController.cpp */,
 				065AD4F40B0C2EDA005A2B1D /* ContextMenuController.h */,
+				7ADE722510CBBB9B006B3B3A /* ContextMenuSelectionHandler.h */,
 				FE6FD4850F676E5700092873 /* Coordinates.h */,
 				FE6FD4860F676E5700092873 /* Coordinates.idl */,
 				BC5A86810C33676000EEA649 /* DOMSelection.cpp */,
@@ -11964,6 +12085,7 @@
 				85DF81230AA7787200486AD7 /* DOMHTMLImageElement.h */,
 				85DF81240AA7787200486AD7 /* DOMHTMLImageElement.mm */,
 				85F32AE40AA63B8700FF3184 /* DOMHTMLInputElement.h */,
+				1CCA732110ADD43E00FD440D /* DOMHTMLInputElementPrivate.h */,
 				85F32AE50AA63B8700FF3184 /* DOMHTMLInputElement.mm */,
 				859A9C410AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.h */,
 				859A9C420AA5E3BD00B694B2 /* DOMHTMLIsIndexElement.mm */,
@@ -12702,6 +12824,8 @@
 				E446139A0CD6331000FADA75 /* HTMLVideoElement.idl */,
 				BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */,
 				BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */,
+				F5D3A57A106B83B300545297 /* ISODateTime.cpp */,
+				F5D3A57B106B83B300545297 /* ISODateTime.h */,
 				A77979130D6B9D0C003851B9 /* ImageData.cpp */,
 				A77979140D6B9D0C003851B9 /* ImageData.h */,
 				A77979150D6B9D0C003851B9 /* ImageData.idl */,
@@ -12752,48 +12876,50 @@
 		A83B79080CCAFF2B000B0825 /* HTML */ = {
 			isa = PBXGroup;
 			children = (
-				A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */,
-				A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */,
-				49EECF19105072F300099FAB /* JSCanvasArray.cpp */,
-				49EECF1A105072F300099FAB /* JSCanvasArray.h */,
-				49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */,
-				49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */,
-				49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */,
-				49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */,
-				49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */,
-				49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */,
-				49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */,
-				49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */,
-				49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */,
-				49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */,
+				A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */,
+				A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */,
+				49EECF19105072F300099FAB /* JSWebGLArray.cpp */,
+				49EECF1A105072F300099FAB /* JSWebGLArray.h */,
+				49EECEF2105070C400099FAB /* JSWebGLArrayBuffer.cpp */,
+				49EECEF3105070C400099FAB /* JSWebGLArrayBuffer.h */,
+				49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */,
+				49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */,
+				49C7B9821042D2D30009D447 /* JSWebGLByteArray.cpp */,
+				49C7B9831042D2D30009D447 /* JSWebGLByteArray.h */,
+				49EECEF4105070C400099FAB /* JSWebGLFloatArray.cpp */,
+				49EECEF5105070C400099FAB /* JSWebGLFloatArray.h */,
+				49C7B9841042D2D30009D447 /* JSWebGLFramebuffer.cpp */,
+				49C7B9851042D2D30009D447 /* JSWebGLFramebuffer.h */,
 				65DF323309D1DE65000BE325 /* JSCanvasGradient.cpp */,
 				65DF323409D1DE65000BE325 /* JSCanvasGradient.h */,
-				49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */,
-				49EECEF7105070C400099FAB /* JSCanvasIntArray.h */,
+				49EECEF6105070C400099FAB /* JSWebGLIntArray.cpp */,
+				49EECEF7105070C400099FAB /* JSWebGLIntArray.h */,
 				65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */,
 				65DF323609D1DE65000BE325 /* JSCanvasPattern.h */,
-				49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */,
-				49C7B9891042D2D30009D447 /* JSCanvasProgram.h */,
-				49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */,
-				49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */,
+				49C7B9881042D2D30009D447 /* JSWebGLProgram.cpp */,
+				49C7B9891042D2D30009D447 /* JSWebGLProgram.h */,
+				49C7B98A1042D2D30009D447 /* JSWebGLRenderbuffer.cpp */,
+				49C7B98B1042D2D30009D447 /* JSWebGLRenderbuffer.h */,
 				49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */,
 				49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */,
 				49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */,
 				49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */,
-				49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */,
-				49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */,
-				49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */,
-				49C7B9901042D2D30009D447 /* JSCanvasShader.h */,
-				49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */,
-				49EECEF9105070C400099FAB /* JSCanvasShortArray.h */,
-				49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */,
-				49C7B9921042D2D30009D447 /* JSCanvasTexture.h */,
-				49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */,
-				49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */,
-				49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */,
-				49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */,
-				49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */,
-				49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */,
+				49EED1401051969400099FAB /* JSWebGLRenderingContext.cpp */,
+				49EED1411051969400099FAB /* JSWebGLRenderingContext.h */,
+				49C7B98F1042D2D30009D447 /* JSWebGLShader.cpp */,
+				49C7B9901042D2D30009D447 /* JSWebGLShader.h */,
+				49EECEF8105070C400099FAB /* JSWebGLShortArray.cpp */,
+				49EECEF9105070C400099FAB /* JSWebGLShortArray.h */,
+				49C7B9911042D2D30009D447 /* JSWebGLTexture.cpp */,
+				49C7B9921042D2D30009D447 /* JSWebGLTexture.h */,
+				0C45342510CDBBFA00869157 /* JSWebGLUniformLocation.cpp */,
+				0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */,
+				49EECEFA105070C400099FAB /* JSWebGLUnsignedByteArray.cpp */,
+				49EECEFB105070C400099FAB /* JSWebGLUnsignedByteArray.h */,
+				49EECEFC105070C400099FAB /* JSWebGLUnsignedIntArray.cpp */,
+				49EECEFD105070C400099FAB /* JSWebGLUnsignedIntArray.h */,
+				49EECEFE105070C400099FAB /* JSWebGLUnsignedShortArray.cpp */,
+				49EECEFF105070C400099FAB /* JSWebGLUnsignedShortArray.h */,
 				BC77D1650FF19F550070887B /* JSDataGridColumn.cpp */,
 				BC77D1660FF19F550070887B /* JSDataGridColumn.h */,
 				BC77D1670FF19F550070887B /* JSDataGridColumnList.cpp */,
@@ -13367,6 +13493,8 @@
 			children = (
 				BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */,
 				BC946347107A936600857193 /* JSBeforeLoadEvent.h */,
+				79AC9216109945C80021266E /* JSCompositionEvent.cpp */,
+				79AC9217109945C80021266E /* JSCompositionEvent.h */,
 				2ECF7ADA10162B3800427DE7 /* JSErrorEvent.cpp */,
 				2ECF7ADB10162B3800427DE7 /* JSErrorEvent.h */,
 				14E8378309F85D1C00B85AE4 /* JSEvent.cpp */,
@@ -13389,6 +13517,8 @@
 				1A0D573F0A5C7867007EDD4C /* JSOverflowEvent.h */,
 				E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */,
 				E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,
+				5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */,
+				5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */,
 				933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
 				933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
 				A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */,
@@ -14002,17 +14132,18 @@
 				49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */,
 				EDE3A4FF0C7A430600956A37 /* ColorMac.h */,
 				B275354A0B053814002CE64F /* ColorMac.mm */,
-				3724CA550E68A7E400DB4384 /* CoreTextController.cpp */,
-				3724CA540E68A7E400DB4384 /* CoreTextController.h */,
+				37C2360E1097EE7700EF9F72 /* ComplexTextController.cpp */,
+				37C2360F1097EE7700EF9F72 /* ComplexTextController.h */,
+				37C2381F1098C84200EF9F72 /* ComplexTextControllerATSUI.cpp */,
+				37C238201098C84200EF9F72 /* ComplexTextControllerCoreText.cpp */,
 				B275354B0B053814002CE64F /* FloatPointMac.mm */,
 				B275354C0B053814002CE64F /* FloatRectMac.mm */,
 				B275354D0B053814002CE64F /* FloatSizeMac.mm */,
 				B2AFFC740D00A5C10030074D /* FontCacheMac.mm */,
+				37C2360A1097EDED00EF9F72 /* FontComplexTextMac.cpp */,
 				B2AFFC750D00A5C10030074D /* FontCustomPlatformData.cpp */,
 				B2AFFC760D00A5C10030074D /* FontCustomPlatformData.h */,
 				B2AFFC780D00A5C10030074D /* FontMac.mm */,
-				3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */,
-				3724CA7D0E68B20500DB4384 /* FontMacCoreText.cpp */,
 				B2AFFC790D00A5C10030074D /* FontPlatformData.h */,
 				B2AFFC7A0D00A5C10030074D /* FontPlatformDataMac.mm */,
 				B2AFFC7B0D00A5C10030074D /* GlyphPageTreeNodeMac.cpp */,
@@ -14040,6 +14171,7 @@
 		B2A015910AF6CD53006BCE0E /* graphics */ = {
 			isa = PBXGroup;
 			children = (
+				F4EAF4AB10C74268009100D3 /* opentype */,
 				B27535290B053814002CE64F /* cg */,
 				A75E8B7F0E1DE2B0007F2481 /* filters */,
 				B27535490B053814002CE64F /* mac */,
@@ -14048,6 +14180,7 @@
 				A89943260B42338700D7C802 /* BitmapImage.h */,
 				B27535380B053814002CE64F /* Color.cpp */,
 				B27535390B053814002CE64F /* Color.h */,
+				9382DF5710A8D5C900925652 /* ColorSpace.h */,
 				A8CB41020E85B8A50032C4F0 /* DashArray.h */,
 				B275353A0B053814002CE64F /* FloatPoint.cpp */,
 				B275353B0B053814002CE64F /* FloatPoint.h */,
@@ -14304,8 +14437,6 @@
 				934CC1160EDCAC7300A658F2 /* ScriptInstance.h */,
 				41F066E30F64BCF600A07EAC /* ScriptObject.cpp */,
 				41F066E20F64BCF600A07EAC /* ScriptObject.h */,
-				412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */,
-				419536500F68222400D0C679 /* ScriptObjectQuarantine.h */,
 				934CC1090EDB223900A658F2 /* ScriptSourceCode.h */,
 				CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */,
 				4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */,
@@ -14373,17 +14504,17 @@
 			children = (
 				415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */,
 				BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
-				492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */,
-				49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */,
-				49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */,
-				49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */,
+				492273A21083B3B100EE5C84 /* JSWebGLArrayCustom.cpp */,
+				49EECF7110508D9C00099FAB /* JSWebGLByteArrayCustom.cpp */,
+				49EECF7210508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp */,
+				49EECF7310508D9C00099FAB /* JSWebGLIntArrayCustom.cpp */,
 				49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */,
-				49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */,
+				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
 				49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */,
-				49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */,
-				49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */,
-				49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */,
-				49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */,
+				49EECF7410508D9C00099FAB /* JSWebGLShortArrayCustom.cpp */,
+				49EECF7510508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp */,
+				49EECF7610508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp */,
+				49EECF7710508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
@@ -14445,7 +14576,8 @@
 				BC17F9650B64EBB8004A65CB /* JSHTMLSelectElementCustom.cpp */,
 				AB4CB4EA0B8BDA3D009F40B0 /* JSHTMLSelectElementCustom.h */,
 				A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */,
-				7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */,
+				7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */,
+				7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */,
 				1C5FAEE60DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp */,
 				BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */,
 				E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */,
@@ -14461,6 +14593,7 @@
 				BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */,
 				A9C6E64A0D7465E7006442E9 /* JSPluginArrayCustom.cpp */,
 				A9C6E64B0D7465E7006442E9 /* JSPluginCustom.cpp */,
+				5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */,
 				51DCE8010CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp */,
 				1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */,
 				51D0C5150DAA90B7003B3831 /* JSStorageCustom.cpp */,
@@ -14506,6 +14639,7 @@
 				BC5EB69D0E81DAEB00B25965 /* FillLayer.h */,
 				BC5EBA0E0E823E4700B25965 /* KeyframeList.cpp */,
 				BC5EBA0F0E823E4700B25965 /* KeyframeList.h */,
+				AB31C91D10AE1B8E000C7B92 /* LineClampValue.h */,
 				BCEF43DF0E674110001C1287 /* NinePieceImage.cpp */,
 				BCEF43DC0E674012001C1287 /* NinePieceImage.h */,
 				BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */,
@@ -14745,22 +14879,22 @@
 			children = (
 				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
 				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
-				49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */,
-				49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */,
-				49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */,
-				49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */,
-				49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */,
-				49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */,
-				49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */,
-				49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */,
-				49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */,
-				49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */,
-				49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */,
-				49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */,
-				49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */,
-				49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */,
-				49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */,
-				49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */,
+				49EECF991050938200099FAB /* JSWebGLArrayBufferConstructor.cpp */,
+				49EECF9A1050938200099FAB /* JSWebGLArrayBufferConstructor.h */,
+				49EECF9B1050938200099FAB /* JSWebGLByteArrayConstructor.cpp */,
+				49EECF9C1050938200099FAB /* JSWebGLByteArrayConstructor.h */,
+				49EECF9D1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp */,
+				49EECF9E1050938200099FAB /* JSWebGLFloatArrayConstructor.h */,
+				49EECF9F1050938200099FAB /* JSWebGLIntArrayConstructor.cpp */,
+				49EECFA01050938200099FAB /* JSWebGLIntArrayConstructor.h */,
+				49EECFA31050938200099FAB /* JSWebGLShortArrayConstructor.cpp */,
+				49EECFA41050938200099FAB /* JSWebGLShortArrayConstructor.h */,
+				49EECFA51050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp */,
+				49EECFA61050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h */,
+				49EECFA71050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp */,
+				49EECFA81050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h */,
+				49EECFA91050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp */,
+				49EECFAA1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h */,
 				E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */,
 				E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */,
 				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
@@ -15021,6 +15155,15 @@
 			name = mac;
 			sourceTree = "<group>";
 		};
+		F4EAF4AB10C74268009100D3 /* opentype */ = {
+			isa = PBXGroup;
+			children = (
+				F4EAF4AC10C742B1009100D3 /* OpenTypeSanitizer.cpp */,
+				F4EAF4AD10C742B1009100D3 /* OpenTypeSanitizer.h */,
+			);
+			name = opentype;
+			sourceTree = "<group>";
+		};
 		F523D18402DE42E8018635CA /* css */ = {
 			isa = PBXGroup;
 			children = (
@@ -15312,6 +15455,14 @@
 				A871DFDF0A15376B00B12A68 /* RenderReplaced.h */,
 				BCA846D40DC67A350026C309 /* RenderReplica.cpp */,
 				BCA846D50DC67A350026C309 /* RenderReplica.h */,
+				1479FAE5109AE37500DED655 /* RenderRuby.cpp */,
+				1479FAE6109AE37500DED655 /* RenderRuby.h */,
+				1479FAE7109AE37500DED655 /* RenderRubyBase.cpp */,
+				1479FAE8109AE37500DED655 /* RenderRubyBase.h */,
+				1479FAE9109AE37500DED655 /* RenderRubyRun.cpp */,
+				1479FAEA109AE37500DED655 /* RenderRubyRun.h */,
+				1479FAEB109AE37500DED655 /* RenderRubyText.cpp */,
+				1479FAEC109AE37500DED655 /* RenderRubyText.h */,
 				BC3BE9900E9C1C7C00835588 /* RenderScrollbar.cpp */,
 				BC3BE9910E9C1C7C00835588 /* RenderScrollbar.h */,
 				BC3BE9AA0E9C242000835588 /* RenderScrollbarPart.cpp */,
@@ -15436,8 +15587,6 @@
 				93F925410F7EF5B8007E37C9 /* CheckedRadioButtons.h */,
 				A818721A0977D3C0005826D9 /* ChildNodeList.cpp */,
 				A81872150977D3C0005826D9 /* ChildNodeList.h */,
-				BC4BF9E20D11E133007D247F /* ClassNames.cpp */,
-				BC4BF9E30D11E133007D247F /* ClassNames.h */,
 				BC904B720D10998F00680D32 /* ClassNodeList.cpp */,
 				BC904B730D10998F00680D32 /* ClassNodeList.h */,
 				BCC065770F3CE1B700CD2D87 /* ClientRect.cpp */,
@@ -15455,6 +15604,9 @@
 				6550B697099DF0270090D781 /* Comment.cpp */,
 				6550B698099DF0270090D781 /* Comment.h */,
 				85089CC70A98C22600A275AA /* Comment.idl */,
+				79F2F59E1091939A000D87CB /* CompositionEvent.cpp */,
+				79F2F59F1091939A000D87CB /* CompositionEvent.h */,
+				79F2F5A01091939A000D87CB /* CompositionEvent.idl */,
 				A81872140977D3C0005826D9 /* ContainerNode.cpp */,
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				A8C4A7F809D563270003AC8D /* CSSMappedAttributeDeclaration.cpp */,
@@ -15573,6 +15725,9 @@
 				E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */,
 				41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */,
 				41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */,
+				5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */,
+				5174E20810A1F44F00F95E6F /* PopStateEvent.h */,
+				5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */,
 				BE91FC8C06133666005E3790 /* Position.cpp */,
 				BE91FC8B06133666005E3790 /* Position.h */,
 				37919C210B7D188600A56998 /* PositionIterator.cpp */,
@@ -15601,6 +15756,8 @@
 				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
 				BC7FA67F0D1F167900DB22A9 /* SelectorNodeList.h */,
+				D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */,
+				D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */,
 				BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */,
 				BC7FA62B0D1F0EFF00DB22A9 /* StaticNodeList.h */,
 				A8C4A7EC09D563270003AC8D /* StyledElement.cpp */,
@@ -15752,30 +15909,30 @@
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
 				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
-				A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */,
-				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
-				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
-				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
-				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
-				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
-				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
+				A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */,
+				49EECDE010503C2400099FAB /* WebGLArray.h in Headers */,
+				49EECDE310503C2400099FAB /* WebGLArrayBuffer.h in Headers */,
+				49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */,
+				49C7B9CC1042D32F0009D447 /* WebGLByteArray.h in Headers */,
+				49EECDE610503C2400099FAB /* WebGLFloatArray.h in Headers */,
+				49C7B9CF1042D32F0009D447 /* WebGLFramebuffer.h in Headers */,
 				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
-				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
+				49EECDE910503C2400099FAB /* WebGLIntArray.h in Headers */,
 				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
 				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
 				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
-				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
-				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
+				49C7B9D71042D32F0009D447 /* WebGLProgram.h in Headers */,
+				49C7B9DA1042D32F0009D447 /* WebGLRenderbuffer.h in Headers */,
 				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
-				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
-				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
-				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
+				49C7B9E01042D32F0009D447 /* WebGLRenderingContext.h in Headers */,
+				49C7B9E31042D32F0009D447 /* WebGLShader.h in Headers */,
+				49EECDEC10503C2400099FAB /* WebGLShortArray.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
-				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
-				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
-				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
-				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
+				49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */,
+				49EECDEF10503C2400099FAB /* WebGLUnsignedByteArray.h in Headers */,
+				49EECDF210503C2400099FAB /* WebGLUnsignedIntArray.h in Headers */,
+				49EECDF510503C2400099FAB /* WebGLUnsignedShortArray.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
 				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
@@ -15785,7 +15942,6 @@
 				A81872200977D3C0005826D9 /* ChildNodeList.h in Headers */,
 				14D823520AF92A790004F057 /* Chrome.h in Headers */,
 				14D824080AF93AEB0004F057 /* ChromeClient.h in Headers */,
-				BC4BF9E50D11E133007D247F /* ClassNames.h in Headers */,
 				BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */,
 				BCC0657E0F3CE1B700CD2D87 /* ClientRect.h in Headers */,
 				BCC065810F3CE1B700CD2D87 /* ClientRectList.h in Headers */,
@@ -15802,6 +15958,7 @@
 				6550B6A2099DF0270090D781 /* Comment.h in Headers */,
 				316FE1160E6E1DA700BF6088 /* CompositeAnimation.h in Headers */,
 				93309DDD099E64920056E581 /* CompositeEditCommand.h in Headers */,
+				79F2F5A21091939A000D87CB /* CompositionEvent.h in Headers */,
 				65C97AF308EA908800ACD273 /* config.h in Headers */,
 				BC0B36A50CD3C67C00AC7EB5 /* Console.h in Headers */,
 				41F0618E0F5F069800A07EAC /* ConsoleMessage.h in Headers */,
@@ -15815,7 +15972,6 @@
 				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
-				3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */,
 				A80E6D040A1989CA007FB8C5 /* Counter.h in Headers */,
 				BC5EB9790E82069200B25965 /* CounterContent.h in Headers */,
 				BC5EB9510E82056B00B25965 /* CounterDirectives.h in Headers */,
@@ -16850,6 +17006,7 @@
 				BCCD74DC0A4C8D35005FDA6D /* HTMLViewSourceDocument.h in Headers */,
 				514C76710CE923A1007EF3CD /* HTTPHeaderMap.h in Headers */,
 				514C76730CE923A1007EF3CD /* HTTPParsers.h in Headers */,
+				F5D3A57D106B83B300545297 /* ISODateTime.h in Headers */,
 				B275356E0B053814002CE64F /* Icon.h in Headers */,
 				5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */,
 				51E1ECBE0C91C90400DC255B /* IconDatabaseClient.h in Headers */,
@@ -16909,35 +17066,35 @@
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
 				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
 				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
-				A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */,
-				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
-				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
-				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
-				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
-				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
-				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
-				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
-				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
-				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
+				A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */,
+				49EECF1C105072F300099FAB /* JSWebGLArray.h in Headers */,
+				49EECF01105070C400099FAB /* JSWebGLArrayBuffer.h in Headers */,
+				49EECFAC1050938200099FAB /* JSWebGLArrayBufferConstructor.h in Headers */,
+				49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */,
+				49C7B9961042D2D30009D447 /* JSWebGLByteArray.h in Headers */,
+				49EECFAE1050938200099FAB /* JSWebGLByteArrayConstructor.h in Headers */,
+				49EECF03105070C400099FAB /* JSWebGLFloatArray.h in Headers */,
+				49EECFB01050938200099FAB /* JSWebGLFloatArrayConstructor.h in Headers */,
+				49C7B9981042D2D30009D447 /* JSWebGLFramebuffer.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
-				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
-				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
+				49EECF05105070C400099FAB /* JSWebGLIntArray.h in Headers */,
+				49EECFB21050938200099FAB /* JSWebGLIntArrayConstructor.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
-				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
-				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
+				49C7B99C1042D2D30009D447 /* JSWebGLProgram.h in Headers */,
+				49C7B99E1042D2D30009D447 /* JSWebGLRenderbuffer.h in Headers */,
 				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
 				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
-				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
-				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
-				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
-				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
-				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
-				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
-				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
-				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
-				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
-				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
-				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
+				49EED1471051969400099FAB /* JSWebGLRenderingContext.h in Headers */,
+				49C7B9A31042D2D30009D447 /* JSWebGLShader.h in Headers */,
+				49EECF07105070C400099FAB /* JSWebGLShortArray.h in Headers */,
+				49EECFB61050938200099FAB /* JSWebGLShortArrayConstructor.h in Headers */,
+				49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */,
+				49EECF09105070C400099FAB /* JSWebGLUnsignedByteArray.h in Headers */,
+				49EECFB81050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.h in Headers */,
+				49EECF0B105070C400099FAB /* JSWebGLUnsignedIntArray.h in Headers */,
+				49EECFBA1050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.h in Headers */,
+				49EECF0D105070C400099FAB /* JSWebGLUnsignedShortArray.h in Headers */,
+				49EECFBC1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.h in Headers */,
 				93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */,
 				65DF31F409D1CC60000BE325 /* JSCharacterData.h in Headers */,
 				BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */,
@@ -16970,6 +17127,7 @@
 				51EC926A0CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h in Headers */,
 				1A3417C90CECFF250049CBDE /* JSCustomVoidCallback.h in Headers */,
 				E10B937C0B73C00A003ED890 /* JSCustomXPathNSResolver.h in Headers */,
+				79AC9219109945C80021266E /* JSCompositionEvent.h in Headers */,
 				1AE82F900CAAFA9D002237AE /* JSDatabase.h in Headers */,
 				BC77D16A0FF19F560070887B /* JSDataGridColumn.h in Headers */,
 				BC77D16C0FF19F560070887B /* JSDataGridColumnList.h in Headers */,
@@ -17583,7 +17741,6 @@
 				41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */,
 				934CC1170EDCAC7300A658F2 /* ScriptInstance.h in Headers */,
 				41F066E40F64BCF600A07EAC /* ScriptObject.h in Headers */,
-				419536510F68222400D0C679 /* ScriptObjectQuarantine.h in Headers */,
 				934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */,
 				CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */,
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
@@ -17631,6 +17788,7 @@
 				4B3043C70AE0370300A82647 /* Sound.h in Headers */,
 				84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */,
 				84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */,
+				D01A27AE10C9BFD800026A42 /* SpaceSplitString.h in Headers */,
 				93309E12099E64920056E581 /* SplitElementCommand.h in Headers */,
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
@@ -18068,6 +18226,26 @@
 				7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */,
 				BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */,
 				BC97E413109154FA0010D361 /* JSHTMLAllCollection.h in Headers */,
+				37C236111097EE7700EF9F72 /* ComplexTextController.h in Headers */,
+				1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */,
+				1479FAF0109AE37500DED655 /* RenderRubyBase.h in Headers */,
+				1479FAF2109AE37500DED655 /* RenderRubyRun.h in Headers */,
+				1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */,
+				5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */,
+				E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */,
+				9382DF5810A8D5C900925652 /* ColorSpace.h in Headers */,
+				AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */,
+				5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */,
+				6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */,
+				7A0E76DB10BF059800A0276E /* JSInjectedScriptHost.h in Headers */,
+				7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
+				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */,
+				F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */,
+				599D1E3310C97D6E00E0EF12 /* jni_utility_private.h in Headers */,
+				7ADE722610CBBB9B006B3B3A /* ContextMenuSelectionHandler.h in Headers */,
+				0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */,
+				0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18136,7 +18314,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */,
-				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 				46D4F2490AF97E810035385A /* cellCursor.png in Resources */,
 				46D4F24A0AF97E810035385A /* contextMenuCursor.png in Resources */,
 				4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */,
@@ -18169,6 +18346,8 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
+				5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */,
+				0C3F1F5C10C8871200D72CE1 /* WebGLUniformLocation.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18252,7 +18431,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\ntouch \"$SRCROOT/Info.plist\"\n";
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"$SRCROOT/Info.plist\";\nfi;\n";
 		};
 		933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -18378,29 +18557,29 @@
 				BCB16C250979C3BD00467741 /* CachedXBLDocument.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
 				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
-				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
-				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
-				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
-				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
-				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
-				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
+				49EECDDF10503C2400099FAB /* WebGLArray.cpp in Sources */,
+				49EECDE210503C2400099FAB /* WebGLArrayBuffer.cpp in Sources */,
+				49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */,
+				49C7B9CB1042D32F0009D447 /* WebGLByteArray.cpp in Sources */,
+				49EECDE510503C2400099FAB /* WebGLFloatArray.cpp in Sources */,
+				49C7B9CE1042D32F0009D447 /* WebGLFramebuffer.cpp in Sources */,
 				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
-				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
+				49EECDE810503C2400099FAB /* WebGLIntArray.cpp in Sources */,
 				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
 				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
 				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
-				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
-				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
+				49C7B9D61042D32F0009D447 /* WebGLProgram.cpp in Sources */,
+				49C7B9D91042D32F0009D447 /* WebGLRenderbuffer.cpp in Sources */,
 				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
-				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
-				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
-				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
+				49C7B9DF1042D32F0009D447 /* WebGLRenderingContext.cpp in Sources */,
+				49C7B9E21042D32F0009D447 /* WebGLShader.cpp in Sources */,
+				49EECDEB10503C2400099FAB /* WebGLShortArray.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
-				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
-				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
-				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
-				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
+				49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */,
+				49EECDEE10503C2400099FAB /* WebGLUnsignedByteArray.cpp in Sources */,
+				49EECDF110503C2400099FAB /* WebGLUnsignedIntArray.cpp in Sources */,
+				49EECDF410503C2400099FAB /* WebGLUnsignedShortArray.cpp in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
 				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
@@ -18409,7 +18588,6 @@
 				A81872250977D3C0005826D9 /* ChildNodeList.cpp in Sources */,
 				14D8238B0AF92DF60004F057 /* Chrome.cpp in Sources */,
 				ABAF22080C03B1C700B0BCF0 /* ChromeMac.mm in Sources */,
-				BC4BF9E40D11E133007D247F /* ClassNames.cpp in Sources */,
 				BC904B760D10998F00680D32 /* ClassNodeList.cpp in Sources */,
 				BCC0657D0F3CE1B700CD2D87 /* ClientRect.cpp in Sources */,
 				BCC065800F3CE1B700CD2D87 /* ClientRectList.cpp in Sources */,
@@ -18422,8 +18600,12 @@
 				B22279620D00BF220071B782 /* ColorDistance.cpp in Sources */,
 				B27535770B053814002CE64F /* ColorMac.mm in Sources */,
 				6550B6A1099DF0270090D781 /* Comment.cpp in Sources */,
+				37C236101097EE7700EF9F72 /* ComplexTextController.cpp in Sources */,
+				37C238211098C84200EF9F72 /* ComplexTextControllerATSUI.cpp in Sources */,
+				37C238221098C84200EF9F72 /* ComplexTextControllerCoreText.cpp in Sources */,
 				316FE1150E6E1DA700BF6088 /* CompositeAnimation.cpp in Sources */,
 				93309DDC099E64920056E581 /* CompositeEditCommand.cpp in Sources */,
+				79F2F5A11091939A000D87CB /* CompositionEvent.cpp in Sources */,
 				BC0B36A40CD3C67C00AC7EB5 /* Console.cpp in Sources */,
 				41F0618F0F5F069800A07EAC /* ConsoleMessage.cpp in Sources */,
 				A818721F0977D3C0005826D9 /* ContainerNode.cpp in Sources */,
@@ -18434,7 +18616,6 @@
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
 				93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */,
 				9352087709BD453400F2038D /* CookieJar.mm in Sources */,
-				3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */,
 				BC5EB9500E82056B00B25965 /* CounterDirectives.cpp in Sources */,
 				9392F1500AD1862300691BD4 /* CounterNode.cpp in Sources */,
 				D0B0556909C6700100307E43 /* CreateLinkCommand.cpp in Sources */,
@@ -18845,6 +19026,7 @@
 				B2C3DA600D006CD600EF6F26 /* Font.cpp in Sources */,
 				B2C3DA620D006CD600EF6F26 /* FontCache.cpp in Sources */,
 				B2AFFC7C0D00A5C10030074D /* FontCacheMac.mm in Sources */,
+				37C2360B1097EDED00EF9F72 /* FontComplexTextMac.cpp in Sources */,
 				B2AFFC7D0D00A5C10030074D /* FontCustomPlatformData.cpp in Sources */,
 				371F4F410D25B9AF00ECE0D5 /* FontData.cpp in Sources */,
 				37ACCF690DA414E70089E602 /* FontDescription.cpp in Sources */,
@@ -18853,8 +19035,6 @@
 				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				B2AFFC800D00A5C10030074D /* FontMac.mm in Sources */,
-				3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */,
-				3724CA7E0E68B20500DB4384 /* FontMacCoreText.cpp in Sources */,
 				B2AFFC820D00A5C10030074D /* FontPlatformDataMac.mm in Sources */,
 				A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */,
 				D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */,
@@ -18984,6 +19164,7 @@
 				BCCD74E50A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp in Sources */,
 				0B8C56D40F28627F000502E1 /* HTTPHeaderMap.cpp in Sources */,
 				514C76720CE923A1007EF3CD /* HTTPParsers.cpp in Sources */,
+				F5D3A57C106B83B300545297 /* ISODateTime.cpp in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
 				445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */,
 				1A2D753E0DE47FAB00F0A648 /* IconFetcher.cpp in Sources */,
@@ -19046,46 +19227,46 @@
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
 				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
 				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
-				A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */,
-				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
-				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
-				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
-				492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */,
-				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
-				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
-				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
-				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
-				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
-				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
-				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
-				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
+				A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */,
+				49EECF1B105072F300099FAB /* JSWebGLArray.cpp in Sources */,
+				49EECF00105070C400099FAB /* JSWebGLArrayBuffer.cpp in Sources */,
+				49EECFAB1050938200099FAB /* JSWebGLArrayBufferConstructor.cpp in Sources */,
+				492273A31083B3B100EE5C84 /* JSWebGLArrayCustom.cpp in Sources */,
+				49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */,
+				49C7B9951042D2D30009D447 /* JSWebGLByteArray.cpp in Sources */,
+				49EECFAD1050938200099FAB /* JSWebGLByteArrayConstructor.cpp in Sources */,
+				49EECF7810508D9C00099FAB /* JSWebGLByteArrayCustom.cpp in Sources */,
+				49EECF02105070C400099FAB /* JSWebGLFloatArray.cpp in Sources */,
+				49EECFAF1050938200099FAB /* JSWebGLFloatArrayConstructor.cpp in Sources */,
+				49EECF7910508D9C00099FAB /* JSWebGLFloatArrayCustom.cpp in Sources */,
+				49C7B9971042D2D30009D447 /* JSWebGLFramebuffer.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
-				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
-				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
-				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
+				49EECF04105070C400099FAB /* JSWebGLIntArray.cpp in Sources */,
+				49EECFB11050938200099FAB /* JSWebGLIntArrayConstructor.cpp in Sources */,
+				49EECF7A10508D9C00099FAB /* JSWebGLIntArrayCustom.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
-				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
-				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
+				49C7B99B1042D2D30009D447 /* JSWebGLProgram.cpp in Sources */,
+				49C7B99D1042D2D30009D447 /* JSWebGLRenderbuffer.cpp in Sources */,
 				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
 				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
 				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
-				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
-				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
+				49EED1461051969400099FAB /* JSWebGLRenderingContext.cpp in Sources */,
+				49EED14F1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp in Sources */,
 				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
-				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
-				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
-				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
-				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
-				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
-				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
-				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
-				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
-				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
-				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
-				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
-				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
-				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
-				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
+				49C7B9A21042D2D30009D447 /* JSWebGLShader.cpp in Sources */,
+				49EECF06105070C400099FAB /* JSWebGLShortArray.cpp in Sources */,
+				49EECFB51050938200099FAB /* JSWebGLShortArrayConstructor.cpp in Sources */,
+				49EECF7B10508D9C00099FAB /* JSWebGLShortArrayCustom.cpp in Sources */,
+				49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */,
+				49EECF08105070C400099FAB /* JSWebGLUnsignedByteArray.cpp in Sources */,
+				49EECFB71050938200099FAB /* JSWebGLUnsignedByteArrayConstructor.cpp in Sources */,
+				49EECF7C10508D9C00099FAB /* JSWebGLUnsignedByteArrayCustom.cpp in Sources */,
+				49EECF0A105070C400099FAB /* JSWebGLUnsignedIntArray.cpp in Sources */,
+				49EECFB91050938200099FAB /* JSWebGLUnsignedIntArrayConstructor.cpp in Sources */,
+				49EECF7D10508D9C00099FAB /* JSWebGLUnsignedIntArrayCustom.cpp in Sources */,
+				49EECF0C105070C400099FAB /* JSWebGLUnsignedShortArray.cpp in Sources */,
+				49EECFBB1050938200099FAB /* JSWebGLUnsignedShortArrayConstructor.cpp in Sources */,
+				49EECF7E10508D9C00099FAB /* JSWebGLUnsignedShortArrayCustom.cpp in Sources */,
 				93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */,
 				93BA59B20F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp in Sources */,
 				65DF31F309D1CC60000BE325 /* JSCharacterData.cpp in Sources */,
@@ -19094,6 +19275,7 @@
 				BCA83E4F0D7CE1E9003421A8 /* JSClipboard.cpp in Sources */,
 				BCA83E520D7CE205003421A8 /* JSClipboardCustom.cpp in Sources */,
 				93F9B6E00BA0FB7200854064 /* JSComment.cpp in Sources */,
+				79AC9218109945C80021266E /* JSCompositionEvent.cpp in Sources */,
 				BC98543D0CD3D98B00069BC1 /* JSConsole.cpp in Sources */,
 				C0DFC8700DB6841A003EAE7C /* JSConsoleCustom.cpp in Sources */,
 				FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */,
@@ -19262,7 +19444,7 @@
 				A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */,
 				C091588A0DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp in Sources */,
 				41F060CD0F5EEB2B00A07EAC /* JSInspectorBackend.cpp in Sources */,
-				7A74ECBD101839DA00BF939E /* JSInspectorBackendCustom.cpp in Sources */,
+				7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */,
 				C091588C0DB4209200E55AF4 /* JSInspectorCallbackWrapper.cpp in Sources */,
 				1C5FAED10DCFD90100D58F78 /* JSJavaScriptCallFrame.cpp in Sources */,
 				1C5FAEE70DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp in Sources */,
@@ -19772,7 +19954,6 @@
 				E11C9DB00EB3699500E409DB /* ScriptExecutionContext.cpp in Sources */,
 				41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */,
 				41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */,
-				412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */,
 				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
 				BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */,
@@ -20203,6 +20384,25 @@
 				BC97E23B109144950010D361 /* HTMLAllCollection.cpp in Sources */,
 				BC97E412109154FA0010D361 /* JSHTMLAllCollection.cpp in Sources */,
 				BC97E42C10915B060010D361 /* JSHTMLAllCollectionCustom.cpp in Sources */,
+				1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */,
+				1479FAEF109AE37500DED655 /* RenderRubyBase.cpp in Sources */,
+				1479FAF1109AE37500DED655 /* RenderRubyRun.cpp in Sources */,
+				1479FAF3109AE37500DED655 /* RenderRubyText.cpp in Sources */,
+				5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */,
+				5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */,
+				5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */,
+				E1B4CD2510B322E200BFFD7E /* CredentialStorageMac.mm in Sources */,
+				6E47E66010B7944B00B186C8 /* WebGLGetInfo.cpp in Sources */,
+				7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */,
+				7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */,
+				7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */,
+				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */,
+				F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */,
+				D01A27AD10C9BFD800026A42 /* SpaceSplitString.cpp in Sources */,
+				599D1E3210C97D6E00E0EF12 /* jni_utility_private.cpp in Sources */,
+				0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */,
+				0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/WebCorePrefix.cpp b/WebCore/WebCorePrefix.cpp
index b522e1d..e0f19a0 100644
--- a/WebCore/WebCorePrefix.cpp
+++ b/WebCore/WebCorePrefix.cpp
@@ -24,4 +24,3 @@
  */
 
 #include "WebCorePrefix.h"
-
diff --git a/WebCore/WebCorePrefix.h b/WebCore/WebCorePrefix.h
index 6d445c5..1ffb675 100644
--- a/WebCore/WebCorePrefix.h
+++ b/WebCore/WebCorePrefix.h
@@ -18,7 +18,7 @@
  *
  */
 
-/* This prefix file should contain only:
+/* This prefix file should contain only: 
  *    1) files to precompile for faster builds
  *    2) in one case at least: OS-X-specific performance bug workarounds
  *    3) the special trick to catch us using new or delete without including "config.h"
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index c579084..cd94ae6 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -111,8 +111,9 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSHTMLSelectElementCustom.cpp
         bindings/js/JSImageConstructor.cpp
         bindings/js/JSImageDataCustom.cpp
+        bindings/js/JSInjectedScriptHostCustom.cpp
         bindings/js/JSInspectedObjectWrapper.cpp
-        bindings/js/JSInspectorBackendCustom.cpp
+        bindings/js/JSInspectorFrontendHostCustom.cpp
         bindings/js/JSInspectorCallbackWrapper.cpp
         bindings/js/JSJavaScriptCallFrameCustom.cpp
         bindings/js/JSLocationCustom.cpp
@@ -155,7 +156,6 @@ This file contains the list of files needed to build WebCore.
         bindings/js/ScriptEventListener.cpp
         bindings/js/ScriptFunctionCall.cpp
         bindings/js/ScriptObject.cpp
-        bindings/js/ScriptObjectQuarantine.cpp
         bindings/js/ScriptState.cpp
         bindings/js/ScriptValue.cpp
         bindings/js/ScheduledAction.cpp
@@ -274,6 +274,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSClientRectList.cpp
         DerivedSources/WebCore/JSClipboard.cpp
         DerivedSources/WebCore/JSComment.cpp
+        DerivedSources/WebCore/JSCompositionEvent.cpp
         DerivedSources/WebCore/JSConsole.cpp
         DerivedSources/WebCore/JSCoordinates.cpp
         DerivedSources/WebCore/JSCounter.cpp
@@ -365,7 +366,9 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSHTMLUListElement.cpp
         DerivedSources/WebCore/JSHistory.cpp
         DerivedSources/WebCore/JSImageData.cpp
+        DerivedSources/WebCore/JSInjectedScriptHost.cpp
         DerivedSources/WebCore/JSInspectorBackend.cpp
+        DerivedSources/WebCore/JSInspectorFrontendHost.cpp
         DerivedSources/WebCore/JSJavaScriptCallFrame.cpp
         DerivedSources/WebCore/JSKeyboardEvent.cpp
         DerivedSources/WebCore/JSLocation.cpp
@@ -447,13 +450,13 @@ This file contains the list of files needed to build WebCore.
         dom/CharacterData.cpp
         dom/CheckedRadioButtons.cpp
         dom/ChildNodeList.cpp
-        dom/ClassNames.cpp
         dom/ClassNodeList.cpp
         dom/ClientRect.cpp
         dom/ClientRectList.cpp
         dom/Clipboard.cpp
         dom/ClipboardEvent.cpp
         dom/Comment.cpp
+        dom/CompositionEvent.cpp
         dom/ContainerNode.cpp
         dom/DOMImplementation.cpp
         dom/Document.cpp
@@ -502,6 +505,7 @@ This file contains the list of files needed to build WebCore.
         dom/ScriptExecutionContext.cpp
         dom/SelectElement.cpp
         dom/SelectorNodeList.cpp
+        dom/SpaceSplitString.cpp
         dom/StaticNodeList.cpp
         dom/StyleElement.cpp
         dom/StyledElement.cpp
@@ -672,6 +676,7 @@ This file contains the list of files needed to build WebCore.
         html/HTMLTokenizer.cpp
         html/HTMLUListElement.cpp
         html/HTMLViewSourceDocument.cpp
+        html/ISODateTime.cpp
         html/ImageData.cpp
         html/PreloadScanner.cpp
         html/ValidityState.cpp
@@ -679,7 +684,9 @@ This file contains the list of files needed to build WebCore.
 
     <set append="1" var="WEBCORE_SOURCES_INSPECTOR">
         inspector/ConsoleMessage.cpp
+        inspector/InjectedScriptHost.cpp
         inspector/InspectorBackend.cpp
+        inspector/InspectorFrontendHost.cpp
         inspector/InspectorDatabaseResource.cpp
         inspector/InspectorDOMAgent.cpp
         inspector/InspectorDOMStorageResource.cpp
diff --git a/WebCore/accessibility/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
index 55199a3..6ec325a 100644
--- a/WebCore/accessibility/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -30,12 +30,12 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityARIAGrid.h"
-#include "AccessibilityARIAGridRow.h"
 #include "AccessibilityARIAGridCell.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityImageMapLink.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
-#include "AccessibilityImageMapLink.h"
 #include "AccessibilityMediaControls.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilitySlider.h"
@@ -141,7 +141,10 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+
+        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
+        else if (node && ((nodeIsAriaType(node, "list") || nodeIsAriaType(node, "directory"))
+                          || (nodeIsAriaType(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
@@ -191,23 +194,23 @@ AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
     
     // will be filled in...
     switch (role) {
-        case ListBoxOptionRole:
-            obj = AccessibilityListBoxOption::create();
-            break;
-        case ImageMapLinkRole:
-            obj = AccessibilityImageMapLink::create();
-            break;
-        case ColumnRole:
-            obj = AccessibilityTableColumn::create();
-            break;            
-        case TableHeaderContainerRole:
-            obj = AccessibilityTableHeaderContainer::create();
-            break;   
-        case SliderThumbRole:
-            obj = AccessibilitySliderThumb::create();
-            break;
-        default:
-            obj = 0;
+    case ListBoxOptionRole:
+        obj = AccessibilityListBoxOption::create();
+        break;
+    case ImageMapLinkRole:
+        obj = AccessibilityImageMapLink::create();
+        break;
+    case ColumnRole:
+        obj = AccessibilityTableColumn::create();
+        break;            
+    case TableHeaderContainerRole:
+        obj = AccessibilityTableHeaderContainer::create();
+        break;   
+    case SliderThumbRole:
+        obj = AccessibilitySliderThumb::create();
+        break;
+    default:
+        obj = 0;
     }
     
     if (obj)
@@ -235,9 +238,8 @@ void AXObjectCache::remove(AXID axID)
     removeAXID(obj);
     
     // finally remove the object
-    if (!m_objects.take(axID)) {
+    if (!m_objects.take(axID))
         return;
-    }
     
     ASSERT(m_objects.size() >= m_idsInUse.size());    
 }
@@ -261,7 +263,7 @@ AXID AXObjectCache::platformGenerateAXID() const
     AXID objID = lastUsedID;
     do {
         ++objID;
-    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+    } while (!objID || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
 
     lastUsedID = objID;
 
@@ -292,7 +294,7 @@ void AXObjectCache::removeAXID(AccessibilityObject* obj)
         return;
     
     AXID objID = obj->axObjectID();
-    if (objID == 0)
+    if (!objID)
         return;
     ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
     ASSERT(m_idsInUse.contains(objID));
diff --git a/WebCore/accessibility/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
index 5a75f84..adfddcd 100644
--- a/WebCore/accessibility/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -42,104 +42,105 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
-    class Node;
-    class Page;
-    class RenderObject;
-    class String;
-    class VisiblePosition;
-
-    struct TextMarkerData  {
-        AXID axID;
-        Node* node;
-        int offset;
-        EAffinity affinity;
-    };
-
-    class AXObjectCache {
-    public:
-        AXObjectCache();
-        ~AXObjectCache();
-
-        static AccessibilityObject* focusedUIElementForPage(const Page*);
-
-        // to be used with render objects
-        AccessibilityObject* getOrCreate(RenderObject*);
-        
-        // used for objects without backing elements
-        AccessibilityObject* getOrCreate(AccessibilityRole);
-        
-        // will only return the AccessibilityObject if it already exists
-        AccessibilityObject* get(RenderObject*);
-        
-        void remove(RenderObject*);
-        void remove(AXID);
-
-        void detachWrapper(AccessibilityObject*);
-        void attachWrapper(AccessibilityObject*);
-        void childrenChanged(RenderObject*);
-        void selectedChildrenChanged(RenderObject*);
-        void handleActiveDescendantChanged(RenderObject*);
-        void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
-        void handleScrolledToAnchor(const Node* anchorNode);
-
-        static void enableAccessibility() { gAccessibilityEnabled = true; }
-        static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
-        
-        static bool accessibilityEnabled() { return gAccessibilityEnabled; }
-        static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
-
-        void removeAXID(AccessibilityObject*);
-        bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
-        AXID platformGenerateAXID() const;
-        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
-
-        // Text marker utilities.
-        static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
-        static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-
-        enum AXNotification {
-            AXCheckedStateChanged,
-            AXFocusedUIElementChanged,
-            AXLayoutComplete,
-            AXLoadComplete,
-            AXSelectedChildrenChanged,
-            AXSelectedTextChanged,
-            AXValueChanged,
-            AXScrolledToAnchor,
-        };
-        
-        void postNotification(RenderObject*, AXNotification, bool postToElement);
-
-    protected:
-        void postPlatformNotification(AccessibilityObject*, AXNotification);
-
-    private:
-        HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
-        HashMap<RenderObject*, AXID> m_renderObjectMapping;
-        static bool gAccessibilityEnabled;
-        static bool gAccessibilityEnhancedUserInterfaceEnabled;
-        
-        HashSet<AXID> m_idsInUse;
-        
-        Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
-        void notificationPostTimerFired(Timer<AXObjectCache>*);
-        
-        AXID getAXID(AccessibilityObject*);
-        bool nodeIsAriaType(Node* node, String role);
+class Node;
+class Page;
+class RenderObject;
+class String;
+class VisiblePosition;
+
+struct TextMarkerData {
+    AXID axID;
+    Node* node;
+    int offset;
+    EAffinity affinity;
+};
+
+class AXObjectCache : public Noncopyable {
+public:
+    AXObjectCache();
+    ~AXObjectCache();
+
+    static AccessibilityObject* focusedUIElementForPage(const Page*);
+
+    // to be used with render objects
+    AccessibilityObject* getOrCreate(RenderObject*);
+    
+    // used for objects without backing elements
+    AccessibilityObject* getOrCreate(AccessibilityRole);
+    
+    // will only return the AccessibilityObject if it already exists
+    AccessibilityObject* get(RenderObject*);
+    
+    void remove(RenderObject*);
+    void remove(AXID);
+
+    void detachWrapper(AccessibilityObject*);
+    void attachWrapper(AccessibilityObject*);
+    void childrenChanged(RenderObject*);
+    void selectedChildrenChanged(RenderObject*);
+    void handleActiveDescendantChanged(RenderObject*);
+    void handleAriaRoleChanged(RenderObject*);
+    void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+    void handleScrolledToAnchor(const Node* anchorNode);
+
+    static void enableAccessibility() { gAccessibilityEnabled = true; }
+    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    
+    static bool accessibilityEnabled() { return gAccessibilityEnabled; }
+    static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
+
+    void removeAXID(AccessibilityObject*);
+    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+    AXID platformGenerateAXID() const;
+    AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
+
+    // Text marker utilities.
+    static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
+    static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
+
+    enum AXNotification {
+        AXActiveDescendantChanged,
+        AXCheckedStateChanged,
+        AXFocusedUIElementChanged,
+        AXLayoutComplete,
+        AXLoadComplete,
+        AXSelectedChildrenChanged,
+        AXSelectedTextChanged,
+        AXValueChanged,
+        AXScrolledToAnchor,
     };
+    
+    void postNotification(RenderObject*, AXNotification, bool postToElement);
+
+protected:
+    void postPlatformNotification(AccessibilityObject*, AXNotification);
+
+private:
+    HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
+    HashMap<RenderObject*, AXID> m_renderObjectMapping;
+    static bool gAccessibilityEnabled;
+    static bool gAccessibilityEnhancedUserInterfaceEnabled;
+    
+    HashSet<AXID> m_idsInUse;
+    
+    Timer<AXObjectCache> m_notificationPostTimer;
+    Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
+    void notificationPostTimerFired(Timer<AXObjectCache>*);
+    
+    AXID getAXID(AccessibilityObject*);
+    bool nodeIsAriaType(Node*, String role);
+};
 
 #if !HAVE(ACCESSIBILITY)
-    inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
-    inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
-    inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
-    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
+inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
+inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
+inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
+inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
+inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
+inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 #endif
 
 }
diff --git a/WebCore/accessibility/AccessibilityARIAGrid.cpp b/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 69c4512..a0cf77a 100644
--- a/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -29,11 +29,11 @@
 #include "config.h"
 #include "AccessibilityARIAGrid.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -137,7 +137,7 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject *tableRow = m_rows[row].get();
+    AccessibilityObject* tableRow = m_rows[row].get();
     if (!tableRow)
         return 0;
     
diff --git a/WebCore/accessibility/AccessibilityAllInOne.cpp b/WebCore/accessibility/AccessibilityAllInOne.cpp
index 04124bd..ada50cd 100755
--- a/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -25,6 +25,7 @@
 

 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.

 

+#include <AXObjectCache.cpp>

 #include <AccessibilityARIAGrid.cpp>

 #include <AccessibilityARIAGridCell.cpp>

 #include <AccessibilityARIAGridRow.cpp>

@@ -41,4 +42,3 @@
 #include <AccessibilityTableColumn.cpp>

 #include <AccessibilityTableHeaderContainer.cpp>

 #include <AccessibilityTableRow.cpp>

-#include <AXObjectCache.cpp>

diff --git a/WebCore/accessibility/AccessibilityImageMapLink.cpp b/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 943122e..06150b9 100644
--- a/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityImageMapLink.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
 #include "IntRect.h"
@@ -68,6 +68,18 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
+AccessibilityRole AccessibilityImageMapLink::roleValue() const
+{
+    if (!m_areaElement)
+        return WebCoreLinkRole;
+    
+    const AtomicString& ariaRole = m_areaElement->getAttribute(roleAttr);
+    if (!ariaRole.isEmpty())
+        return AccessibilityObject::ariaRoleToWebCoreRole(ariaRole);
+
+    return WebCoreLinkRole;
+}
+    
 Element* AccessibilityImageMapLink::actionElement() const
 {
     return anchorElement();
@@ -134,5 +146,15 @@ IntSize AccessibilityImageMapLink::size() const
 {
     return elementRect().size();
 }
-    
+
+String AccessibilityImageMapLink::stringValueForMSAA() const
+{
+    return url();
+}
+
+String AccessibilityImageMapLink::nameForMSAA() const
+{
+    return accessibilityDescription();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityImageMapLink.h b/WebCore/accessibility/AccessibilityImageMapLink.h
index 2c27e46..3024f37 100644
--- a/WebCore/accessibility/AccessibilityImageMapLink.h
+++ b/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -47,7 +47,7 @@ public:
     void setHTMLMapElement(HTMLMapElement* element) { m_mapElement = element; }    
     void setParent(AccessibilityObject* parent) { m_parent = parent; }
         
-    virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
+    virtual AccessibilityRole roleValue() const;
     virtual bool accessibilityIsIgnored() const { return false; }
     virtual bool isEnabled() const { return true; }
 
@@ -56,9 +56,13 @@ public:
     virtual Element* actionElement() const;
     virtual KURL url() const;
     virtual bool isLink() const { return true; } 
+    virtual bool isLinked() const { return true; }
     virtual String title() const;
     virtual String accessibilityDescription() const;
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String nameForMSAA() const;
+
     virtual IntSize size() const;
     virtual IntRect elementRect() const;
 
diff --git a/WebCore/accessibility/AccessibilityList.cpp b/WebCore/accessibility/AccessibilityList.cpp
index 95239b0..feceee5 100644
--- a/WebCore/accessibility/AccessibilityList.cpp
+++ b/WebCore/accessibility/AccessibilityList.cpp
@@ -55,6 +55,10 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 
 bool AccessibilityList::accessibilityIsIgnored() const
 {
+    // Is the platform interested in the object?
+    if (accessibilityPlatformIncludesObject() == IgnoreObject)
+        return true;
+    
     // lists don't appear on tiger/leopard on the mac
 #if ACCESSIBILITY_LISTS
     return false;
@@ -83,7 +87,11 @@ bool AccessibilityList::isOrderedList() const
 {
     if (!m_renderer)
         return false;
-    
+
+    // ARIA says a directory is like a static table of contents, which sounds like an ordered list.
+    if (ariaRoleAttribute() == DirectoryRole)
+        return true;
+
     Node* node = m_renderer->node();
     return node && node->hasTagName(olTag);    
 }
diff --git a/WebCore/accessibility/AccessibilityList.h b/WebCore/accessibility/AccessibilityList.h
index 89befb2..b7265b2 100644
--- a/WebCore/accessibility/AccessibilityList.h
+++ b/WebCore/accessibility/AccessibilityList.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<AccessibilityList> create(RenderObject*);
     virtual ~AccessibilityList();
     
-    virtual bool isList() const { return true; };
+    virtual bool isList() const { return true; }
     bool isUnorderedList() const;
     bool isOrderedList() const;
     bool isDefinitionList() const;
diff --git a/WebCore/accessibility/AccessibilityListBox.cpp b/WebCore/accessibility/AccessibilityListBox.cpp
index 1f37481..2a60294 100644
--- a/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/WebCore/accessibility/AccessibilityListBox.cpp
@@ -31,9 +31,9 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBoxOption.h"
-#include "HitTestResult.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "HitTestResult.h"
 #include "RenderListBox.h"
 #include "RenderObject.h"
 
diff --git a/WebCore/accessibility/AccessibilityListBox.h b/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d..ce1abe0 100644
--- a/WebCore/accessibility/AccessibilityListBox.h
+++ b/WebCore/accessibility/AccessibilityListBox.h
@@ -43,7 +43,7 @@ public:
     virtual ~AccessibilityListBox();
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
-    virtual bool isListBox() const { return true; };
+    virtual bool isListBox() const { return true; }
     
     virtual bool canSetFocusAttribute() const { return true; }
     virtual bool canSetSelectedChildrenAttribute() const;
diff --git a/WebCore/accessibility/AccessibilityListBoxOption.cpp b/WebCore/accessibility/AccessibilityListBoxOption.cpp
index 6e3bf98..6a77dac 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.cpp
+++ b/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -34,12 +34,12 @@
 #include "Element.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "HTMLOptionElement.h"
 #include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
 #include "HTMLSelectElement.h"
 #include "IntRect.h"
-#include "RenderObject.h"
 #include "RenderListBox.h"
+#include "RenderObject.h"
 
 using namespace std;
 
diff --git a/WebCore/accessibility/AccessibilityListBoxOption.h b/WebCore/accessibility/AccessibilityListBoxOption.h
index 933cdeb..f8fd5f0 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -63,7 +63,7 @@ public:
     virtual IntRect elementRect() const;
     virtual IntSize size() const;
     virtual AccessibilityObject* parentObject() const;
-    bool isListBoxOption() const { return true; };
+    bool isListBoxOption() const { return true; }
     
 private:
     HTMLElement* m_optionElement;
diff --git a/WebCore/accessibility/AccessibilityMediaControls.cpp b/WebCore/accessibility/AccessibilityMediaControls.cpp
index 7200de9..6151840 100644
--- a/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -113,6 +113,8 @@ String AccessibilityMediaControl::controlTypeName() const
     DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
     DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaShowClosedCaptionsButtonName, ("ShowClosedCaptionsButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaHideClosedCaptionsButtonName, ("HideClosedCaptionsButton"));
 
     switch (controlType()) {
     case MediaFullscreenButton:
@@ -139,6 +141,10 @@ String AccessibilityMediaControl::controlTypeName() const
         return mediaCurrentTimeDisplay;
     case MediaTimeRemainingDisplay:
         return mediaTimeRemainingDisplay;
+    case MediaShowClosedCaptionsButton:
+        return mediaShowClosedCaptionsButtonName;
+    case MediaHideClosedCaptionsButton:
+        return mediaHideClosedCaptionsButtonName;
 
     default:
         break;
@@ -187,6 +193,8 @@ AccessibilityRole AccessibilityMediaControl::roleValue() const
     case MediaReturnToRealtimeButton:
     case MediaUnMuteButton:
     case MediaPauseButton:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         return ButtonRole;
 
     case MediaStatusDisplay:
diff --git a/WebCore/accessibility/AccessibilityMediaControls.h b/WebCore/accessibility/AccessibilityMediaControls.h
index 9b306fd..6f51b2c 100644
--- a/WebCore/accessibility/AccessibilityMediaControls.h
+++ b/WebCore/accessibility/AccessibilityMediaControls.h
@@ -37,77 +37,77 @@
 
 namespace WebCore {
 
-    class AccessibilityMediaControl : public AccessibilityRenderObject {
+class AccessibilityMediaControl : public AccessibilityRenderObject {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControl() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControl() { }
 
-        virtual AccessibilityRole roleValue() const;
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String title() const;
-        virtual String accessibilityDescription() const;
-        virtual String helpText() const;
+    virtual String title() const;
+    virtual String accessibilityDescription() const;
+    virtual String helpText() const;
 
-    protected:
-        AccessibilityMediaControl(RenderObject*);
-        MediaControlElementType controlType() const;
-        String controlTypeName() const;
-    };
+protected:
+    AccessibilityMediaControl(RenderObject*);
+    MediaControlElementType controlType() const;
+    String controlTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeline : public AccessibilitySlider {
+class AccessibilityMediaTimeline : public AccessibilitySlider {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeline() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeline() { }
 
-        virtual bool isMediaTimeline() const { return true; }
+    virtual bool isMediaTimeline() const { return true; }
 
-        virtual String helpText() const;
-        virtual String valueDescription() const;
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual String helpText() const;
+    virtual String valueDescription() const;
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-    private:
-        AccessibilityMediaTimeline(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeline(RenderObject*);
+};
 
 
-    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaControlsContainer() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaControlsContainer() { }
 
-        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual String helpText() const;
-        virtual String accessibilityDescription() const;
+    virtual String helpText() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaControlsContainer(RenderObject*);
-        bool controllingVideoElement() const;
-        const String elementTypeName() const;
-    };
+private:
+    AccessibilityMediaControlsContainer(RenderObject*);
+    bool controllingVideoElement() const;
+    const String elementTypeName() const;
+};
 
 
-    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
 
-    public:
-        static PassRefPtr<AccessibilityObject> create(RenderObject*);
-        virtual ~AccessibilityMediaTimeDisplay() { }
+public:
+    static PassRefPtr<AccessibilityObject> create(RenderObject*);
+    virtual ~AccessibilityMediaTimeDisplay() { }
 
-        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
-        virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+    virtual bool accessibilityIsIgnored() const;
 
-        virtual String stringValue() const;
-        virtual String accessibilityDescription() const;
+    virtual String stringValue() const;
+    virtual String accessibilityDescription() const;
 
-    private:
-        AccessibilityMediaTimeDisplay(RenderObject*);
-    };
+private:
+    AccessibilityMediaTimeDisplay(RenderObject*);
+};
 
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
index d7093e4..585e4cb 100644
--- a/WebCore/accessibility/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityObject.h"
 
-#include "AccessibilityRenderObject.h"
 #include "AXObjectCache.h"
+#include "AccessibilityRenderObject.h"
 #include "CharacterNames.h"
 #include "FloatRect.h"
 #include "FocusController.h"
@@ -85,8 +85,9 @@ void AccessibilityObject::detach()
 AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
 {
     AccessibilityObject* parent;
-    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject())
-        ;
+    for (parent = parentObject(); parent && parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+    }
+    
     return parent;
 }
 
@@ -275,7 +276,7 @@ VisiblePositionRange AccessibilityObject::rightLineVisiblePositionRange(const Vi
     VisiblePosition startPosition = startOfLine(nextVisiblePos);
 
     // fetch for a valid line start position
-    if (startPosition.isNull() ) {
+    if (startPosition.isNull()) {
         startPosition = visiblePos;
         nextVisiblePos = nextVisiblePos.next();
     } else
@@ -381,9 +382,8 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 {
     // we should always be given a rendered node and a replaced node, but be safe
     // replaced nodes are either attachments (widgets) or images
-    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode()) {
+    if (!replacedNode || !replacedNode->renderer() || !replacedNode->renderer()->isReplaced() || replacedNode->isTextNode())
         return false;
-    }
 
     // create an AX object, but skip it if it is not supposed to be seen
     AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
@@ -445,7 +445,7 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length()) {
             // Add a textual representation for list marker text
             String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
             if (!listMarkerText.isEmpty())
@@ -459,9 +459,8 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
             ASSERT(node == it.range()->endContainer(exception));
             int offset = it.range()->startOffset(exception);
 
-            if (replacedNodeNeedsCharacter(node->childNode(offset))) {
+            if (replacedNodeNeedsCharacter(node->childNode(offset)))
                 resultVector.append(objectReplacementCharacter);
-            }
         }
     }
 
@@ -478,9 +477,9 @@ int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRang
     RefPtr<Range> range = makeRange(visiblePositionRange.start, visiblePositionRange.end);
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
-        if (it.length() != 0) {
+        if (it.length())
             length += it.length();
-        } else {
+        else {
             // locate the node and starting offset for this replaced range
             int exception = 0;
             Node* node = it.range()->startContainer(exception);
@@ -754,6 +753,53 @@ AccessibilityObject* AccessibilityObject::anchorElementForNode(Node* node)
     return anchorRenderer->document()->axObjectCache()->getOrCreate(anchorRenderer);
 }
     
+void AccessibilityObject::ariaTreeRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole) 
+            result.append(obj);
+
+        // Now see if this item also has rows hiding inside of it.
+        obj->ariaTreeRows(result);
+    }
+}
+    
+void AccessibilityObject::ariaTreeItemContent(AccessibilityChildrenVector& result)
+{
+    // The ARIA tree item content are the item that are not other tree items or their containing groups.
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        AccessibilityRole role = obj->roleValue();
+        if (role == TreeItemRole || role == GroupRole)
+            continue;
+        
+        result.append(obj);
+    }
+}
+
+void AccessibilityObject::ariaTreeItemDisclosedRows(AccessibilityChildrenVector& result)
+{
+    AccessibilityChildrenVector axChildren = children();
+    unsigned count = axChildren.size();
+    for (unsigned k = 0; k < count; ++k) {
+        AccessibilityObject* obj = axChildren[k].get();
+        
+        // Add tree items as the rows.
+        if (obj->roleValue() == TreeItemRole)
+            result.append(obj);
+        // If it's not a tree item, then descend into the group to find more tree items.
+        else 
+            obj->ariaTreeRows(result);
+    }    
+}
+    
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -766,20 +812,20 @@ const String& AccessibilityObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
 
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
  
@@ -794,6 +840,93 @@ AccessibilityOrientation AccessibilityObject::orientation() const
 
     // A tie goes to horizontal.
     return AccessibilityOrientationHorizontal;
+}    
+
+typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
+
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
+static ARIARoleMap* createARIARoleMap()
+{
+    const RoleEntry roles[] = {
+        { "alert", ApplicationAlertRole },
+        { "alertdialog", ApplicationAlertDialogRole },
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
+        { "button", ButtonRole },
+        { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
+        { "dialog", ApplicationDialogRole },
+        { "directory", DirectoryRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "combobox", ComboBoxRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
+        { "rowheader", RowHeaderRole },
+        { "group", GroupRole },
+        { "heading", HeadingRole },
+        { "img", ImageRole },
+        { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
+        { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
+        // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
+        { "math", DocumentMathRole },
+        { "menu", MenuRole },
+        { "menubar", GroupRole },
+        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
+        { "menuitemcheckbox", MenuItemRole },
+        { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
+        { "progressbar", ProgressIndicatorRole },
+        { "radio", RadioButtonRole },
+        { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
+        { "row", RowRole },
+        { "range", SliderRole },
+        { "scrollbar", ScrollBarRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
+        { "slider", SliderRole },
+        { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
+        { "tab", TabRole },
+        { "tablist", TabListRole },
+        { "tabpanel", TabPanelRole },
+        { "text", StaticTextRole },
+        { "textbox", TextAreaRole },
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole },
+        { "tree", TreeRole },
+        { "treeitem", TreeItemRole }
+    };
+    ARIARoleMap* roleMap = new ARIARoleMap;
+    
+    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
+    for (unsigned i = 0; i < numRoles; ++i)
+        roleMap->set(roles[i].ariaRole, roles[i].webcoreRole);
+    return roleMap;
+}
+
+AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value)
+{
+    ASSERT(!value.isEmpty());
+    static const ARIARoleMap* roleMap = createARIARoleMap();
+    return roleMap->get(value);
 }
     
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index 8fc40e8..8e46311 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -161,6 +161,12 @@ enum AccessibilityRole {
     AnnotationRole,
     SliderThumbRole,
     IgnoredRole,
+    TabRole,
+    TabListRole,
+    TabPanelRole,
+    TreeRole,
+    TreeItemRole,
+    DirectoryRole,
     
     // ARIA Grouping roles
     LandmarkApplicationRole,
@@ -171,6 +177,9 @@ enum AccessibilityRole {
     LandmarkNavigationRole,
     LandmarkSearchRole,
     
+    ApplicationAlertRole,
+    ApplicationAlertDialogRole,
+    ApplicationDialogRole,
     ApplicationLogRole,
     ApplicationMarqueeRole,
     ApplicationStatusRole,
@@ -178,6 +187,7 @@ enum AccessibilityRole {
     
     DocumentRole,
     DocumentArticleRole,
+    DocumentMathRole,
     DocumentNoteRole,
     DocumentRegionRole,
     
@@ -225,7 +235,7 @@ struct PlainTextRange {
         , length(l)
     { }
     
-    bool isNull() const { return start == 0 && length == 0; }
+    bool isNull() const { return !start && !length; }
 };
 
 class AccessibilityObject : public RefCounted<AccessibilityObject> {
@@ -237,64 +247,75 @@ public:
         
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
-    virtual bool isAccessibilityRenderObject() const { return false; };
-    virtual bool isAnchor() const { return false; };
-    virtual bool isAttachment() const { return false; };
-    virtual bool isHeading() const { return false; };
-    virtual bool isLink() const { return false; };
-    virtual bool isImage() const { return false; };
-    virtual bool isNativeImage() const { return false; };
-    virtual bool isImageButton() const { return false; };
-    virtual bool isPasswordField() const { return false; };
-    virtual bool isTextControl() const { return false; };
-    virtual bool isNativeTextControl() const { return false; };
-    virtual bool isWebArea() const { return false; };
-    virtual bool isCheckboxOrRadio() const { return false; };
-    virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isAccessibilityRenderObject() const { return false; }
+    virtual bool isAnchor() const { return false; }
+    virtual bool isAttachment() const { return false; }
+    virtual bool isHeading() const { return false; }
+    virtual bool isLink() const { return false; }
+    virtual bool isImage() const { return false; }
+    virtual bool isNativeImage() const { return false; }
+    virtual bool isImageButton() const { return false; }
+    virtual bool isPasswordField() const { return false; }
+    virtual bool isTextControl() const { return false; }
+    virtual bool isNativeTextControl() const { return false; }
+    virtual bool isWebArea() const { return false; }
+    virtual bool isCheckboxOrRadio() const { return false; }
+    virtual bool isListBox() const { return roleValue() == ListBoxRole; }
     virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
-    virtual bool isFileUploadButton() const { return false; };
+    virtual bool isFileUploadButton() const { return false; }
     virtual bool isInputImage() const { return false; }
-    virtual bool isProgressIndicator() const { return false; };
-    virtual bool isSlider() const { return false; };
-    virtual bool isControl() const { return false; };
-    virtual bool isList() const { return false; };
-    virtual bool isDataTable() const { return false; };
-    virtual bool isTableRow() const { return false; };
-    virtual bool isTableColumn() const { return false; };
-    virtual bool isTableCell() const { return false; };
-    virtual bool isFieldset() const { return false; };
-    virtual bool isGroup() const { return false; };
+    virtual bool isProgressIndicator() const { return false; }
+    virtual bool isSlider() const { return false; }
+    virtual bool isControl() const { return false; }
+    virtual bool isList() const { return false; }
+    virtual bool isDataTable() const { return false; }
+    virtual bool isTableRow() const { return false; }
+    virtual bool isTableColumn() const { return false; }
+    virtual bool isTableCell() const { return false; }
+    virtual bool isFieldset() const { return false; }
+    virtual bool isGroup() const { return false; }
+    bool isTabList() const { return roleValue() == TabListRole; }
+    bool isTabItem() const { return roleValue() == TabRole; }
     bool isRadioGroup() const { return roleValue() == RadioGroupRole; }
+    bool isComboBox() const { return roleValue() == ComboBoxRole; }
+    bool isTree() const { return roleValue() == TreeRole; }
+    bool isTreeItem() const { return roleValue() == TreeItemRole; }
+    bool isScrollbar() const { return roleValue() == ScrollBarRole; }
+    bool isButton() const { return roleValue() == ButtonRole; }
     
-    virtual bool isChecked() const { return false; };
-    virtual bool isEnabled() const { return false; };
-    virtual bool isSelected() const { return false; };
-    virtual bool isFocused() const { return false; };
-    virtual bool isHovered() const { return false; };
-    virtual bool isIndeterminate() const { return false; };
-    virtual bool isLoaded() const { return false; };
-    virtual bool isMultiSelect() const { return false; };
-    virtual bool isOffScreen() const { return false; };
-    virtual bool isPressed() const { return false; };
-    virtual bool isReadOnly() const { return false; };
-    virtual bool isVisited() const { return false; };
-    virtual bool isRequired() const { return false; };
-
-    virtual bool canSetFocusAttribute() const { return false; };
-    virtual bool canSetTextRangeAttributes() const { return false; };
-    virtual bool canSetValueAttribute() const { return false; };
+    virtual bool isChecked() const { return false; }
+    virtual bool isEnabled() const { return false; }
+    virtual bool isSelected() const { return false; }
+    virtual bool isFocused() const { return false; }
+    virtual bool isHovered() const { return false; }
+    virtual bool isIndeterminate() const { return false; }
+    virtual bool isLoaded() const { return false; }
+    virtual bool isMultiSelect() const { return false; }
+    virtual bool isOffScreen() const { return false; }
+    virtual bool isPressed() const { return false; }
+    virtual bool isReadOnly() const { return false; }
+    virtual bool isVisited() const { return false; }
+    virtual bool isRequired() const { return false; }
+    virtual bool isLinked() const { return false; }
+    virtual bool isExpanded() const { return false; }
+    virtual void setIsExpanded(bool) { }
+
+    virtual bool canSetFocusAttribute() const { return false; }
+    virtual bool canSetTextRangeAttributes() const { return false; }
+    virtual bool canSetValueAttribute() const { return false; }
     virtual bool canSetSelectedAttribute() const { return false; }
     virtual bool canSetSelectedChildrenAttribute() const { return false; }
+    virtual bool canSetExpandedAttribute() const { return false; }
     
-    virtual bool hasIntValue() const { return false; };
+    virtual bool hasIntValue() const { return false; }
 
-    bool accessibilityShouldUseUniqueId() const { return true; };
-    virtual bool accessibilityIsIgnored() const  { return true; };
+    bool accessibilityShouldUseUniqueId() const { return true; }
+    virtual bool accessibilityIsIgnored() const  { return true; }
 
     virtual int headingLevel() const { return 0; }
     virtual int intValue() const { return 0; }
@@ -303,9 +324,21 @@ public:
     virtual float maxValueForRange() const { return 0.0f; }
     virtual float minValueForRange() const { return 0.0f; }
     virtual AccessibilityObject* selectedRadioButton() { return 0; }
+    virtual AccessibilityObject* selectedTabItem() { return 0; }    
     virtual int layoutCount() const { return 0; }
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
+    virtual bool supportsARIAOwns() const { return false; }
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const { }
+    virtual bool supportsARIAFlowTo() const { return false; }
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
+    
+    // ARIA drag and drop
+    virtual bool supportsARIADropping() { return false; }
+    virtual bool supportsARIADragging() { return false; }
+    virtual bool isARIAGrabbed() { return false; }
+    virtual void setARIAGrabbed(bool) { }
+    virtual void determineARIADropEffects(Vector<String>&) { }
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const { return 0; }
     virtual AccessibilityObject* focusedUIElement() const { return 0; }
@@ -331,7 +364,6 @@ public:
 
     void setRoleValue(AccessibilityRole role) { m_role = role; }
     virtual AccessibilityRole roleValue() const { return m_role; }
-    virtual String ariaAccessibilityName(const String&) const { return String(); }
     virtual String ariaLabeledByAttribute() const { return String(); }
     virtual String ariaDescribedByAttribute() const { return String(); }
     virtual String accessibilityDescription() const { return String(); }
@@ -370,20 +402,22 @@ public:
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-
+    virtual unsigned hierarchicalLevel() const { return 0; }
+    
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
     virtual void setSelectedTextRange(const PlainTextRange&) { }
     virtual void setValue(const String&) { }
     virtual void setSelected(bool) { }
-
+    virtual void setSelectedRows(AccessibilityChildrenVector&) { }
+    
     virtual void makeRangeVisible(const PlainTextRange&) { }
     virtual bool press() const;
     bool performDefaultAction() const { return press(); }
-
+    
     virtual AccessibilityOrientation orientation() const;
-    virtual void increment() { };
-    virtual void decrement() { };
+    virtual void increment() { }
+    virtual void decrement() { }
 
     virtual void childrenChanged() { }
     virtual const AccessibilityChildrenVector& children() { return m_children; }
@@ -392,10 +426,13 @@ public:
     virtual bool hasChildren() const { return m_haveChildren; }
     virtual void selectedChildren(AccessibilityChildrenVector&) { }
     virtual void visibleChildren(AccessibilityChildrenVector&) { }
+    virtual void tabChildren(AccessibilityChildrenVector&) { }
     virtual bool shouldFocusActiveDescendant() const { return false; }
     virtual AccessibilityObject* activeDescendant() const { return 0; }    
     virtual void handleActiveDescendantChanged() { }
 
+    static AccessibilityRole ariaRoleToWebCoreRole(const String&);
+    
     virtual VisiblePositionRange visiblePositionRange() const { return VisiblePositionRange(); }
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const { return VisiblePositionRange(); }
     
@@ -446,6 +483,18 @@ public:
 
     unsigned doAXLineForIndex(unsigned);
 
+    virtual String stringValueForMSAA() const { return String(); }
+    virtual String stringRoleForMSAA() const { return String(); }
+    virtual String nameForMSAA() const { return String(); }
+    virtual String descriptionForMSAA() const { return String(); }
+    
+    // Used by an ARIA tree to get all its rows.
+    void ariaTreeRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get all of its direct rows that it can disclose.
+    void ariaTreeItemDisclosedRows(AccessibilityChildrenVector&);
+    // Used by an ARIA tree item to get only its content, and not its child tree items and groups. 
+    void ariaTreeItemContent(AccessibilityChildrenVector&);
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index 4c50b9a..c57dd92 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -30,8 +30,8 @@
 #include "AccessibilityRenderObject.h"
 
 #include "AXObjectCache.h"
-#include "AccessibilityListBox.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
@@ -84,6 +84,7 @@ AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
     : AccessibilityObject()
     , m_renderer(renderer)
     , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
 {
     updateAccessibilityRole();
 #ifndef NDEBUG
@@ -166,7 +167,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
 
@@ -178,7 +179,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
     if (!m_renderer)
         return 0;
     
-    RenderObject *parent = m_renderer->parent();
+    RenderObject* parent = m_renderer->parent();
     if (!parent)
         return 0;
     
@@ -296,10 +297,10 @@ bool AccessibilityRenderObject::isSlider() const
 bool AccessibilityRenderObject::isMenuRelated() const
 {
     AccessibilityRole role = roleValue();
-    return  role == MenuRole ||
-            role == MenuBarRole ||
-            role == MenuButtonRole ||
-            role == MenuItemRole;
+    return role == MenuRole 
+        || role == MenuBarRole
+        || role == MenuButtonRole
+        || role == MenuItemRole;
 }    
 
 bool AccessibilityRenderObject::isMenu() const
@@ -505,6 +506,24 @@ AccessibilityObject* AccessibilityRenderObject::selectedRadioButton()
     }
     return 0;
 }
+
+AccessibilityObject* AccessibilityRenderObject::selectedTabItem()
+{
+    if (!isTabList())
+        return 0;
+    
+    // Find the child tab item that is selected (ie. the intValue == 1).
+    AccessibilityObject::AccessibilityChildrenVector tabs;
+    tabChildren(tabs);
+    
+    int count = tabs.size();
+    for (int i = 0; i < count; ++i) {
+        AccessibilityObject* object = m_children[i].get();
+        if (object->isTabItem() && object->intValue() == 1)
+            return object;
+    }
+    return 0;
+}
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
@@ -693,6 +712,40 @@ String AccessibilityRenderObject::helpText() const
     return String();
 }
     
+unsigned AccessibilityRenderObject::hierarchicalLevel() const
+{
+    if (!m_renderer)
+        return 0;
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(node);
+    String ariaLevel = element->getAttribute(aria_levelAttr);
+    if (!ariaLevel.isEmpty())
+        return ariaLevel.toInt();
+    
+    // Only tree item will calculate its level through the DOM currently.
+    if (roleValue() != TreeItemRole)
+        return 0;
+    
+    // Hierarchy leveling starts at 0.
+    // We measure tree hierarchy by the number of groups that the item is within.
+    unsigned level = 0;
+    AccessibilityObject* parent = parentObject();
+    while (parent) {
+        AccessibilityRole parentRole = parent->roleValue();
+        if (parentRole == GroupRole)
+            level++;
+        else if (parentRole == TreeRole)
+            break;
+        
+        parent = parent->parentObject();
+    }
+    
+    return level;
+}
+    
 String AccessibilityRenderObject::language() const
 {
     if (!m_renderer)
@@ -780,7 +833,7 @@ String AccessibilityRenderObject::valueDescription() const
     
 float AccessibilityRenderObject::valueForRange() const
 {
-    if (!isProgressIndicator() && !isSlider())
+    if (!isProgressIndicator() && !isSlider() && !isScrollbar())
         return 0.0f;
 
     return getAttribute(aria_valuenowAttr).toFloat();
@@ -807,6 +860,9 @@ String AccessibilityRenderObject::stringValue() const
     if (!m_renderer || isPasswordField())
         return String();
     
+    if (ariaRoleAttribute() == StaticTextRole)
+        return text();
+        
     if (m_renderer->isText())
         return textUnderElement();
     
@@ -864,56 +920,67 @@ static String accessibleNameForNode(Node* node)
     return String();
 }
 
-String AccessibilityRenderObject::ariaAccessibilityName(const String& s) const
+String AccessibilityRenderObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
 {
+    Vector<UChar> ariaLabel;
+    unsigned size = elements.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Element* idElement = elements[i];
+        
+        String nameFragment = accessibleNameForNode(idElement);
+        ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
+            nameFragment = accessibleNameForNode(n);
+            ariaLabel.append(nameFragment.characters(), nameFragment.length());
+        }
+            
+        if (i != size - 1)
+            ariaLabel.append(' ');
+    }
+    return String::adopt(ariaLabel);
+}
+
+    
+void AccessibilityRenderObject::elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& attribute) const
+{
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+
     Document* document = m_renderer->document();
     if (!document)
-        return String();
-
-    String idList = s;
+        return;
+    
+    String idList = getAttribute(attribute).string();
+    if (idList.isEmpty())
+        return;
+    
     idList.replace('\n', ' ');
     Vector<String> idVector;
     idList.split(' ', idVector);
-
-    Vector<UChar> ariaLabel;
+    
     unsigned size = idVector.size();
     for (unsigned i = 0; i < size; ++i) {
         String idName = idVector[i];
         Element* idElement = document->getElementById(idName);
-        if (idElement) {
-            String nameFragment = accessibleNameForNode(idElement);
-            ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
-                nameFragment = accessibleNameForNode(n);
-                ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            }
-            
-            if (i != size - 1)
-                ariaLabel.append(' ');
-        }
+        if (idElement)
+            elements.append(idElement);
     }
-    return String::adopt(ariaLabel);
 }
-
+    
+void AccessibilityRenderObject::ariaLabeledByElements(Vector<Element*>& elements) const
+{
+    elementsFromAttribute(elements, aria_labeledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labelledbyAttr);
+}
+   
 String AccessibilityRenderObject::ariaLabeledByAttribute() const
 {
-    Node* node = m_renderer->node();
-    if (!node)
-        return String();
-
-    if (!node->isElementNode())
-        return String();
-
-    // The ARIA spec uses the British spelling: "labelled." It seems prudent to support the American
-    // spelling ("labeled") as well.
-    String idList = getAttribute(aria_labeledbyAttr).string();
-    if (idList.isEmpty()) {
-        idList = getAttribute(aria_labelledbyAttr).string();
-        if (idList.isEmpty())
-            return String();
-    }
-
-    return ariaAccessibilityName(idList);
+    Vector<Element*> elements;
+    ariaLabeledByElements(elements);
+    
+    return accessibilityDescriptionForElements(elements);
 }
 
 static HTMLLabelElement* labelForElement(Element* element)
@@ -990,6 +1057,8 @@ String AccessibilityRenderObject::title() const
         || ariaRole == MenuItemRole
         || ariaRole == MenuButtonRole
         || ariaRole == RadioButtonRole
+        || ariaRole == CheckBoxRole
+        || ariaRole == TabRole
         || isHeading())
         return textUnderElement();
     
@@ -1001,11 +1070,10 @@ String AccessibilityRenderObject::title() const
 
 String AccessibilityRenderObject::ariaDescribedByAttribute() const
 {
-    String idList = getAttribute(aria_describedbyAttr).string();
-    if (idList.isEmpty())
-        return String();
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
     
-    return ariaAccessibilityName(idList);
+    return accessibilityDescriptionForElements(elements);
 }
 
 String AccessibilityRenderObject::accessibilityDescription() const
@@ -1032,7 +1100,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
     }
     
     if (isWebArea()) {
-        Document *document = m_renderer->document();
+        Document* document = m_renderer->document();
         Node* owner = document->ownerElement();
         if (owner) {
             if (owner->hasTagName(frameTag) || owner->hasTagName(iframeTag)) {
@@ -1048,12 +1116,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
         if (owner && owner->isHTMLElement())
             return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
     }
-    
-    if (roleValue() == DefinitionListTermRole)
-        return AXDefinitionListTermText();
-    if (roleValue() == DefinitionListDefinitionRole)
-        return AXDefinitionListDefinitionText();
-    
+
     return String();
 }
 
@@ -1198,6 +1261,8 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
 // or an internal anchor connection
 void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& linkedUIElements) const
 {
+    ariaFlowToElements(linkedUIElements);
+
     if (isAnchor()) {
         AccessibilityObject* linkedAXElement = internalLinkElement();
         if (linkedAXElement)
@@ -1208,6 +1273,71 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::hasTextAlternative() const
+{
+    // ARIA: section 2A, bullet #3 says if aria-labeledby or aria-label appears, it should
+    // override the "label" element association.
+    if (!ariaLabeledByAttribute().isEmpty() || !getAttribute(aria_labelAttr).string().isEmpty())
+        return true;
+        
+    return false;   
+}
+    
+bool AccessibilityRenderObject::supportsARIAFlowTo() const
+{
+    return !getAttribute(aria_flowtoAttr).string().isEmpty();
+}
+    
+void AccessibilityRenderObject::ariaFlowToElements(AccessibilityChildrenVector& flowTo) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_flowtoAttr);
+    
+    AXObjectCache* cache = axObjectCache();
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* flowToElement = cache->getOrCreate(element->renderer());
+        if (flowToElement)
+            flowTo.append(flowToElement);
+    }
+        
+}
+    
+bool AccessibilityRenderObject::supportsARIADropping()
+{
+    const AtomicString& dropEffect = getAttribute(aria_dropeffectAttr).string();
+    return !dropEffect.isEmpty();
+}
+
+bool AccessibilityRenderObject::supportsARIADragging()
+{
+    const AtomicString& grabbed = getAttribute(aria_grabbedAttr).string();
+    return equalIgnoringCase(grabbed, "true") || equalIgnoringCase(grabbed, "false");   
+}
+
+bool AccessibilityRenderObject::isARIAGrabbed()
+{
+    return elementAttributeValue(aria_grabbedAttr);
+}
+
+void AccessibilityRenderObject::setARIAGrabbed(bool grabbed)
+{
+    setElementAttributeValue(aria_grabbedAttr, grabbed);
+}
+
+void AccessibilityRenderObject::determineARIADropEffects(Vector<String>& effects)
+{
+    String dropEffects = getAttribute(aria_dropeffectAttr).string();
+    if (dropEffects.isEmpty()) {
+        effects.clear();
+        return;
+    }
+    
+    dropEffects.replace('\n', ' ');
+    dropEffects.split(' ', effects);
+}
+    
 bool AccessibilityRenderObject::exposesTitleUIElement() const
 {
     if (!isControl())
@@ -1217,6 +1347,9 @@ bool AccessibilityRenderObject::exposesTitleUIElement() const
     if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
         return false;
     
+    if (hasTextAlternative())
+        return false;
+    
     return true;
 }
     
@@ -1256,9 +1389,19 @@ bool AccessibilityRenderObject::ariaIsHidden() const
     return false;
 }
 
+bool AccessibilityRenderObject::isDescendantOfBarrenParent() const
+{
+    for (AccessibilityObject* object = parentObject(); object; object = object->parentObject()) {
+        if (!object->canHaveChildren())
+            return true;
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
-    // is the platform is interested in this object?
+    // Is the platform interested in this object?
     AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
     if (decision == IncludeObject)
         return false;
@@ -1276,6 +1419,10 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isPresentationalChildOfAriaRole())
         return true;
         
+    // If this element is within a parent that cannot have children, it should not be exposed.
+    if (isDescendantOfBarrenParent())
+        return true;    
+    
     if (roleValue() == IgnoredRole)
         return true;
     
@@ -1288,7 +1435,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->exposesTitleUIElement())
+    if (controlObject && !controlObject->exposesTitleUIElement() && controlObject->isCheckboxOrRadio())
         return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
@@ -1300,8 +1447,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // NOTE: BRs always have text boxes now, so the text box check here can be removed
     if (m_renderer->isText()) {
         // static text beneath MenuItems and MenuButtons are just reported along with the menu item, so it's ignored on an individual level
-        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
-            parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
+        if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole
+            || parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
         RenderText* renderText = toRenderText(m_renderer);
         if (m_renderer->isBR() || !renderText->firstTextBox())
@@ -1388,6 +1535,10 @@ int AccessibilityRenderObject::layoutCount() const
 
 String AccessibilityRenderObject::text() const
 {
+    // If this is a user defined static text, use the accessible name computation.
+    if (ariaRoleAttribute() == StaticTextRole)
+        return accessibilityDescription();
+    
     if (!isTextControl() || isPasswordField())
         return String();
     
@@ -1545,6 +1696,46 @@ bool AccessibilityRenderObject::isVisited() const
     return m_renderer->style()->pseudoState() == PseudoVisited;
 }
     
+bool AccessibilityRenderObject::isExpanded() const
+{
+    if (equalIgnoringCase(getAttribute(aria_expandedAttr).string(), "true"))
+        return true;
+    
+    return false;  
+}
+
+void AccessibilityRenderObject::setElementAttributeValue(const QualifiedName& attributeName, bool value)
+{
+    if (!m_renderer)
+        return;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return;
+    
+    Element* element = static_cast<Element*>(node);
+    element->setAttribute(attributeName, (value) ? "true" : "false");        
+}
+    
+bool AccessibilityRenderObject::elementAttributeValue(const QualifiedName& attributeName)
+{
+    if (!m_renderer)
+        return false;
+    
+    return equalIgnoringCase(getAttribute(attributeName).string(), "true");
+}
+    
+void AccessibilityRenderObject::setIsExpanded(bool isExpanded)
+{
+    // Combo boxes and tree items can be expanded (in different ways on different platforms).
+    // That action translates into setting the aria-expanded attribute to true.
+    AccessibilityRole role = roleValue();
+    if (role != ComboBoxRole && role != TreeItemRole)
+        return;
+    
+    setElementAttributeValue(aria_expandedAttr, isExpanded);
+}
+    
 bool AccessibilityRenderObject::isRequired() const
 {
     if (equalIgnoringCase(getAttribute(aria_requiredAttr).string(), "true"))
@@ -1562,9 +1753,56 @@ bool AccessibilityRenderObject::isSelected() const
     if (!node)
         return false;
     
+    String ariaSelected = getAttribute(aria_selectedAttr).string();
+    if (equalIgnoringCase(ariaSelected, "true"))
+        return true;    
+    
+    if (isTabItem() && isTabItemSelected())
+        return true;
+
     return false;
 }
 
+bool AccessibilityRenderObject::isTabItemSelected() const
+{
+    if (!isTabItem() || !m_renderer)
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return false;
+    
+    // The ARIA spec says a tab item can also be selected if it is aria-labeled by a tabpanel
+    // that has keyboard focus inside of it, or if a tabpanel in its aria-controls list has KB
+    // focus inside of it.
+    AccessibilityObject* focusedElement = focusedUIElement();
+    if (!focusedElement)
+        return false;
+    
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_controlsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        Element* element = elements[k];
+        AccessibilityObject* tabPanel = axObjectCache()->getOrCreate(element->renderer());
+
+        // A tab item should only control tab panels.
+        if (!tabPanel || tabPanel->roleValue() != TabPanelRole)
+            continue;
+        
+        AccessibilityObject* checkFocusElement = focusedElement;
+        // Check if the focused element is a descendant of the element controlled by the tab item.
+        while (checkFocusElement) {
+            if (tabPanel == checkFocusElement)
+                return true;
+            checkFocusElement = checkFocusElement->parentObject();
+        }
+    }
+    
+    return false;
+}
+    
 bool AccessibilityRenderObject::isFocused() const
 {
     if (!m_renderer)
@@ -1580,8 +1818,8 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->node() || 
-        (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
+    if (focusedNode == m_renderer->node()
+        || (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
     return false;
@@ -1613,6 +1851,26 @@ void AccessibilityRenderObject::changeValueByPercent(float percentChange)
     axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
 }
     
+void AccessibilityRenderObject::setSelected(bool enabled)
+{
+    setElementAttributeValue(aria_selectedAttr, enabled);
+}
+
+void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& selectedRows)
+{
+    // Setting selected rows only works on trees for now.
+    if (roleValue() != TreeRole)
+        return;
+    
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
+    unsigned count = selectedRows.size();
+    if (count > 1 && !isMultiselectable)
+        count = 1;
+    
+    for (unsigned k = 0; k < count; ++k)
+        selectedRows[k]->setSelected(true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
     if (!m_renderer)
@@ -1632,6 +1890,29 @@ void AccessibilityRenderObject::setValue(const String& string)
     }
 }
 
+void AccessibilityRenderObject::ariaOwnsElements(AccessibilityChildrenVector& axObjects) const
+{
+    Vector<Element*> elements;
+    elementsFromAttribute(elements, aria_ownsAttr);
+    
+    unsigned count = elements.size();
+    for (unsigned k = 0; k < count; ++k) {
+        RenderObject* render = elements[k]->renderer();
+        AccessibilityObject* obj = axObjectCache()->getOrCreate(render);
+        if (obj)
+            axObjects.append(obj);
+    }
+}
+
+bool AccessibilityRenderObject::supportsARIAOwns() const
+{
+    if (!m_renderer)
+        return false;
+    const AtomicString& ariaOwns = getAttribute(aria_ownsAttr).string();
+
+    return !ariaOwns.isEmpty();
+}
+    
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
@@ -1777,7 +2058,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
 
 VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsigned lineCount) const
 {
-    if (lineCount == 0 || !m_renderer)
+    if (!lineCount || !m_renderer)
         return VisiblePositionRange();
     
     // iterate over the lines
@@ -1785,7 +2066,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // last offset of the last line
     VisiblePosition visiblePos = m_renderer->document()->renderer()->positionForCoordinates(0, 0);
     VisiblePosition savedVisiblePos;
-    while (--lineCount != 0) {
+    while (--lineCount) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -1900,9 +2181,8 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         return;
     
     // make selection and tell the document to use it. if it's zero length, then move to that position
-    if (range.start == range.end) {
+    if (range.start == range.end)
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
-    }
     else {
         VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
@@ -1998,7 +2278,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // iterate to the specified line
     VisiblePosition visiblePos = visiblePositionForIndex(0);
     VisiblePosition savedVisiblePos;
-    for (unsigned lineCount = lineNumber; lineCount != 0; lineCount -= 1) {
+    for (unsigned lineCount = lineNumber; lineCount; lineCount -= 1) {
         savedVisiblePos = visiblePos;
         visiblePos = nextLinePosition(visiblePos, 0);
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
@@ -2053,8 +2333,8 @@ String AccessibilityRenderObject::doAXStringForRange(const PlainTextRange& range
     if (isPasswordField())
         return String();
     
-    if (range.length == 0)
-        return "";
+    if (!range.length)
+        return String();
     
     if (!isTextControl())
         return String();
@@ -2081,7 +2361,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
     
-    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parent());
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
@@ -2159,14 +2439,14 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
     case ProgressIndicatorRole:
     case ToolbarRole:
     case OutlineRole:
+    case TreeRole:
+    case GridRole:
     /* FIXME: replace these with actual roles when they are added to AccessibilityRole
     composite
     alert
     alertdialog
-    grid
     status
     timer
-    tree
     */
         return true;
     default:
@@ -2176,19 +2456,22 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->node() && !renderer()->node()->isElementNode())
+    if (!m_renderer)
         return 0;
-    Element* element = static_cast<Element*>(renderer()->node());
+    
+    if (m_renderer->node() && !m_renderer->node()->isElementNode())
+        return 0;
+    Element* element = static_cast<Element*>(m_renderer->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
         return 0;
     
-    Element* target = renderer()->document()->getElementById(activeDescendantAttrStr);
+    Element* target = document()->getElementById(activeDescendantAttrStr);
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
+    AccessibilityObject* obj = axObjectCache()->getOrCreate(target->renderer());
     if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -2207,7 +2490,7 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
+        doc->axObjectCache()->postNotification(m_renderer, AXObjectCache::AXActiveDescendantChanged, true);
 }
 
 AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
@@ -2247,80 +2530,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
     return 0;
 }
-    
-typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
-
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
-
-static const ARIARoleMap& createARIARoleMap()
-{
-    const RoleEntry roles[] = {
-        { "application", LandmarkApplicationRole },
-        { "article", DocumentArticleRole },
-        { "banner", LandmarkBannerRole },
-        { "button", ButtonRole },
-        { "checkbox", CheckBoxRole },
-        { "complementary", LandmarkComplementaryRole },
-        { "contentinfo", LandmarkContentInfoRole },
-        { "grid", TableRole },
-        { "gridcell", CellRole },
-        { "columnheader", ColumnHeaderRole },
-        { "definition", DefinitionListDefinitionRole },
-        { "document", DocumentRole },
-        { "rowheader", RowHeaderRole },
-        { "group", GroupRole },
-        { "heading", HeadingRole },
-        { "img", ImageRole },
-        { "link", WebCoreLinkRole },
-        { "list", ListRole },        
-        { "listitem", GroupRole },        
-        { "listbox", ListBoxRole },
-        { "log", ApplicationLogRole },
-        // "option" isn't here because it may map to different roles depending on the parent element's role
-        { "main", LandmarkMainRole },
-        { "marquee", ApplicationMarqueeRole },
-        { "menu", MenuRole },
-        { "menubar", GroupRole },
-        // "menuitem" isn't here because it may map to different roles depending on the parent element's role
-        { "menuitemcheckbox", MenuItemRole },
-        { "menuitemradio", MenuItemRole },
-        { "note", DocumentNoteRole },
-        { "navigation", LandmarkNavigationRole },
-        { "option", ListBoxOptionRole },
-        { "presentation", IgnoredRole },
-        { "progressbar", ProgressIndicatorRole },
-        { "radio", RadioButtonRole },
-        { "radiogroup", RadioGroupRole },
-        { "region", DocumentRegionRole },
-        { "row", RowRole },
-        { "range", SliderRole },
-        { "search", LandmarkSearchRole },
-        { "separator", SplitterRole },
-        { "slider", SliderRole },
-        { "spinbutton", ProgressIndicatorRole },
-        { "status", ApplicationStatusRole },
-        { "textbox", TextAreaRole },
-        { "timer", ApplicationTimerRole },
-        { "toolbar", ToolbarRole },
-        { "tooltip", UserInterfaceTooltipRole }
-    };
-    ARIARoleMap& roleMap = *new ARIARoleMap;
-        
-    const unsigned numRoles = sizeof(roles) / sizeof(roles[0]);
-    for (unsigned i = 0; i < numRoles; ++i)
-        roleMap.set(roles[i].ariaRole, roles[i].webcoreRole);
-    return roleMap;
-}
-
-static AccessibilityRole ariaRoleToWebCoreRole(String value)
-{
-    ASSERT(!value.isEmpty() && !value.isNull());
-    static const ARIARoleMap& roleMap = createARIARoleMap();
-    return roleMap.get(value);
-}
 
 AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
 {
@@ -2332,14 +2541,14 @@ AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
     if (role)
         return role;
     // selects and listboxes both have options as child roles, but they map to different roles within WebCore
-    if (equalIgnoringCase(ariaRole,"option")) {
+    if (equalIgnoringCase(ariaRole, "option")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
             return MenuItemRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == ListBoxRole)
             return ListBoxOptionRole;
     }
     // an aria "menuitem" may map to MenuButton or MenuItem depending on its parent
-    if (equalIgnoringCase(ariaRole,"menuitem")) {
+    if (equalIgnoringCase(ariaRole, "menuitem")) {
         if (parentObjectUnignored()->ariaRoleAttribute() == GroupRole)
             return MenuButtonRole;
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuRole)
@@ -2418,7 +2627,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel() != 0)
+    if (headingLevel())
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2436,12 +2645,24 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     return UnknownRole;
 }
 
+AccessibilityOrientation AccessibilityRenderObject::orientation() const
+{
+    const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr).string();
+    if (equalIgnoringCase(ariaOrientation, "horizontal"))
+        return AccessibilityOrientationHorizontal;
+    if (equalIgnoringCase(ariaOrientation, "vertical"))
+        return AccessibilityOrientationVertical;
+    
+    return AccessibilityObject::orientation();
+}
+    
 bool AccessibilityRenderObject::isPresentationalChildOfAriaRole() const
 {
     // Walk the parent chain looking for a parent that has presentational children
     AccessibilityObject* parent;
     for (parent = parentObject(); parent && !parent->ariaRoleHasPresentationalChildren(); parent = parent->parentObject())
-        ;
+    { }
+    
     return parent;
 }
     
@@ -2474,20 +2695,27 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         return false;
 
     switch (roleValue()) {
-        case WebCoreLinkRole:
-        case ImageMapLinkRole:
-        case TextFieldRole:
-        case TextAreaRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case SliderRole:
-            return true;
-        default:
-            return false;
+    case WebCoreLinkRole:
+    case ImageMapLinkRole:
+    case TextFieldRole:
+    case TextAreaRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case SliderRole:
+        return true;
+    default:
+        return false;
     }
 }
+    
+bool AccessibilityRenderObject::canSetExpandedAttribute() const
+{
+    // An object can be expanded if it aria-expanded is true or false.
+    String ariaExpanded = getAttribute(aria_expandedAttr).string();
+    return equalIgnoringCase(ariaExpanded, "true") || equalIgnoringCase(ariaExpanded, "false");
+}
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
@@ -2531,16 +2759,18 @@ bool AccessibilityRenderObject::canHaveChildren() const
     
     // Elements that should not have children
     switch (roleValue()) {
-        case ImageRole:
-        case ButtonRole:
-        case PopUpButtonRole:
-        case CheckBoxRole:
-        case RadioButtonRole:
-        case StaticTextRole:
-        case ListBoxOptionRole:
-            return false;
-        default:
-            return true;
+    case ImageRole:
+    case ButtonRole:
+    case PopUpButtonRole:
+    case CheckBoxRole:
+    case RadioButtonRole:
+    case TabRole:
+    case StaticTextRole:
+    case ListBoxOptionRole:
+    case ScrollBarRole:
+        return false;
+    default:
+        return true;
     }
 }
 
@@ -2604,17 +2834,42 @@ void AccessibilityRenderObject::addChildren()
     }
 }
 
+void AccessibilityRenderObject::ariaTreeSelectedRows(AccessibilityChildrenVector& result)
+{
+    // Get all the rows. 
+    AccessibilityChildrenVector allRows;
+    ariaTreeRows(allRows);
+
+    // Determine which rows are selected.
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
+
+    // Prefer active descendant over aria-selected.
+    AccessibilityObject* activeDesc = activeDescendant();
+    if (activeDesc && activeDesc->isTreeItem()) {
+        result.append(activeDesc);    
+        if (!isMultiselectable)
+            return;
+    }
+
+    unsigned count = allRows.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (allRows[k]->isSelected()) {
+            result.append(allRows[k]);
+            if (!isMultiselectable)
+                break;
+        }
+    }
+}
+    
 void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildrenVector& result)
 {
     AccessibilityObject* child = firstChild();
-    bool isMultiselectable = false;
     
     Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
-    String multiselectablePropertyStr = element->getAttribute("aria-multiselectable").string();
-    isMultiselectable = equalIgnoringCase(multiselectablePropertyStr, "true");
+    bool isMultiselectable = elementAttributeValue(aria_multiselectableAttr);
     
     while (child) {
         // every child should have aria-role option, and if so, check for selected attribute/state
@@ -2625,7 +2880,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (childRenderer && ariaRole == ListBoxOptionRole) {
             Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
-                String selectedAttrString = childElement->getAttribute("aria-selected").string();
+                String selectedAttrString = childElement->getAttribute(aria_selectedAttr).string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
                     result.append(child);
                     if (isMultiselectable)
@@ -2642,11 +2897,11 @@ void AccessibilityRenderObject::selectedChildren(AccessibilityChildrenVector& re
     ASSERT(result.isEmpty());
 
     // only listboxes should be asked for their selected children. 
-    if (ariaRoleAttribute() != ListBoxRole) { // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
-        ASSERT_NOT_REACHED(); 
-        return;
-    }
-    return ariaListboxSelectedChildren(result);
+    AccessibilityRole role = roleValue();
+    if (role == ListBoxRole) // native list boxes would be AccessibilityListBoxes, so only check for aria list boxes
+        ariaListboxSelectedChildren(result);
+    else if (role == TreeRole)
+        ariaTreeSelectedRows(result);
 }
 
 void AccessibilityRenderObject::ariaListboxVisibleChildren(AccessibilityChildrenVector& result)      
@@ -2673,6 +2928,17 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
+void AccessibilityRenderObject::tabChildren(AccessibilityChildrenVector& result)
+{
+    ASSERT(roleValue() == TabListRole);
+    
+    unsigned length = m_children.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_children[i]->isTabItem())
+            result.append(m_children[i]);
+    }
+}
+    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2685,20 +2951,20 @@ const String& AccessibilityRenderObject::actionVerb() const
     DEFINE_STATIC_LOCAL(const String, noAction, ());
     
     switch (roleValue()) {
-        case ButtonRole:
-            return buttonAction;
-        case TextFieldRole:
-        case TextAreaRole:
-            return textFieldAction;
-        case RadioButtonRole:
-            return radioButtonAction;
-        case CheckBoxRole:
-            return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
-        case LinkRole:
-        case WebCoreLinkRole:
-            return linkAction;
-        default:
-            return noAction;
+    case ButtonRole:
+        return buttonAction;
+    case TextFieldRole:
+    case TextAreaRole:
+        return textFieldAction;
+    case RadioButtonRole:
+        return radioButtonAction;
+    case CheckBoxRole:
+        return isChecked() ? checkedCheckBoxAction : uncheckedCheckBoxAction;
+    case LinkRole:
+    case WebCoreLinkRole:
+        return linkAction;
+    default:
+        return noAction;
     }
 }
      
@@ -2711,4 +2977,101 @@ void AccessibilityRenderObject::updateBackingStore()
     m_renderer->document()->updateLayoutIgnorePendingStylesheets();
 }
 
+static bool isLinkable(const AccessibilityRenderObject& object)
+{
+    if (!object.renderer())
+        return false;
+
+    // See https://wiki.mozilla.org/Accessibility/AT-Windows-API for the elements
+    // Mozilla considers linkable.
+    return object.isLink() || object.isImage() || object.renderer()->isText();
+}
+
+String AccessibilityRenderObject::stringValueForMSAA() const
+{
+    if (isLinkable(*this)) {
+        Element* anchor = anchorElement();
+        if (anchor && anchor->hasTagName(aTag))
+            return static_cast<HTMLAnchorElement*>(anchor)->href();
+    }
+
+    return stringValue();
+}
+
+bool AccessibilityRenderObject::isLinked() const
+{
+    if (!isLinkable(*this))
+        return false;
+
+    Element* anchor = anchorElement();
+    if (!anchor || !anchor->hasTagName(aTag))
+        return false;
+
+    return !static_cast<HTMLAnchorElement*>(anchor)->href().isEmpty();
+}
+
+String AccessibilityRenderObject::nameForMSAA() const
+{
+    if (m_renderer && m_renderer->isText())
+        return textUnderElement();
+
+    return title();
+}
+
+static bool shouldReturnTagNameAsRoleForMSAA(const Element& element)
+{
+    // See "document structure",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    // FIXME: Add the other tag names that should be returned as the role.
+    return element.hasTagName(h1Tag) || element.hasTagName(h2Tag) 
+        || element.hasTagName(h3Tag) || element.hasTagName(h4Tag)
+        || element.hasTagName(h5Tag) || element.hasTagName(h6Tag);
+}
+
+String AccessibilityRenderObject::stringRoleForMSAA() const
+{
+    if (!m_renderer)
+        return String();
+
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return String();
+
+    Element* element = static_cast<Element*>(node);
+    if (!shouldReturnTagNameAsRoleForMSAA(*element))
+        return String();
+
+    return element->tagName();
+}
+
+String AccessibilityRenderObject::positionalDescriptionForMSAA() const
+{
+    // See "positional descriptions",
+    // https://wiki.mozilla.org/Accessibility/AT-Windows-API
+    if (isHeading())
+        return "L" + String::number(headingLevel());
+
+    // FIXME: Add positional descriptions for other elements.
+    return String();
+}
+
+String AccessibilityRenderObject::descriptionForMSAA() const
+{
+    String description = positionalDescriptionForMSAA();
+    if (!description.isEmpty())
+        return description;
+
+    description = accessibilityDescription();
+    if (!description.isEmpty()) {
+        // From the Mozilla MSAA implementation:
+        // "Signal to screen readers that this description is speakable and is not
+        // a formatted positional information description. Don't localize the
+        // 'Description: ' part of this string, it will be parsed out by assistive
+        // technologies."
+        return "Description: " + description;
+    }
+
+    return String();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index c6fd748..d537881 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -62,7 +62,7 @@ public:
     static PassRefPtr<AccessibilityRenderObject> create(RenderObject*);
     virtual ~AccessibilityRenderObject();
     
-    bool isAccessibilityRenderObject() const { return true; };
+    bool isAccessibilityRenderObject() const { return true; }
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -102,12 +102,16 @@ public:
     virtual bool isReadOnly() const;
     virtual bool isVisited() const;        
     virtual bool isRequired() const;
+    virtual bool isLinked() const;
+    virtual bool isExpanded() const;
+    virtual void setIsExpanded(bool);
 
     const AtomicString& getAttribute(const QualifiedName&) const;
     virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
-    
+    virtual bool canSetExpandedAttribute() const;
+
     virtual bool hasIntValue() const;
     
     virtual bool accessibilityIsIgnored() const;
@@ -119,6 +123,7 @@ public:
     virtual float maxValueForRange() const;
     virtual float minValueForRange() const;
     virtual AccessibilityObject* selectedRadioButton();
+    virtual AccessibilityObject* selectedTabItem();
     virtual int layoutCount() const;
     
     virtual AccessibilityObject* doAccessibilityHitTest(const IntPoint&) const;
@@ -136,6 +141,8 @@ public:
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
     virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
+    virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
+    virtual bool supportsARIAOwns() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -167,7 +174,6 @@ public:
     virtual PlainTextRange selectedTextRange() const;
     virtual VisibleSelection selection() const;
     virtual String stringValue() const;
-    virtual String ariaAccessibilityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
     virtual String title() const;
     virtual String ariaDescribedByAttribute() const;
@@ -185,13 +191,17 @@ public:
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
     virtual String language() const;
-    
+    virtual unsigned hierarchicalLevel() const;
+
     virtual const AccessibilityChildrenVector& children();
     
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void setSelected(bool);
+    virtual void setSelectedRows(AccessibilityChildrenVector&);
     virtual void changeValueByPercent(float percentChange);
+    virtual AccessibilityOrientation orientation() const;
     virtual void increment();
     virtual void decrement();
     
@@ -201,6 +211,7 @@ public:
     virtual bool canHaveChildren() const;
     virtual void selectedChildren(AccessibilityChildrenVector&);
     virtual void visibleChildren(AccessibilityChildrenVector&);
+    virtual void tabChildren(AccessibilityChildrenVector&);
     virtual bool shouldFocusActiveDescendant() const;
     virtual AccessibilityObject* activeDescendant() const;
     virtual void handleActiveDescendantChanged();
@@ -209,6 +220,14 @@ public:
     virtual VisiblePositionRange visiblePositionRangeForLine(unsigned) const;
     virtual IntRect boundsForVisiblePositionRange(const VisiblePositionRange&) const;
     virtual void setSelectedVisiblePositionRange(const VisiblePositionRange&) const;
+    virtual bool supportsARIAFlowTo() const;
+    virtual void ariaFlowToElements(AccessibilityChildrenVector&) const;
+
+    virtual bool supportsARIADropping();
+    virtual bool supportsARIADragging();
+    virtual bool isARIAGrabbed();
+    virtual void setARIAGrabbed(bool);
+    virtual void determineARIADropEffects(Vector<String>&);
     
     virtual VisiblePosition visiblePositionForPoint(const IntPoint&) const;
     virtual VisiblePosition visiblePositionForIndex(unsigned indexValue, bool lastIndexOK) const;    
@@ -224,13 +243,19 @@ public:
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
     virtual void updateBackingStore();
-    
+
+    virtual String stringValueForMSAA() const;
+    virtual String stringRoleForMSAA() const;
+    virtual String nameForMSAA() const;
+    virtual String descriptionForMSAA() const;
+
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
     mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
+    void ariaLabeledByElements(Vector<Element*>& elements) const;
     
     virtual bool isDetached() const { return !m_renderer; }
 
@@ -238,18 +263,30 @@ private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
     bool ariaIsHidden() const;
+    bool isDescendantOfBarrenParent() const;
+    bool hasTextAlternative() const;
+    String positionalDescriptionForMSAA() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
     AccessibilityRole determineAccessibilityRole();
     AccessibilityRole determineAriaRoleAttribute() const;
 
+    bool isTabItemSelected() const;
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
     AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
+    void ariaTreeSelectedRows(AccessibilityChildrenVector&);
+    
+    bool elementAttributeValue(const QualifiedName&);
+    void setElementAttributeValue(const QualifiedName&, bool);
+    
+    String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
+    void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
+    
     void markChildrenDirty() const { m_childrenDirty = true; }
 };
     
diff --git a/WebCore/accessibility/AccessibilitySlider.cpp b/WebCore/accessibility/AccessibilitySlider.cpp
index 5aca672..77f4dcc 100644
--- a/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/WebCore/accessibility/AccessibilitySlider.cpp
@@ -68,18 +68,18 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     
     ControlPart styleAppearance = style->appearance();
     switch (styleAppearance) {
-        case SliderThumbHorizontalPart:
-        case SliderHorizontalPart:
-        case MediaSliderPart:
-            return AccessibilityOrientationHorizontal;
+    case SliderThumbHorizontalPart:
+    case SliderHorizontalPart:
+    case MediaSliderPart:
+        return AccessibilityOrientationHorizontal;
+    
+    case SliderThumbVerticalPart: 
+    case SliderVerticalPart:
+    case MediaVolumeSliderPart:
+        return AccessibilityOrientationVertical;
         
-        case SliderThumbVerticalPart: 
-        case SliderVerticalPart:
-        case MediaVolumeSliderPart:
-            return AccessibilityOrientationVertical;
-            
-        default:
-            return AccessibilityOrientationHorizontal;
+    default:
+        return AccessibilityOrientationHorizontal;
     }
 }
     
diff --git a/WebCore/accessibility/AccessibilitySlider.h b/WebCore/accessibility/AccessibilitySlider.h
index 254ebdd..e1e3812 100644
--- a/WebCore/accessibility/AccessibilitySlider.h
+++ b/WebCore/accessibility/AccessibilitySlider.h
@@ -33,58 +33,58 @@
 
 namespace WebCore {
 
-    class HTMLInputElement;
+class HTMLInputElement;
 
-    class AccessibilitySlider : public AccessibilityRenderObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySlider> create(RenderObject*);
-        virtual ~AccessibilitySlider() { }
+class AccessibilitySlider : public AccessibilityRenderObject {
+    
+public:
+    static PassRefPtr<AccessibilitySlider> create(RenderObject*);
+    virtual ~AccessibilitySlider() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        virtual bool isSlider() const { return true; }
+    virtual bool isSlider() const { return true; }
 
-        virtual const AccessibilityChildrenVector& children();
-        virtual void addChildren();
+    virtual const AccessibilityChildrenVector& children();
+    virtual void addChildren();
 
-        virtual bool canSetValueAttribute() const { return true; };
-        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+    virtual bool canSetValueAttribute() const { return true; }
+    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
-        virtual void setValue(const String&);
-        virtual float valueForRange() const;
-        virtual float maxValueForRange() const;
-        virtual float minValueForRange() const;
-        virtual AccessibilityOrientation orientation() const;
+    virtual void setValue(const String&);
+    virtual float valueForRange() const;
+    virtual float maxValueForRange() const;
+    virtual float minValueForRange() const;
+    virtual AccessibilityOrientation orientation() const;
 
-    protected:
-        AccessibilitySlider(RenderObject*);
+protected:
+    AccessibilitySlider(RenderObject*);
 
-    private:
-        HTMLInputElement* element() const;
-    };
+private:
+    HTMLInputElement* element() const;
+};
 
-    class AccessibilitySliderThumb : public AccessibilityObject {
-        
-    public:
-        static PassRefPtr<AccessibilitySliderThumb> create();
-        virtual ~AccessibilitySliderThumb() { }
+class AccessibilitySliderThumb : public AccessibilityObject {
+    
+public:
+    static PassRefPtr<AccessibilitySliderThumb> create();
+    virtual ~AccessibilitySliderThumb() { }
 
-        virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
-        virtual bool accessibilityIsIgnored() const { return false; }
+    virtual AccessibilityRole roleValue() const { return SliderThumbRole; }
+    virtual bool accessibilityIsIgnored() const { return false; }
 
-        void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
-        virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
+    void setParentObject(AccessibilitySlider* slider) { m_parentSlider = slider; }
+    virtual AccessibilityObject* parentObject() const { return m_parentSlider; }
 
-        virtual IntSize size() const;
-        virtual IntRect elementRect() const;
+    virtual IntSize size() const;
+    virtual IntRect elementRect() const;
 
-    private:
-        AccessibilitySliderThumb();
+private:
+    AccessibilitySliderThumb();
 
-        AccessibilitySlider* m_parentSlider;
-    };
+    AccessibilitySlider* m_parentSlider;
+};
 
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityTable.cpp b/WebCore/accessibility/AccessibilityTable.cpp
index 928ef2c..9ac1046 100644
--- a/WebCore/accessibility/AccessibilityTable.cpp
+++ b/WebCore/accessibility/AccessibilityTable.cpp
@@ -29,15 +29,15 @@
 #include "config.h"
 #include "AccessibilityTable.h"
 
+#include "AXObjectCache.h"
 #include "AccessibilityTableCell.h"
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "AXObjectCache.h"
 #include "HTMLNames.h"
-#include "HTMLTableElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "RenderObject.h"
 #include "RenderTable.h"
 #include "RenderTableCell.h"
@@ -149,8 +149,8 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             HTMLTableCellElement* cellElement = static_cast<HTMLTableCellElement*>(cellNode);
             
             // in this case, the developer explicitly assigned a "data" table attribute
-            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty() || 
-                !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
+            if (!cellElement->headers().isEmpty() || !cellElement->abbr().isEmpty()
+                || !cellElement->axis().isEmpty() || !cellElement->scope().isEmpty())
                 return true;
             
             RenderStyle* renderStyle = cell->style();
@@ -158,15 +158,15 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
                 continue;
 
             // a cell needs to have matching bordered sides, before it can be considered a bordered cell.
-            if ((cell->borderTop() > 0 && cell->borderBottom() > 0) ||
-                (cell->borderLeft() > 0 && cell->borderRight() > 0))
+            if ((cell->borderTop() > 0 && cell->borderBottom() > 0)
+                || (cell->borderLeft() > 0 && cell->borderRight() > 0))
                 borderedCellCount++;
             
             // if the cell has a different color from the table and there is cell spacing,
             // then it is probably a data table cell (spacing and colors take the place of borders)
             Color cellColor = renderStyle->backgroundColor();
-            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0 && 
-                tableBGColor != cellColor && cellColor.alpha() != 1)
+            if (table->hBorderSpacing() > 0 && table->vBorderSpacing() > 0
+                && tableBGColor != cellColor && cellColor.alpha() != 1)
                 backgroundDifferenceCellCount++;
             
             // if we've found 10 "good" cells, we don't need to keep searching
diff --git a/WebCore/accessibility/AccessibilityTableColumn.cpp b/WebCore/accessibility/AccessibilityTableColumn.cpp
index e09d65e..ee8531e 100644
--- a/WebCore/accessibility/AccessibilityTableColumn.cpp
+++ b/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -29,12 +29,12 @@
 #include "config.h"
 #include "AccessibilityTableColumn.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "RenderTable.h"
-#include "RenderTableSection.h"
 #include "RenderTableCell.h"
+#include "RenderTableSection.h"
 
 using namespace std;
 
diff --git a/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp b/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39..3a2a241 100644
--- a/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
+++ b/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableHeaderContainer.h"
 
-#include "AccessibilityTable.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTable.h"
 
 using namespace std;
 
@@ -79,9 +79,8 @@ void AccessibilityTableHeaderContainer::addChildren()
     static_cast<AccessibilityTable*>(m_parentTable)->columnHeaders(m_children);
     
     unsigned length = m_children.size();
-    for (unsigned k = 0; k < length; ++k) {
+    for (unsigned k = 0; k < length; ++k)
         m_headerRect.unite(m_children[k]->elementRect());
-    }
 }
 
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityTableRow.cpp b/WebCore/accessibility/AccessibilityTableRow.cpp
index 53b479e..71f8b2b 100644
--- a/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "AccessibilityTableRow.h"
 
-#include "AccessibilityTableCell.h"
 #include "AXObjectCache.h"
+#include "AccessibilityTableCell.h"
 #include "HTMLNames.h"
 #include "HTMLTableRowElement.h"
 #include "RenderObject.h"
diff --git a/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
index d7238e1..85a65ed 100644
--- a/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
+++ b/WebCore/accessibility/chromium/AccessibilityObjectWrapper.h
@@ -27,6 +27,8 @@
 #ifndef AccessibilityObjectWrapper_h
 #define AccessibilityObjectWrapper_h
 
+#include <wtf/RefCounted.h>
+
 namespace WebCore {
 
     class AccessibilityObject;
@@ -41,8 +43,6 @@ namespace WebCore {
         AccessibilityObjectWrapper(AccessibilityObject* obj)
             : m_object(obj)
         {
-            // FIXME: Remove this once our immediate subclass no longer uses COM.
-            *addressOfCount() = 0;
         }
         AccessibilityObjectWrapper() : m_object(0) { }
 
diff --git a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index cc515ad..c30b006 100644
--- a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -43,6 +43,10 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
         if (!coreObject->isCheckboxOrRadio())
             return;
         g_signal_emit_by_name(coreObject->wrapper(), "state-change", "checked", coreObject->isChecked());
+    } else if (notification == AXSelectedChildrenChanged) {
+        if (!coreObject->isListBox())
+            return;
+        g_signal_emit_by_name(coreObject->wrapper(), "selection-changed");
     }
 }
 
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index c5f09ae..16ea948 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -35,6 +35,7 @@
 
 #include "AXObjectCache.h"
 #include "AccessibilityListBox.h"
+#include "AccessibilityListBoxOption.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilityTable.h"
 #include "AccessibilityTableCell.h"
@@ -43,6 +44,7 @@
 #include "AtomicString.h"
 #include "CString.h"
 #include "Document.h"
+#include "DocumentType.h"
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -106,6 +108,11 @@ static AccessibilityObject* core(AtkAction* action)
     return core(ATK_OBJECT(action));
 }
 
+static AccessibilityObject* core(AtkSelection* selection)
+{
+    return core(ATK_OBJECT(selection));
+}
+
 static AccessibilityObject* core(AtkText* text)
 {
     return core(ATK_OBJECT(text));
@@ -131,39 +138,72 @@ static AccessibilityObject* core(AtkTable* table)
     return core(ATK_OBJECT(table));
 }
 
+static AccessibilityObject* core(AtkDocument* document)
+{
+    return core(ATK_OBJECT(document));
+}
+
+static const gchar* nameFromChildren(AccessibilityObject* object)
+{
+    if (!object)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector children = object->children();
+    // Currently, object->stringValue() should be an empty String. This might not be the case down the road.
+    String name = object->stringValue();
+    for (unsigned i = 0; i < children.size(); ++i)
+        name += children.at(i).get()->stringValue();
+    return returnString(name);
+}
+
 static const gchar* webkit_accessible_get_name(AtkObject* object)
 {
     AccessibilityObject* coreObject = core(object);
+    if (!coreObject->isAccessibilityRenderObject())
+        return returnString(coreObject->stringValue());
+
+    AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
     if (coreObject->isControl()) {
-        AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
         AccessibilityObject* label = renderObject->correspondingLabelForControlElement();
-        if (label) {
-            AccessibilityRenderObject::AccessibilityChildrenVector children = label->children();
-            // Currently, label->stringValue() should be an empty String. This
-            // might not be the case down the road.
-            String name = label->stringValue();
-            for (unsigned i = 0; i < children.size(); ++i)
-                name += children.at(i).get()->stringValue();
-            return returnString(name);
+        if (label)
+            return returnString(nameFromChildren(label));
+    }
+
+    if (renderObject->isImage() || renderObject->isInputImage()) {
+        Node* node = renderObject->renderer()->node();
+        if (node && node->isHTMLElement()) {
+            // Get the attribute rather than altText String so as not to fall back on title.
+            String alt = static_cast<HTMLElement*>(node)->getAttribute(HTMLNames::altAttr);
+            if (!alt.isEmpty())
+                return returnString(alt);
         }
     }
+
     return returnString(coreObject->stringValue());
 }
 
 static const gchar* webkit_accessible_get_description(AtkObject* object)
 {
     AccessibilityObject* coreObject = core(object);
+    Node* node = 0;
+    if (coreObject->isAccessibilityRenderObject())
+        node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
+    if (!node || !node->isHTMLElement() || coreObject->ariaRoleAttribute() != UnknownRole)
+        return returnString(coreObject->accessibilityDescription());
 
     // atk_table_get_summary returns an AtkObject. We have no summary object, so expose summary here.
-    if (coreObject->roleValue() == TableRole && coreObject->ariaRoleAttribute() == UnknownRole) {
-        Node* node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
-        if (node && node->isHTMLElement()) {
-            String summary = static_cast<HTMLTableElement*>(node)->summary();
-            if (!summary.isEmpty())
-                return returnString(summary);
-        }
+    if (coreObject->roleValue() == TableRole) {
+        String summary = static_cast<HTMLTableElement*>(node)->summary();
+        if (!summary.isEmpty())
+            return returnString(summary);
     }
 
+    // The title attribute should be reliably available as the object's descripton.
+    // We do not want to fall back on other attributes in its absence. See bug 25524.
+    String title = static_cast<HTMLElement*>(node)->title();
+    if (!title.isEmpty())
+        return returnString(title);
+
     return returnString(coreObject->accessibilityDescription());
 }
 
@@ -181,9 +221,9 @@ static void setAtkRelationSetFromCoreObject(AccessibilityObject* coreObject, Atk
     }
 }
 
-static gpointer webkit_accessible_parent_class = NULL;
+static gpointer webkit_accessible_parent_class = 0;
 
-static AtkObject* webkit_accessible_get_parent(AtkObject* object)
+static AtkObject* atkParentOfWebView(AtkObject* object)
 {
     AccessibilityObject* coreParent = core(object)->parentObjectUnignored();
 
@@ -203,7 +243,19 @@ static AtkObject* webkit_accessible_get_parent(AtkObject* object)
     }
 
     if (!coreParent)
-        return NULL;
+        return 0;
+
+    return coreParent->wrapper();
+}
+
+static AtkObject* webkit_accessible_get_parent(AtkObject* object)
+{
+    AccessibilityObject* coreParent = core(object)->parentObjectUnignored();
+    if (!coreParent && core(object)->isWebArea())
+        return atkParentOfWebView(object);
+
+    if (!coreParent)
+        return 0;
 
     return coreParent->wrapper();
 }
@@ -216,14 +268,14 @@ static gint webkit_accessible_get_n_children(AtkObject* object)
 static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
 {
     AccessibilityObject* coreObject = core(object);
+    AccessibilityObject::AccessibilityChildrenVector children = coreObject->children();
+    if (index < 0 || static_cast<unsigned>(index) >= children.size())
+        return 0;
 
-    g_return_val_if_fail(index >= 0, NULL);
-    g_return_val_if_fail(static_cast<size_t>(index) < coreObject->children().size(), NULL);
-
-    AccessibilityObject* coreChild = coreObject->children().at(index).get();
+    AccessibilityObject* coreChild = children.at(index).get();
 
     if (!coreChild)
-        return NULL;
+        return 0;
 
     AtkObject* child = coreChild->wrapper();
     atk_object_set_parent(child, object);
@@ -237,7 +289,20 @@ static gint webkit_accessible_get_index_in_parent(AtkObject* object)
     AccessibilityObject* coreObject = core(object);
     AccessibilityObject* parent = coreObject->parentObjectUnignored();
 
-    g_return_val_if_fail(parent, 0);
+    if (!parent && core(object)->isWebArea()) {
+        AtkObject* atkParent = atkParentOfWebView(object);
+        if (!atkParent)
+            return -1;
+
+        unsigned count = atk_object_get_n_accessible_children(atkParent);
+        for (unsigned i = 0; i < count; ++i) {
+            AtkObject* child = atk_object_ref_accessible_child(atkParent, i);
+            bool childIsObject = child == object;
+            g_object_unref(child);
+            if (childIsObject)
+                return i;
+        }
+    }
 
     AccessibilityObject::AccessibilityChildrenVector children = parent->children();
     unsigned count = children.size();
@@ -246,7 +311,7 @@ static gint webkit_accessible_get_index_in_parent(AtkObject* object)
             return i;
     }
 
-    return 0;
+    return -1;
 }
 
 static AtkAttributeSet* addAttributeToSet(AtkAttributeSet* attributeSet, const char* name, const char* value)
@@ -261,7 +326,7 @@ static AtkAttributeSet* addAttributeToSet(AtkAttributeSet* attributeSet, const c
 
 static AtkAttributeSet* webkit_accessible_get_attributes(AtkObject* object)
 {
-    AtkAttributeSet* attributeSet = NULL;
+    AtkAttributeSet* attributeSet = 0;
 
     int headingLevel = core(object)->headingLevel();
     if (headingLevel) {
@@ -361,21 +426,21 @@ static AtkRole atkRole(AccessibilityRole role)
 
 static AtkRole webkit_accessible_get_role(AtkObject* object)
 {
-    AccessibilityObject* AXObject = core(object);
+    AccessibilityObject* axObject = core(object);
 
-    if (!AXObject)
+    if (!axObject)
         return ATK_ROLE_UNKNOWN;
 
     // WebCore does not seem to have a role for list items
-    if (AXObject->isGroup()) {
-        AccessibilityObject* parent = AXObject->parentObjectUnignored();
+    if (axObject->isGroup()) {
+        AccessibilityObject* parent = axObject->parentObjectUnignored();
         if (parent && parent->isList())
             return ATK_ROLE_LIST_ITEM;
     }
 
     // WebCore does not know about paragraph role, label role, or section role
-    if (AXObject->isAccessibilityRenderObject()) {
-        Node* node = static_cast<AccessibilityRenderObject*>(AXObject)->renderer()->node();
+    if (axObject->isAccessibilityRenderObject()) {
+        Node* node = static_cast<AccessibilityRenderObject*>(axObject)->renderer()->node();
         if (node) {
             if (node->hasTagName(HTMLNames::pTag))
                 return ATK_ROLE_PARAGRAPH;
@@ -387,10 +452,10 @@ static AtkRole webkit_accessible_get_role(AtkObject* object)
     }
 
     // Note: Why doesn't WebCore have a password field for this
-    if (AXObject->isPasswordField())
+    if (axObject->isPasswordField())
         return ATK_ROLE_PASSWORD_TEXT;
 
-    return atkRole(AXObject->roleValue());
+    return atkRole(axObject->roleValue());
 }
 
 static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkStateSet* stateSet)
@@ -549,15 +614,15 @@ webkit_accessible_get_type(void)
     if (g_once_init_enter(&type_volatile)) {
         static const GTypeInfo tinfo = {
             sizeof(WebKitAccessibleClass),
-            (GBaseInitFunc)NULL,
-            (GBaseFinalizeFunc)NULL,
-            (GClassInitFunc)webkit_accessible_class_init,
-            (GClassFinalizeFunc)NULL,
-            NULL, /* class data */
+            (GBaseInitFunc) 0,
+            (GBaseFinalizeFunc) 0,
+            (GClassInitFunc) webkit_accessible_class_init,
+            (GClassFinalizeFunc) 0,
+            0, /* class data */
             sizeof(WebKitAccessible), /* instance size */
             0, /* nb preallocs */
-            (GInstanceInitFunc)NULL,
-            NULL /* value table */
+            (GInstanceInitFunc) 0,
+            0 /* value table */
         };
 
         GType type = g_type_register_static(ATK_TYPE_OBJECT,
@@ -581,7 +646,7 @@ static gint webkit_accessible_action_get_n_actions(AtkAction* action)
 
 static const gchar* webkit_accessible_action_get_description(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     // TODO: Need a way to provide/localize action descriptions.
     notImplemented();
     return "";
@@ -589,14 +654,14 @@ static const gchar* webkit_accessible_action_get_description(AtkAction* action,
 
 static const gchar* webkit_accessible_action_get_keybinding(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     // FIXME: Construct a proper keybinding string.
     return returnString(core(action)->accessKey().string());
 }
 
 static const gchar* webkit_accessible_action_get_name(AtkAction* action, gint i)
 {
-    g_return_val_if_fail(i == 0, NULL);
+    g_return_val_if_fail(i == 0, 0);
     return returnString(core(action)->actionVerb());
 }
 
@@ -609,6 +674,145 @@ static void atk_action_interface_init(AtkActionIface* iface)
     iface->get_name = webkit_accessible_action_get_name;
 }
 
+// Selection (for controls)
+
+static AccessibilityObject* optionFromList(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || i < 0)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector options = core(selection)->children();
+    if (i < static_cast<gint>(options.size()))
+        return options.at(i).get();
+
+    return 0;
+}
+
+static AccessibilityObject* optionFromSelection(AtkSelection* selection, gint i)
+{
+    // i is the ith selection as opposed to the ith child.
+
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || i < 0)
+        return 0;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    if (coreSelection->isListBox())
+        static_cast<AccessibilityListBox*>(coreSelection)->selectedChildren(selectedItems);
+
+    // TODO: Combo boxes
+
+    if (i < static_cast<gint>(selectedItems.size()))
+        return selectedItems.at(i).get();
+
+    return 0;
+}
+
+static gboolean webkit_accessible_selection_add_selection(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromList(selection, i);
+    if (option && core(selection)->isListBox()) {
+        AccessibilityListBoxOption* listBoxOption = static_cast<AccessibilityListBoxOption*>(option);
+        listBoxOption->setSelected(true);
+        return listBoxOption->isSelected();
+    }
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_clear_selection(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection)
+        return false;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+    if (coreSelection->isListBox()) {
+        // Set the list of selected items to an empty list; then verify that it worked.
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
+        listBox->setSelectedChildren(selectedItems);
+        listBox->selectedChildren(selectedItems);
+        return selectedItems.size() == 0;
+    }
+    return false;
+}
+
+static AtkObject* webkit_accessible_selection_ref_selection(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromSelection(selection, i);
+    if (option) {
+        AtkObject* child = option->wrapper();
+        g_object_ref(child);
+        return child;
+    }
+
+    return 0;
+}
+
+static gint webkit_accessible_selection_get_selection_count(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (coreSelection && coreSelection->isListBox()) {
+        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        static_cast<AccessibilityListBox*>(coreSelection)->selectedChildren(selectedItems);
+        return static_cast<gint>(selectedItems.size());
+    }
+
+    return 0;
+}
+
+static gboolean webkit_accessible_selection_is_child_selected(AtkSelection* selection, gint i)
+{
+    AccessibilityObject* option = optionFromList(selection, i);
+    if (option && core(selection)->isListBox())
+        return static_cast<AccessibilityListBoxOption*>(option)->isSelected();
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_remove_selection(AtkSelection* selection, gint i)
+{
+    // TODO: This is only getting called if i == 0. What is preventing the rest?
+    AccessibilityObject* option = optionFromSelection(selection, i);
+    if (option && core(selection)->isListBox()) {
+        AccessibilityListBoxOption* listBoxOption = static_cast<AccessibilityListBoxOption*>(option);
+        listBoxOption->setSelected(false);
+        return !listBoxOption->isSelected();
+    }
+
+    return false;
+}
+
+static gboolean webkit_accessible_selection_select_all_selection(AtkSelection* selection)
+{
+    AccessibilityObject* coreSelection = core(selection);
+    if (!coreSelection || !coreSelection->isMultiSelect())
+        return false;
+
+    AccessibilityRenderObject::AccessibilityChildrenVector children = coreSelection->children();
+    if (coreSelection->isListBox()) {
+        AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(coreSelection);
+        listBox->setSelectedChildren(children);
+        AccessibilityRenderObject::AccessibilityChildrenVector selectedItems;
+        listBox->selectedChildren(selectedItems);
+        return selectedItems.size() == children.size();
+    }
+
+    return false;
+}
+
+static void atk_selection_interface_init(AtkSelectionIface* iface)
+{
+    iface->add_selection = webkit_accessible_selection_add_selection;
+    iface->clear_selection = webkit_accessible_selection_clear_selection;
+    iface->ref_selection = webkit_accessible_selection_ref_selection;
+    iface->get_selection_count = webkit_accessible_selection_get_selection_count;
+    iface->is_child_selected = webkit_accessible_selection_is_child_selected;
+    iface->remove_selection = webkit_accessible_selection_remove_selection;
+    iface->select_all_selection = webkit_accessible_selection_select_all_selection;
+}
+
 // Text
 
 static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, gint endOffset)
@@ -616,6 +820,8 @@ static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, g
     AccessibilityObject* coreObject = core(text);
     String ret;
     unsigned start = startOffset;
+    if (endOffset == -1)
+        endOffset = coreObject->stringValue().length();
     int length = endOffset - startOffset;
 
     if (coreObject->isTextControl())
@@ -656,23 +862,24 @@ static gchar* convertUniCharToUTF8(const UChar* characters, gint length, int fro
 {
     CString stringUTF8 = UTF8Encoding().encode(characters, length, QuestionMarksForUnencodables);
     gchar* utf8String = utf8Substr(stringUTF8.data(), from, to);
-    if (!g_utf8_validate(utf8String, -1, NULL)) {
+    if (!g_utf8_validate(utf8String, -1, 0)) {
         g_free(utf8String);
         return 0;
     }
     gsize len = strlen(utf8String);
-    GString* ret = g_string_new_len(NULL, len);
+    GString* ret = g_string_new_len(0, len);
+    gchar* ptr = utf8String;
 
     // WebCore introduces line breaks in the text that do not reflect
     // the layout you see on the screen, replace them with spaces
     while (len > 0) {
         gint index, start;
-        pango_find_paragraph_boundary(utf8String, len, &index, &start);
-        g_string_append_len(ret, utf8String, index);
+        pango_find_paragraph_boundary(ptr, len, &index, &start);
+        g_string_append_len(ret, ptr, index);
         if (index == start)
             break;
         g_string_append_c(ret, ' ');
-        utf8String += start;
+        ptr += start;
         len -= start;
     }
 
@@ -691,7 +898,7 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
     if (!webView)
         return 0;
 
-    GString* str = g_string_new(NULL);
+    GString* str = g_string_new(0);
 
     AccessibilityRenderObject* accObject = static_cast<AccessibilityRenderObject*>(coreObject);
     if (!accObject)
@@ -701,12 +908,30 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
         return 0;
 
     // Create a string with the layout as it appears on the screen
-    InlineTextBox* box = renderText->firstTextBox();
-    while (box) {
-        gchar *text = convertUniCharToUTF8(renderText->characters(), renderText->textLength(), box->start(), box->end());
-        g_string_append(str, text);
-        g_string_append(str, "\n");
-        box = box->nextTextBox();
+    if (accObject->isTextControl()) {
+        unsigned textLength = accObject->textLength();
+        int lineNumber = 0;
+        PlainTextRange range = accObject->doAXRangeForLine(lineNumber);
+        while (range.length) {
+            // When a line of text wraps in a text area, the final space is removed.
+            if (range.start + range.length < textLength)
+                range.length -= 1;
+            String lineText = accObject->doAXStringForRange(range);
+            g_string_append(str, lineText.utf8().data());
+            g_string_append(str, "\n");
+            range = accObject->doAXRangeForLine(++lineNumber);
+        }
+    } else {
+        InlineTextBox* box = renderText->firstTextBox();
+        while (box) {
+            gchar* text = convertUniCharToUTF8(renderText->characters(), renderText->textLength(), box->start(), box->end());
+            g_string_append(str, text);
+            // Newline chars in the source result in separate text boxes, so check
+            // before adding a newline in the layout. See bug 25415 comment #78.
+            if (!box->nextOnLineExists())
+                g_string_append(str, "\n");
+            box = box->nextTextBox();
+        }
     }
 
     PangoLayout* layout = gtk_widget_create_pango_layout(static_cast<GtkWidget*>(webView), g_string_free(str, FALSE));
@@ -732,7 +957,7 @@ static gchar* webkit_accessible_text_get_text_before_offset(AtkText* text, gint
 static gunichar webkit_accessible_text_get_character_at_offset(AtkText* text, gint offset)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static gint webkit_accessible_text_get_caret_offset(AtkText* text)
@@ -744,13 +969,13 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
 static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* start_offset, gint* end_offset)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static AtkAttributeSet* webkit_accessible_text_get_default_attributes(AtkText* text)
 {
     notImplemented();
-    return NULL;
+    return 0;
 }
 
 static void webkit_accessible_text_get_character_extents(AtkText* text, gint offset, gint* x, gint* y, gint* width, gint* height, AtkCoordType coords)
@@ -795,7 +1020,7 @@ static gint webkit_accessible_text_get_offset_at_point(AtkText* text, gint x, gi
     return range.start;
 }
 
-static bool selectionBelongsToObject(AccessibilityObject *coreObject, VisibleSelection& selection)
+static bool selectionBelongsToObject(AccessibilityObject* coreObject, VisibleSelection& selection)
 {
     if (!coreObject->isAccessibilityRenderObject())
         return false;
@@ -830,7 +1055,7 @@ static gchar* webkit_accessible_text_get_selection(AtkText* text, gint selection
     // the global one (the API is a bit confusing)
     if (selection_num != 0 || !selectionBelongsToObject(coreObject, selection)) {
         *start_offset = *end_offset = 0;
-        return NULL;
+        return 0;
     }
 
     *start_offset = selection.start().offsetInContainerNode();
@@ -1016,7 +1241,7 @@ static AtkObject* webkit_accessible_component_ref_accessible_at_point(AtkCompone
     IntPoint pos = atkToContents(core(component), coordType, x, y);
     AccessibilityObject* target = core(component)->doAccessibilityHitTest(pos);
     if (!target)
-        return NULL;
+        return 0;
     g_object_ref(target->wrapper());
     return target->wrapper();
 }
@@ -1033,7 +1258,7 @@ static gboolean webkit_accessible_component_grab_focus(AtkComponent* component)
     return core(component)->isFocused();
 }
 
-static void atk_component_interface_init(AtkComponentIface *iface)
+static void atk_component_interface_init(AtkComponentIface* iface)
 {
     iface->ref_accessible_at_point = webkit_accessible_component_ref_accessible_at_point;
     iface->get_extents = webkit_accessible_component_get_extents;
@@ -1080,32 +1305,68 @@ static AccessibilityTableCell* cell(AtkTable* table, guint row, guint column)
     return 0;
 }
 
-static gint cellIndex(AccessibilityTableCell* AXCell, AccessibilityTable* AXTable)
+static gint cellIndex(AccessibilityTableCell* axCell, AccessibilityTable* axTable)
 {
     // Calculate the cell's index as if we had a traditional Gtk+ table in
     // which cells are all direct children of the table, arranged row-first.
     AccessibilityObject::AccessibilityChildrenVector allCells;
-    AXTable->cells(allCells);
+    axTable->cells(allCells);
     AccessibilityObject::AccessibilityChildrenVector::iterator position;
-    position = std::find(allCells.begin(), allCells.end(), AXCell);
+    position = std::find(allCells.begin(), allCells.end(), axCell);
     if (position == allCells.end())
         return -1;
     return position - allCells.begin();
 }
 
+static AccessibilityTableCell* cellAtIndex(AtkTable* table, gint index)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        AccessibilityObject::AccessibilityChildrenVector allCells;
+        static_cast<AccessibilityTable*>(accTable)->cells(allCells);
+        if (0 <= index && static_cast<unsigned>(index) < allCells.size()) {
+            AccessibilityObject* accCell = allCells.at(index).get();
+            return static_cast<AccessibilityTableCell*>(accCell);
+        }
+    }
+    return 0;
+}
+
 static AtkObject* webkit_accessible_table_ref_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (!AXCell)
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (!axCell)
         return 0;
-    return AXCell->wrapper();
+    return axCell->wrapper();
 }
 
 static gint webkit_accessible_table_get_index_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    AccessibilityTable* AXTable = static_cast<AccessibilityTable*>(core(table));
-    return cellIndex(AXCell, AXTable);
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    AccessibilityTable* axTable = static_cast<AccessibilityTable*>(core(table));
+    return cellIndex(axCell, axTable);
+}
+
+static gint webkit_accessible_table_get_column_at_index(AtkTable* table, gint index)
+{
+    AccessibilityTableCell* axCell = cellAtIndex(table, index);
+    if (axCell){
+        pair<int, int> columnRange;
+        axCell->columnIndexRange(columnRange);
+        return columnRange.first;
+    }
+    return -1;
+}
+
+static gint webkit_accessible_table_get_row_at_index(AtkTable* table, gint index)
+{
+    AccessibilityTableCell* axCell = cellAtIndex(table, index);
+    if (axCell){
+        pair<int, int> rowRange;
+        axCell->rowIndexRange(rowRange);
+        return rowRange.first;
+    }
+    return -1;
 }
 
 static gint webkit_accessible_table_get_n_columns(AtkTable* table)
@@ -1126,10 +1387,10 @@ static gint webkit_accessible_table_get_n_rows(AtkTable* table)
 
 static gint webkit_accessible_table_get_column_extent_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (AXCell) {
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (axCell) {
         pair<int, int> columnRange;
-        AXCell->columnIndexRange(columnRange);
+        axCell->columnIndexRange(columnRange);
         return columnRange.second;
     }
     return 0;
@@ -1137,15 +1398,22 @@ static gint webkit_accessible_table_get_column_extent_at(AtkTable* table, gint r
 
 static gint webkit_accessible_table_get_row_extent_at(AtkTable* table, gint row, gint column)
 {
-    AccessibilityTableCell* AXCell = cell(table, row, column);
-    if (AXCell) {
+    AccessibilityTableCell* axCell = cell(table, row, column);
+    if (axCell) {
         pair<int, int> rowRange;
-        AXCell->rowIndexRange(rowRange);
+        axCell->rowIndexRange(rowRange);
         return rowRange.second;
     }
     return 0;
 }
 
+static AtkObject* webkit_accessible_table_get_column_header(AtkTable* table, gint column)
+{
+    // FIXME: This needs to be implemented.
+    notImplemented();
+    return 0;
+}
+
 static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint row)
 {
     AccessibilityObject* accTable = core(table);
@@ -1163,39 +1431,139 @@ static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint r
     return 0;
 }
 
+static AtkObject* webkit_accessible_table_get_caption(AtkTable* table)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        Node* node = static_cast<AccessibilityRenderObject*>(accTable)->renderer()->node();
+        if (node && node->hasTagName(HTMLNames::tableTag)) {
+            HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(node)->caption();
+            if (caption)
+                return AccessibilityObject::firstAccessibleObjectFromNode(caption->renderer()->node())->wrapper();
+        }
+    }
+    return 0;
+}
+
+static const gchar* webkit_accessible_table_get_column_description(AtkTable* table, gint column)
+{
+    AtkObject* columnHeader = atk_table_get_column_header(table, column);
+    if (columnHeader)
+        return returnString(nameFromChildren(core(columnHeader)));
+
+    return 0;
+}
+
+static const gchar* webkit_accessible_table_get_row_description(AtkTable* table, gint row)
+{
+    AtkObject* rowHeader = atk_table_get_row_header(table, row);
+    if (rowHeader)
+        return returnString(nameFromChildren(core(rowHeader)));
+
+    return 0;
+}
+
 static void atk_table_interface_init(AtkTableIface* iface)
 {
     iface->ref_at = webkit_accessible_table_ref_at;
     iface->get_index_at = webkit_accessible_table_get_index_at;
+    iface->get_column_at_index = webkit_accessible_table_get_column_at_index;
+    iface->get_row_at_index = webkit_accessible_table_get_row_at_index;
     iface->get_n_columns = webkit_accessible_table_get_n_columns;
     iface->get_n_rows = webkit_accessible_table_get_n_rows;
     iface->get_column_extent_at = webkit_accessible_table_get_column_extent_at;
     iface->get_row_extent_at = webkit_accessible_table_get_row_extent_at;
+    iface->get_column_header = webkit_accessible_table_get_column_header;
     iface->get_row_header = webkit_accessible_table_get_row_header;
+    iface->get_caption = webkit_accessible_table_get_caption;
+    iface->get_column_description = webkit_accessible_table_get_column_description;
+    iface->get_row_description = webkit_accessible_table_get_row_description;
+}
+
+static const gchar* documentAttributeValue(AtkDocument* document, const gchar* attribute)
+{
+    Document* coreDocument = core(document)->document();
+    if (!coreDocument)
+        return 0;
+
+    String value = String();
+    if (!g_ascii_strcasecmp(attribute, "DocType") && coreDocument->doctype())
+        value = coreDocument->doctype()->name();
+    else if (!g_ascii_strcasecmp(attribute, "Encoding"))
+        value = coreDocument->charset();
+    else if (!g_ascii_strcasecmp(attribute, "URI"))
+        value = coreDocument->documentURI();
+    if (!value.isEmpty())
+        return returnString(value);
+
+    return 0;
+}
+
+static const gchar* webkit_accessible_document_get_attribute_value(AtkDocument* document, const gchar* attribute)
+{
+    return documentAttributeValue(document, attribute);
+}
+
+static AtkAttributeSet* webkit_accessible_document_get_attributes(AtkDocument* document)
+{
+    AtkAttributeSet* attributeSet = 0;
+    const gchar* attributes [] = {"DocType", "Encoding", "URI"};
+
+    for (unsigned i = 0; i < G_N_ELEMENTS(attributes); i++) {
+        const gchar* value = documentAttributeValue(document, attributes[i]);
+        if (value)
+            attributeSet = addAttributeToSet(attributeSet, attributes[i], value);
+    }
+
+    return attributeSet;
+}
+
+static const gchar* webkit_accessible_document_get_locale(AtkDocument* document)
+{
+
+    // TODO: Should we fall back on lang xml:lang when the following comes up empty?
+    String language = static_cast<AccessibilityRenderObject*>(core(document))->language();
+    if (!language.isEmpty())
+        return returnString(language);
+
+    return 0;
+}
+
+static void atk_document_interface_init(AtkDocumentIface* iface)
+{
+    iface->get_document_attribute_value = webkit_accessible_document_get_attribute_value;
+    iface->get_document_attributes = webkit_accessible_document_get_attributes;
+    iface->get_document_locale = webkit_accessible_document_get_locale;
 }
 
 static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_action_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atk_selection_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_editable_text_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_text_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_component_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_image_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL},
+     (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_table_interface_init,
-     (GInterfaceFinalizeFunc) NULL, NULL}
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atk_document_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0}
 };
 
 enum WAIType {
     WAI_ACTION,
+    WAI_SELECTION,
     WAI_EDITABLE_TEXT,
     WAI_TEXT,
     WAI_COMPONENT,
     WAI_IMAGE,
-    WAI_TABLE
+    WAI_TABLE,
+    WAI_DOCUMENT
 };
 
 static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
@@ -1203,6 +1571,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
   switch (type) {
   case WAI_ACTION:
       return ATK_TYPE_ACTION;
+  case WAI_SELECTION:
+      return ATK_TYPE_SELECTION;
   case WAI_EDITABLE_TEXT:
       return ATK_TYPE_EDITABLE_TEXT;
   case WAI_TEXT:
@@ -1213,6 +1583,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
       return ATK_TYPE_IMAGE;
   case WAI_TABLE:
       return ATK_TYPE_TABLE;
+  case WAI_DOCUMENT:
+      return ATK_TYPE_DOCUMENT;
   }
 
   return G_TYPE_INVALID;
@@ -1229,6 +1601,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (!coreObject->actionVerb().isEmpty())
         interfaceMask |= 1 << WAI_ACTION;
 
+    // Selection
+    if (coreObject->isListBox())
+        interfaceMask |= 1 << WAI_SELECTION;
+
     // Text & Editable Text
     AccessibilityRole role = coreObject->roleValue();
 
@@ -1248,6 +1624,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (role == TableRole)
         interfaceMask |= 1 << WAI_TABLE;
 
+    // Document
+    if (role == WebAreaRole)
+        interfaceMask |= 1 << WAI_DOCUMENT;
+
     return interfaceMask;
 }
 
@@ -1255,10 +1635,10 @@ static const char* getUniqueAccessibilityTypeName(guint16 interfaceMask)
 {
 #define WAI_TYPE_NAME_LEN (30) /* Enough for prefix + 5 hex characters (max) */
     static char name[WAI_TYPE_NAME_LEN + 1];
-    
+
     g_sprintf(name, "WAIType%x", interfaceMask);
     name[WAI_TYPE_NAME_LEN] = '\0';
-    
+
     return name;
 }
 
@@ -1266,15 +1646,15 @@ static GType getAccessibilityTypeFromObject(AccessibilityObject* coreObject)
 {
     static const GTypeInfo typeInfo = {
         sizeof(WebKitAccessibleClass),
-        (GBaseInitFunc) NULL,
-        (GBaseFinalizeFunc) NULL,
-        (GClassInitFunc) NULL,
-        (GClassFinalizeFunc) NULL,
-        NULL, /* class data */
+        (GBaseInitFunc) 0,
+        (GBaseFinalizeFunc) 0,
+        (GClassInitFunc) 0,
+        (GClassFinalizeFunc) 0,
+        0, /* class data */
         sizeof(WebKitAccessible), /* instance size */
         0, /* nb preallocs */
-        (GInstanceInitFunc) NULL,
-        NULL /* value table */
+        (GInstanceInitFunc) 0,
+        0 /* value table */
     };
 
     guint16 interfaceMask = getInterfaceMaskFromObject(coreObject);
@@ -1299,7 +1679,7 @@ static GType getAccessibilityTypeFromObject(AccessibilityObject* coreObject)
 WebKitAccessible* webkit_accessible_new(AccessibilityObject* coreObject)
 {
     GType type = getAccessibilityTypeFromObject(coreObject);
-    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, NULL));
+    AtkObject* object = static_cast<AtkObject*>(g_object_new(type, 0));
 
     atk_object_initialize(object, coreObject);
 
diff --git a/WebCore/accessibility/mac/AXObjectCacheMac.mm b/WebCore/accessibility/mac/AXObjectCacheMac.mm
index 2f18cf3..bf1b22c 100644
--- a/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -59,6 +59,13 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
     // Some notifications are unique to Safari and do not have NSAccessibility equivalents.
     String macNotification;
     switch (notification) {
+        case AXActiveDescendantChanged:
+            // An active descendant change for trees means a selected rows change.
+            if (obj->isTree())
+                macNotification = NSAccessibilitySelectedRowsChangedNotification;
+            else
+                macNotification = NSAccessibilityFocusedUIElementChangedNotification;                
+            break;
         case AXCheckedStateChanged:
             macNotification = "AXCheckedStateChanged";
             break;
diff --git a/WebCore/accessibility/mac/AccessibilityObjectMac.mm b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
index 217af54..722b03e 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectMac.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
@@ -43,6 +43,24 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
 
 AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
 {
+    // Determine if this is in a tree. If so, we apply special behavior to make it work like an AXOutline.
+    AccessibilityObject* axObj = parentObject();
+    bool isInTree = false;
+    while (axObj) {
+        if (axObj->isTree()) {
+            isInTree = true;
+            break;
+        }
+        axObj = axObj->parentObjectUnignored();
+    }
+    
+    // If the object is in a tree, only tree items should be exposed (and the children of tree items).
+    if (isInTree) {
+        AccessibilityRole role = roleValue();
+        if (role != TreeItemRole && role != StaticTextRole)
+            return IgnoreObject;
+    }
+    
     return DefaultBehavior;
 }
     
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.h b/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
index 3b584a9..910305b 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.h
@@ -29,7 +29,7 @@
 #ifndef AccessibilityObjectWrapper_h
 #define AccessibilityObjectWrapper_h
 
-#import <wtf/RefPtr.h>
+#include <wtf/RefPtr.h>
 
 #ifdef __OBJC__
 @class WebCoreTextMarker;
@@ -40,12 +40,11 @@ class WebCoreTextMarkerRange;
 #endif
 
 namespace WebCore {
-    class AccessibilityObject;
-    class VisiblePosition;
+class AccessibilityObject;
+class VisiblePosition;
 }
 
-@interface AccessibilityObjectWrapper : NSObject
-{
+@interface AccessibilityObjectWrapper : NSObject {
     WebCore::AccessibilityObject* m_object;
 }
  
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index 58e5018..6099b3d 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -119,6 +119,18 @@ using namespace std;
 #define NSAccessibilityRequiredAttribute @"AXRequired"
 #endif
 
+#ifndef NSAccessibilityOwnsAttribute
+#define NSAccessibilityOwnsAttribute @"AXOwns"
+#endif
+
+#ifndef NSAccessibilityGrabbedAttribute
+#define NSAccessibilityGrabbedAttribute @"AXGrabbed"
+#endif
+
+#ifndef NSAccessibilityDropEffectsAttribute
+#define NSAccessibilityDropEffectsAttribute @"AXDropEffects"
+#endif
+
 #ifdef BUILDING_ON_TIGER
 typedef unsigned NSUInteger;
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
@@ -569,6 +581,27 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
     return actions;
 }
 
+- (NSArray*)additionalAccessibilityAttributeNames
+{
+    if (!m_object)
+        return nil;
+
+    NSMutableArray *additional = [NSMutableArray array];
+    if (m_object->supportsARIAOwns())
+        [additional addObject:NSAccessibilityOwnsAttribute];
+
+    if (m_object->isScrollbar())
+        [additional addObject:NSAccessibilityOrientationAttribute];
+    
+    if (m_object->supportsARIADragging())
+        [additional addObject:NSAccessibilityGrabbedAttribute];
+
+    if (m_object->supportsARIADropping())
+        [additional addObject:NSAccessibilityDropEffectsAttribute];
+
+    return additional;
+}
+
 - (NSArray*)accessibilityAttributeNames
 {
     if (!m_object)
@@ -600,6 +633,11 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
     static NSArray* groupAttrs = nil;
     static NSArray* inputImageAttrs = nil;
     static NSArray* passwordFieldAttrs = nil;
+    static NSArray* tabListAttrs = nil;
+    static NSArray* comboBoxAttrs = nil;
+    static NSArray* outlineAttrs = nil;
+    static NSArray* outlineRowAttrs = nil;
+    static NSArray* buttonAttrs = nil;
     NSMutableArray* tempArray;
     if (attributes == nil) {
         attributes = [[NSArray alloc] initWithObjects: NSAccessibilityRoleAttribute,
@@ -739,6 +777,21 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         controlAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
+    if (buttonAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        // Buttons should not expose AXValue.
+        [tempArray removeObject:NSAccessibilityValueAttribute];
+        [tempArray addObject:NSAccessibilityTitleUIElementAttribute];
+        [tempArray addObject:NSAccessibilityAccessKeyAttribute];
+        buttonAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
+    if (comboBoxAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:controlAttrs];
+        [tempArray addObject:NSAccessibilityExpandedAttribute];
+        comboBoxAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];        
+    }
     if (tableAttrs == nil) {
         tempArray = [[NSMutableArray alloc] initWithArray:attributes];
         [tempArray addObject:NSAccessibilityRowsAttribute];
@@ -781,9 +834,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         [tempArray release];
     }
     if (inputImageAttrs == nil) {
-        tempArray = [[NSMutableArray alloc] initWithArray:controlAttrs];
+        tempArray = [[NSMutableArray alloc] initWithArray:buttonAttrs];
         [tempArray addObject:NSAccessibilityURLAttribute];
-        [tempArray addObject:NSAccessibilityAccessKeyAttribute];
         inputImageAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
@@ -794,53 +846,96 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         passwordFieldAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
+    if (tabListAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        [tempArray addObject:NSAccessibilityTabsAttribute];
+        [tempArray addObject:NSAccessibilityContentsAttribute];
+        tabListAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];        
+    }
+    if (outlineAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:attributes];
+        [tempArray addObject:NSAccessibilitySelectedRowsAttribute];
+        [tempArray addObject:NSAccessibilityRowsAttribute];
+        [tempArray addObject:NSAccessibilityColumnsAttribute];
+        outlineAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
+    if (outlineRowAttrs == nil) {
+        tempArray = [[NSMutableArray alloc] initWithArray:tableRowAttrs];
+        [tempArray addObject:NSAccessibilityIndexAttribute];
+        [tempArray addObject:NSAccessibilityDisclosingAttribute];
+        [tempArray addObject:NSAccessibilityDisclosedByRowAttribute];
+        [tempArray addObject:NSAccessibilityDisclosureLevelAttribute];
+        [tempArray addObject:NSAccessibilityDisclosedRowsAttribute];
+        outlineRowAttrs = [[NSArray alloc] initWithArray:tempArray];
+        [tempArray release];
+    }
     
-    if (m_object->isPasswordField())
-        return passwordFieldAttrs;
-
-    if (m_object->isWebArea())
-        return webAreaAttrs;
+    NSArray *objectAttributes = attributes;
     
-    if (m_object->isTextControl())
-        return textAttrs;
-
-    if (m_object->isAnchor() || m_object->isImage() || m_object->isLink())
-        return anchorAttrs;
-
-    if (m_object->isDataTable())
-        return tableAttrs;
-    if (m_object->isTableRow())
-        return tableRowAttrs;
-    if (m_object->isTableColumn())
-        return tableColAttrs;
-    if (m_object->isTableCell())
-        return tableCellAttrs;
-    
-    if (m_object->isListBox() || m_object->isList())
-        return listBoxAttrs;
-
-    if (m_object->isProgressIndicator() || m_object->isSlider())
-        return rangeAttrs;
-
-    if (m_object->isInputImage())
-        return inputImageAttrs;
-    
-    if (m_object->isControl())
-        return controlAttrs;
-    
-    if (m_object->isGroup())
-        return groupAttrs;
-    
-    if (m_object->isMenu())
-        return menuAttrs;
-    if (m_object->isMenuBar())
-        return menuBarAttrs;
-    if (m_object->isMenuButton())
-        return menuButtonAttrs;
-    if (m_object->isMenuItem())
-        return menuItemAttrs;
-
-    return attributes;
+    if (m_object->isPasswordField())
+        objectAttributes = passwordFieldAttrs;
+
+    else if (m_object->isWebArea())
+        objectAttributes = webAreaAttrs;
+    
+    else if (m_object->isTextControl())
+        objectAttributes = textAttrs;
+
+    else if (m_object->isAnchor() || m_object->isImage() || m_object->isLink())
+        objectAttributes = anchorAttrs;
+
+    else if (m_object->isDataTable())
+        objectAttributes = tableAttrs;
+    else if (m_object->isTableRow())
+        objectAttributes = tableRowAttrs;
+    else if (m_object->isTableColumn())
+        objectAttributes = tableColAttrs;
+    else if (m_object->isTableCell())
+        objectAttributes = tableCellAttrs;
+    
+    else if (m_object->isTree())
+        objectAttributes = outlineAttrs;
+    else if (m_object->isTreeItem())
+        objectAttributes = outlineRowAttrs;
+    
+    else if (m_object->isListBox() || m_object->isList())
+        objectAttributes = listBoxAttrs;
+
+    else if (m_object->isComboBox())
+        objectAttributes = comboBoxAttrs;
+    
+    else if (m_object->isProgressIndicator() || m_object->isSlider())
+        objectAttributes = rangeAttrs;
+
+    // These are processed in order because an input image is a button, and a button is a control.
+    else if (m_object->isInputImage())
+        objectAttributes = inputImageAttrs;
+    else if (m_object->isButton())
+        objectAttributes = buttonAttrs;
+    else if (m_object->isControl())
+        objectAttributes = controlAttrs;
+    
+    else if (m_object->isGroup())
+        objectAttributes = groupAttrs;
+    else if (m_object->isTabList())
+        objectAttributes = tabListAttrs;
+    
+    else if (m_object->isMenu())
+        objectAttributes = menuAttrs;
+    else if (m_object->isMenuBar())
+        objectAttributes = menuBarAttrs;
+    else if (m_object->isMenuButton())
+        objectAttributes = menuButtonAttrs;
+    else if (m_object->isMenuItem())
+        objectAttributes = menuItemAttrs;
+
+    NSArray *additionalAttributes = [self additionalAccessibilityAttributeNames];
+    if ([additionalAttributes count])
+        objectAttributes = [objectAttributes arrayByAddingObjectsFromArray:additionalAttributes];
+    
+    return objectAttributes;
 }
 
 - (VisiblePositionRange)visiblePositionRangeForTextMarkerRange:(WebCoreTextMarkerRange*) textMarkerRange
@@ -936,6 +1031,7 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { GroupRole, NSAccessibilityGroupRole },
         { RadioGroupRole, NSAccessibilityRadioGroupRole },
         { ListRole, NSAccessibilityListRole },
+        { DirectoryRole, NSAccessibilityListRole },
         { ScrollBarRole, NSAccessibilityScrollBarRole },
         { ValueIndicatorRole, NSAccessibilityValueIndicatorRole },
         { ImageRole, NSAccessibilityImageRole },
@@ -992,17 +1088,24 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { LandmarkMainRole, NSAccessibilityGroupRole },
         { LandmarkNavigationRole, NSAccessibilityGroupRole },
         { LandmarkSearchRole, NSAccessibilityGroupRole },
+        { ApplicationAlertRole, NSAccessibilityGroupRole },
+        { ApplicationAlertDialogRole, NSAccessibilityGroupRole },
+        { ApplicationDialogRole, NSAccessibilityGroupRole },
         { ApplicationLogRole, NSAccessibilityGroupRole },
         { ApplicationMarqueeRole, NSAccessibilityGroupRole },
         { ApplicationStatusRole, NSAccessibilityGroupRole },
         { ApplicationTimerRole, NSAccessibilityGroupRole },
         { DocumentRole, NSAccessibilityGroupRole },
         { DocumentArticleRole, NSAccessibilityGroupRole },
+        { DocumentMathRole, NSAccessibilityGroupRole },
         { DocumentNoteRole, NSAccessibilityGroupRole },
         { DocumentRegionRole, NSAccessibilityGroupRole },
         { UserInterfaceTooltipRole, NSAccessibilityGroupRole },
-        
-
+        { TabRole, NSAccessibilityRadioButtonRole },
+        { TabListRole, NSAccessibilityTabGroupRole },
+        { TabPanelRole, NSAccessibilityGroupRole },
+        { TreeRole, NSAccessibilityOutlineRole },
+        { TreeItemRole, NSAccessibilityRowRole },
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
@@ -1041,6 +1144,9 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }
     }
     
+    if (m_object->isTreeItem())
+        return NSAccessibilityOutlineRowSubrole;
+    
     if (m_object->isList()) {
         AccessibilityList* listObject = static_cast<AccessibilityList*>(m_object);
         if (listObject->isUnorderedList() || listObject->isOrderedList())
@@ -1065,6 +1171,12 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return @"AXLandmarkNavigation";
         case LandmarkSearchRole:
             return @"AXLandmarkSearch";
+        case ApplicationAlertRole:
+            return @"AXApplicationAlert";
+        case ApplicationAlertDialogRole:
+            return @"AXApplicationAlertDialog";
+        case ApplicationDialogRole:
+            return @"AXApplicationDialog";
         case ApplicationLogRole:
             return @"AXApplicationLog";
         case ApplicationMarqueeRole:
@@ -1077,14 +1189,23 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return @"AXDocument";
         case DocumentArticleRole:
             return @"AXDocumentArticle";
+        case DocumentMathRole:
+            return @"AXDocumentMath";
         case DocumentNoteRole:
             return @"AXDocumentNote";
         case DocumentRegionRole:
             return @"AXDocumentRegion";
         case UserInterfaceTooltipRole:
             return @"AXUserInterfaceTooltip";
+        case TabPanelRole:
+            return @"AXTabPanel";
+        case DefinitionListTermRole:
+            return @"AXTerm";
+        case DefinitionListDefinitionRole:
+            return @"AXDefinition";
+        // Default doesn't return anything, so roles defined below can be chosen.
         default:
-            return nil;
+            break;
     }
     
     if (m_object->isMediaTimeline())
@@ -1122,6 +1243,12 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return AXARIAContentGroupText(@"ARIALandmarkNavigation");
             case LandmarkSearchRole:
                 return AXARIAContentGroupText(@"ARIALandmarkSearch");
+            case ApplicationAlertRole:
+                return AXARIAContentGroupText(@"ARIAApplicationAlert");
+            case ApplicationAlertDialogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationAlertDialog");
+            case ApplicationDialogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationDialog");
             case ApplicationLogRole:
                 return AXARIAContentGroupText(@"ARIAApplicationLog");
             case ApplicationMarqueeRole:
@@ -1134,12 +1261,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return AXARIAContentGroupText(@"ARIADocument");
             case DocumentArticleRole:
                 return AXARIAContentGroupText(@"ARIADocumentArticle");
+            case DocumentMathRole:
+                return AXARIAContentGroupText(@"ARIADocumentMath");
             case DocumentNoteRole:
                 return AXARIAContentGroupText(@"ARIADocumentNote");
             case DocumentRegionRole:
                 return AXARIAContentGroupText(@"ARIADocumentRegion");
             case UserInterfaceTooltipRole:
                 return AXARIAContentGroupText(@"ARIAUserInterfaceTooltip");
+            case TabPanelRole:
+                return AXARIAContentGroupText(@"ARIATabPanel");
+            case DefinitionListTermRole:
+                return AXDefinitionListTermText();
+            case DefinitionListDefinitionRole:
+                return AXDefinitionListDefinitionText();
         }
     }        
     
@@ -1158,6 +1293,10 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:@"AXHeading"])
         return AXHeadingText();
 
+    // AppKit also returns AXTab for the role description for a tab item.
+    if (m_object->isTabItem())
+        return NSAccessibilityRoleDescription(@"AXTab", nil);
+    
     // We should try the system default role description for all other roles.
     // If we get the same string back, then as a last resort, return unknown.
     NSString* defaultRoleDescription = NSAccessibilityRoleDescription(axRole, [self subrole]);
@@ -1195,6 +1334,16 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                 return fv->platformWidget();
         }
         
+        // Tree item (changed to AXRows) can only report the tree (AXOutline) as its parent.
+        if (m_object->isTreeItem()) {
+            AccessibilityObject* parent = m_object->parentObjectUnignored();
+            while (parent) {
+                if (parent->isTree())
+                    return parent->wrapper();
+                parent = parent->parentObjectUnignored();
+            }
+        }
+        
         return m_object->parentObjectUnignored()->wrapper();
     }
 
@@ -1204,6 +1353,19 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             if (children != nil)
                 return children;
         }
+
+        // The tree's (AXOutline) children are supposed to be its rows and columns.
+        // The ARIA spec doesn't have columns, so we just need rows.
+        if (m_object->isTree())
+            return [self accessibilityAttributeValue:NSAccessibilityRowsAttribute];
+
+        // A tree item should only expose its content as its children (not its rows)
+        if (m_object->isTreeItem()) {
+            AccessibilityObject::AccessibilityChildrenVector contentCopy;
+            m_object->ariaTreeItemContent(contentCopy);
+            return convertToNSArray(contentCopy);
+        }
+        
         return convertToNSArray(m_object->children());
     }
     
@@ -1305,7 +1467,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             if ([[[self attachmentView] accessibilityAttributeNames] containsObject:NSAccessibilityValueAttribute]) 
                 return [[self attachmentView] accessibilityAttributeValue:NSAccessibilityValueAttribute];
         }
-        if (m_object->isProgressIndicator() || m_object->isSlider())
+        if (m_object->isProgressIndicator() || m_object->isSlider() || m_object->isScrollbar())
             return [NSNumber numberWithFloat:m_object->valueForRange()];
         if (m_object->hasIntValue())
             return [NSNumber numberWithInt:m_object->intValue()];
@@ -1318,6 +1480,16 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return radioButton->wrapper();
         }
         
+        if (m_object->isTabList()) {
+            AccessibilityObject* tabItem = m_object->selectedTabItem();
+            if (!tabItem)
+                return nil;
+            return tabItem->wrapper();
+        }
+        
+        if (m_object->isTabItem())
+            return [NSNumber numberWithInt:m_object->isSelected()];
+        
         return m_object->stringValue();
     }
 
@@ -1359,6 +1531,31 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return accessKey;
     }
     
+    if ([attributeName isEqualToString:NSAccessibilityTabsAttribute]) {
+        if (m_object->isTabList()) {
+            AccessibilityObject::AccessibilityChildrenVector tabsChildren;
+            m_object->tabChildren(tabsChildren);
+            return convertToNSArray(tabsChildren);
+        }
+    }
+    
+    if ([attributeName isEqualToString:NSAccessibilityContentsAttribute]) {
+        // The contents of a tab list are all the children except the tabs.
+        if (m_object->isTabList()) {
+            AccessibilityObject::AccessibilityChildrenVector children = m_object->children();
+            AccessibilityObject::AccessibilityChildrenVector tabsChildren;
+            m_object->tabChildren(tabsChildren);
+
+            AccessibilityObject::AccessibilityChildrenVector contents;
+            unsigned childrenSize = children.size();
+            for (unsigned k = 0; k < childrenSize; ++k) {
+                if (tabsChildren.find(children[k]) == WTF::notFound)
+                    contents.append(children[k]);
+            }
+            return convertToNSArray(contents);
+        }
+    }    
+    
     if (m_object->isDataTable()) {
         // TODO: distinguish between visible and non-visible rows
         if ([attributeName isEqualToString:NSAccessibilityRowsAttribute] || 
@@ -1438,6 +1635,69 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }  
     }
     
+    if (m_object->isTree()) {
+        if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector selectedChildrenCopy;
+            m_object->selectedChildren(selectedChildrenCopy);
+            return convertToNSArray(selectedChildrenCopy);
+        }
+        if ([attributeName isEqualToString:NSAccessibilityRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            m_object->ariaTreeRows(rowsCopy);
+            return convertToNSArray(rowsCopy);            
+        }
+        
+        // TreeRoles do not support columns, but Mac AX expects to be able to ask about columns at the least.
+        if ([attributeName isEqualToString:NSAccessibilityColumnsAttribute])
+            return [NSArray array];
+    }
+
+    if (m_object->isTreeItem()) {
+        if ([attributeName isEqualToString:NSAccessibilityIndexAttribute]) {
+            AccessibilityObject* parent = m_object->parentObject();
+            for (; parent && !parent->isTree(); parent = parent->parentObject())
+            { }
+            
+            if (!parent)
+                return nil;
+            
+            // Find the index of this item by iterating the parents.
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            parent->ariaTreeRows(rowsCopy);
+            size_t count = rowsCopy.size();
+            for (size_t k = 0; k < count; ++k)
+                if (rowsCopy[k]->wrapper() == self)
+                    return [NSNumber numberWithUnsignedInt:k];
+            
+            return nil;
+        }
+        
+        // The rows that are considered inside this row. 
+        if ([attributeName isEqualToString:NSAccessibilityDisclosedRowsAttribute]) {
+            AccessibilityObject::AccessibilityChildrenVector rowsCopy;
+            m_object->ariaTreeItemDisclosedRows(rowsCopy);
+            return convertToNSArray(rowsCopy);    
+        }
+
+        // The row that contains this row. It should be the same as the first parent that is a treeitem.
+        if ([attributeName isEqualToString:NSAccessibilityDisclosedByRowAttribute]) {
+            AccessibilityObject* parent = m_object->parentObject();
+            while (parent) {
+                if (parent->isTreeItem())
+                    return parent->wrapper();
+                // If the parent is the tree itself, then this value == nil.
+                if (parent->isTree())
+                    return nil;
+                parent = parent->parentObject();
+            }
+            return nil;
+        }
+        if ([attributeName isEqualToString:NSAccessibilityDisclosureLevelAttribute])
+            return [NSNumber numberWithInt:m_object->hierarchicalLevel()];
+        if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+            return [NSNumber numberWithBool:m_object->isExpanded()];
+    }
+    
     if ((m_object->isListBox() || m_object->isList()) && [attributeName isEqualToString:NSAccessibilityOrientationAttribute])
         return NSAccessibilityVerticalOrientationValue;
 
@@ -1504,9 +1764,32 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([attributeName isEqualToString:NSAccessibilityLanguageAttribute]) 
         return m_object->language();
     
+    if ([attributeName isEqualToString:NSAccessibilityExpandedAttribute])
+        return [NSNumber numberWithBool:m_object->isExpanded()];
+    
     if ([attributeName isEqualToString:NSAccessibilityRequiredAttribute])
         return [NSNumber numberWithBool:m_object->isRequired()];
 
+    if ([attributeName isEqualToString:NSAccessibilityOwnsAttribute]) {
+        AccessibilityObject::AccessibilityChildrenVector ariaOwns;
+        m_object->ariaOwnsElements(ariaOwns);
+        return convertToNSArray(ariaOwns);
+    }
+    
+    if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        return [NSNumber numberWithBool:m_object->isARIAGrabbed()];
+    
+    if ([attributeName isEqualToString:NSAccessibilityDropEffectsAttribute]) {
+        Vector<String> dropEffects;
+        m_object->determineARIADropEffects(dropEffects);
+        size_t length = dropEffects.size();
+
+        NSMutableArray* dropEffectsArray = [NSMutableArray arrayWithCapacity:length];
+        for (size_t i = 0; i < length; ++i)
+            [dropEffectsArray addObject:dropEffects[i]];
+        return dropEffectsArray;
+    }
+    
     // this is used only by DumpRenderTree for testing
     if ([attributeName isEqualToString:@"AXClickPoint"])
         return [NSValue valueWithPoint:m_object->clickPoint()];
@@ -1570,11 +1853,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([attributeName isEqualToString: NSAccessibilitySelectedChildrenAttribute])
         return m_object->canSetSelectedChildrenAttribute();
 
+    if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+        return m_object->canSetExpandedAttribute();
+
+    if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute])
+        return YES;
+
     if ([attributeName isEqualToString: NSAccessibilitySelectedTextAttribute] ||
         [attributeName isEqualToString: NSAccessibilitySelectedTextRangeAttribute] ||
         [attributeName isEqualToString: NSAccessibilityVisibleCharacterRangeAttribute])
         return m_object->canSetTextRangeAttributes();
     
+    if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        return YES;
+    
     return NO;
 }
 
@@ -1736,9 +2028,13 @@ static NSString* roleValueToNSString(AccessibilityRole value)
 
 - (void)accessibilityPerformShowMenuAction
 {
-    // This needs to be performed in an iteration of the run loop that did not start from an AX call. 
-    // If it's the same run loop iteration, the menu open notification won't be sent
-    [self performSelector:@selector(accessibilityShowContextMenu) withObject:nil afterDelay:0.0];
+    if (m_object->roleValue() == ComboBoxRole)
+        m_object->setIsExpanded(true);
+    else {
+        // This needs to be performed in an iteration of the run loop that did not start from an AX call. 
+        // If it's the same run loop iteration, the menu open notification won't be sent
+        [self performSelector:@selector(accessibilityShowContextMenu) withObject:nil afterDelay:0.0];
+    }
 }
 
 - (void)accessibilityShowContextMenu
@@ -1852,7 +2148,15 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         } else if ([attributeName isEqualToString: NSAccessibilityVisibleCharacterRangeAttribute]) {
             m_object->makeRangeVisible(PlainTextRange(range.location, range.length));
         }
-    }
+    } else if ([attributeName isEqualToString:NSAccessibilityDisclosingAttribute])
+        m_object->setIsExpanded([number boolValue]);
+    else if ([attributeName isEqualToString:NSAccessibilitySelectedRowsAttribute]) {
+        AccessibilityObject::AccessibilityChildrenVector selectedRows;
+        convertToVector(array, selectedRows);
+        if (m_object->isTree())
+            m_object->setSelectedRows(selectedRows);
+    } else if ([attributeName isEqualToString:NSAccessibilityGrabbedAttribute])
+        m_object->setARIAGrabbed([number boolValue]);
 }
 
 static RenderObject* rendererForView(NSView* view)
@@ -2186,7 +2490,12 @@ static RenderObject* rendererForView(NSView* view)
     m_object->updateBackingStore();
     if (!m_object)
         return NSNotFound;
-
+    
+    // Tree objects return their rows as their children. We can use the original method
+    // here, because we won't gain any speed up.
+    if (m_object->isTree())
+        return [super accessibilityIndexOfChild:child];
+       
     const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
        
     if (children.isEmpty())
@@ -2212,6 +2521,11 @@ static RenderObject* rendererForView(NSView* view)
         return 0;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
+        // Tree items object returns a different set of children than those that are in children()
+        // because an AXOutline (the mac role is becomes) has some odd stipulations.
+        if (m_object->isTree() || m_object->isTreeItem())
+            return [[self accessibilityAttributeValue:NSAccessibilityChildrenAttribute] count];
+        
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
         if (children.isEmpty())
             return [[self renderWidgetChildren] count];
@@ -2243,6 +2557,9 @@ static RenderObject* rendererForView(NSView* view)
             
             NSUInteger arrayLength = min(childCount - index, maxCount);
             return [children subarrayWithRange:NSMakeRange(index, arrayLength)];
+        } else if (m_object->isTree()) {
+            // Tree objects return their rows as their children. We can use the original method in this case.
+            return [super accessibilityArrayAttributeValues:attribute index:index maxCount:maxCount];
         }
         
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
diff --git a/WebCore/accessibility/win/AXObjectCacheWin.cpp b/WebCore/accessibility/win/AXObjectCacheWin.cpp
index a1bdcc0..863793c 100644
--- a/WebCore/accessibility/win/AXObjectCacheWin.cpp
+++ b/WebCore/accessibility/win/AXObjectCacheWin.cpp
@@ -74,6 +74,7 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotific
     DWORD msaaEvent;
     switch (notification) {
         case AXFocusedUIElementChanged:
+        case AXActiveDescendantChanged:
             msaaEvent = EVENT_OBJECT_FOCUS;
             break;
 
diff --git a/WebCore/bindings/ScriptControllerBase.cpp b/WebCore/bindings/ScriptControllerBase.cpp
index c232e84..72c9f45 100644
--- a/WebCore/bindings/ScriptControllerBase.cpp
+++ b/WebCore/bindings/ScriptControllerBase.cpp
@@ -62,6 +62,9 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
     if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
         return true;
 
+    if (m_frame->inViewSourceMode())
+        return true;
+
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
     String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
@@ -70,8 +73,15 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
         result = executeScript(script, userGesture);
 
     String scriptResult;
+#if USE(JSC)
+    JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());
+    JSC::ExecState* exec = shell->window()->globalExec();
+    if (!result.getString(exec, scriptResult))
+        return true;
+#else
     if (!result.getString(scriptResult))
         return true;
+#endif
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index 14457c4..3c01535 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -65,10 +65,8 @@ void JSAttr::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->ownerElement()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->ownerElement())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSBindingsAllInOne.cpp b/WebCore/bindings/js/JSBindingsAllInOne.cpp
new file mode 100644
index 0000000..cf1049a
--- /dev/null
+++ b/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "GCController.cpp"
+#include "JSAbstractWorkerCustom.cpp"
+#include "JSAttrCustom.cpp"
+#include "JSAudioConstructor.cpp"
+#include "JSCDATASectionCustom.cpp"
+#include "JSCSSRuleCustom.cpp"
+#include "JSCSSRuleListCustom.cpp"
+#include "JSCSSStyleDeclarationCustom.cpp"
+#include "JSCSSValueCustom.cpp"
+#include "JSCallbackData.cpp"
+#include "JSCanvasRenderingContext2DCustom.cpp"
+#include "JSCanvasRenderingContextCustom.cpp"
+#include "JSClipboardCustom.cpp"
+#include "JSConsoleCustom.cpp"
+#include "JSCoordinatesCustom.cpp"
+#include "JSCustomSQLStatementCallback.cpp"
+#include "JSCustomSQLStatementErrorCallback.cpp"
+#include "JSCustomSQLTransactionCallback.cpp"
+#include "JSCustomSQLTransactionErrorCallback.cpp"
+#include "JSCustomVoidCallback.cpp"
+#include "JSCustomXPathNSResolver.cpp"
+#include "JSDOMApplicationCacheCustom.cpp"
+#include "JSDOMBinding.cpp"
+#include "JSDOMGlobalObject.cpp"
+#include "JSDOMWindowBase.cpp"
+#include "JSDOMWindowCustom.cpp"
+#include "JSDOMWindowShell.cpp"
+#include "JSDataGridColumnListCustom.cpp"
+#include "JSDataGridDataSource.cpp"
+#include "JSDatabaseCustom.cpp"
+#include "JSDedicatedWorkerContextCustom.cpp"
+#include "JSDesktopNotificationsCustom.cpp"
+#include "JSDocumentCustom.cpp"
+#include "JSDocumentFragmentCustom.cpp"
+#include "JSElementCustom.cpp"
+#include "JSEventCustom.cpp"
+#include "JSEventListener.cpp"
+#include "JSEventSourceConstructor.cpp"
+#include "JSEventSourceCustom.cpp"
+#include "JSEventTarget.cpp"
+#include "JSExceptionBase.cpp"
+#include "JSHTMLAllCollectionCustom.cpp"
+#include "JSHTMLAppletElementCustom.cpp"
+#include "JSHTMLCanvasElementCustom.cpp"
+#include "JSHTMLCollectionCustom.cpp"
+#include "JSHTMLDataGridElementCustom.cpp"
+#include "JSHTMLDocumentCustom.cpp"
+#include "JSHTMLElementCustom.cpp"
+#include "JSHTMLEmbedElementCustom.cpp"
+#include "JSHTMLFormElementCustom.cpp"
+#include "JSHTMLFrameElementCustom.cpp"
+#include "JSHTMLFrameSetElementCustom.cpp"
+#include "JSHTMLIFrameElementCustom.cpp"
+#include "JSHTMLInputElementCustom.cpp"
+#include "JSHTMLObjectElementCustom.cpp"
+#include "JSHTMLOptionsCollectionCustom.cpp"
+#include "JSHTMLSelectElementCustom.cpp"
+#include "JSHistoryCustom.cpp"
+#include "JSImageConstructor.cpp"
+#include "JSImageDataCustom.cpp"
+#include "JSInjectedScriptHostCustom.cpp"
+#include "JSInspectedObjectWrapper.cpp"
+#include "JSInspectorFrontendHostCustom.cpp"
+#include "JSJavaScriptCallFrameCustom.cpp"
+#include "JSLazyEventListener.cpp"
+#include "JSLocationCustom.cpp"
+#include "JSMessageChannelConstructor.cpp"
+#include "JSMessageChannelCustom.cpp"
+#include "JSMessageEventCustom.cpp"
+#include "JSMessagePortCustom.cpp"
+#include "JSMimeTypeArrayCustom.cpp"
+#include "JSNamedNodeMapCustom.cpp"
+#include "JSNavigatorCustom.cpp"
+#include "JSNodeCustom.cpp"
+#include "JSNodeFilterCondition.cpp"
+#include "JSNodeFilterCustom.cpp"
+#include "JSNodeIteratorCustom.cpp"
+#include "JSNodeListCustom.cpp"
+#include "JSOptionConstructor.cpp"
+#include "JSPluginArrayCustom.cpp"
+#include "JSPluginCustom.cpp"
+#include "JSPluginElementFunctions.cpp"
+#include "JSQuarantinedObjectWrapper.cpp"
+#include "JSSQLResultSetRowListCustom.cpp"
+#include "JSSQLTransactionCustom.cpp"
+#include "JSSVGElementInstanceCustom.cpp"
+#include "JSSVGLengthCustom.cpp"
+#include "JSSVGMatrixCustom.cpp"
+#include "JSSVGPathSegCustom.cpp"
+#include "JSSVGPathSegListCustom.cpp"
+#include "JSSVGPointListCustom.cpp"
+#include "JSSharedWorkerConstructor.cpp"
+#include "JSSharedWorkerCustom.cpp"
+#include "JSStorageCustom.cpp"
+#include "JSStyleSheetCustom.cpp"
+#include "JSStyleSheetListCustom.cpp"
+#include "JSTextCustom.cpp"
+#include "JSTreeWalkerCustom.cpp"
+#include "JSWebKitCSSMatrixConstructor.cpp"
+#include "JSWebKitPointConstructor.cpp"
+#include "JSWebSocketConstructor.cpp"
+#include "JSWebSocketCustom.cpp"
+#include "JSWorkerConstructor.cpp"
+#include "JSWorkerContextBase.cpp"
+#include "JSWorkerContextCustom.cpp"
+#include "JSWorkerCustom.cpp"
+#include "JSXMLHttpRequestConstructor.cpp"
+#include "JSXMLHttpRequestCustom.cpp"
+#include "JSXMLHttpRequestUploadCustom.cpp"
+#include "JSXSLTProcessorConstructor.cpp"
+#include "JSXSLTProcessorCustom.cpp"
+#include "ScheduledAction.cpp"
+#include "ScriptArray.cpp"
+#include "ScriptCachedFrameData.cpp"
+#include "ScriptCallFrame.cpp"
+#include "ScriptCallStack.cpp"
+#include "ScriptController.cpp"
+#include "ScriptControllerWin.cpp"
+#include "ScriptEventListener.cpp"
+#include "ScriptFunctionCall.cpp"
+#include "ScriptState.cpp"
+#include "SerializedScriptValue.cpp"
+#include "WorkerScriptController.cpp"
diff --git a/WebCore/bindings/js/JSCSSRuleCustom.cpp b/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 1b96c06..b0adf15 100644
--- a/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -54,7 +54,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSRule* rule)
     if (!rule)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, rule);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSCSSValueCustom.cpp b/WebCore/bindings/js/JSCSSValueCustom.cpp
index 87a5760..83c1d3a 100644
--- a/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -49,7 +49,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, CSSValue* value)
     if (!value)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, value);
 
     if (wrapper)
         return wrapper;
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
index 38292c7..e128f27 100644
--- a/WebCore/bindings/js/JSCallbackData.cpp
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -47,13 +47,8 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     ASSERT(globalObject());
 
     ExecState* exec = globalObject()->globalExec();
-    
-    JSValue function;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        function = callback()->get(exec, Identifier(exec, "handleEvent"));
-    }
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -64,7 +59,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
+    JSValue result = JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
index 5c86701..b939c01 100644
--- a/WebCore/bindings/js/JSCallbackData.h
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -48,7 +48,6 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
-        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -65,7 +64,6 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index bb3500b..a271923 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -51,10 +51,10 @@ static JSValue toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue value)
 {
     if (value.isString())
-        return CanvasStyle::create(asString(value)->value());
+        return CanvasStyle::create(asString(value)->value(exec));
     if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
@@ -102,13 +102,13 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value());
+                context->setFillColor(asString(args.at(0))->value(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setFillColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -139,13 +139,13 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
     switch (args.size()) {
         case 1:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value());
+                context->setStrokeColor(asString(args.at(0))->value(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
             if (args.at(0).isString())
-                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
+                context->setStrokeColor(asString(args.at(0))->value(exec), args.at(1).toFloat(exec));
             else
                 context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
@@ -298,7 +298,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 4:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
@@ -306,7 +306,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
         case 5:
             if (args.at(3).isString())
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
-                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(exec),
                                    args.at(4).toFloat(exec));
             else
                 context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index 3938ba1..0000000
--- a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,443 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasRenderingContext3D.h"
-
-#include "CanvasRenderingContext3D.h"
-#include "ExceptionCode.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLImageElement.h"
-#include "JSCanvasFloatArray.h"
-#include "JSCanvasIntArray.h"
-#include "JSHTMLCanvasElement.h"
-#include "JSHTMLImageElement.h"
-#include "JSWebKitCSSMatrix.h"
-#include <runtime/Error.h>
-#include <wtf/FastMalloc.h>
-#include <wtf/OwnFastMallocPtr.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned usage = args.at(2).toInt32(exec);
-
-    // If argument 1 is a number, we are initializing this buffer to that size
-    if (!args.at(1).isObject()) {
-        unsigned int count = args.at(1).toInt32(exec);
-        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
-        return jsUndefined();
-    }
-
-    CanvasArray* array = toCanvasArray(args.at(1));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
-    return jsUndefined();
-}
-
-JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned offset = args.at(1).toInt32(exec);
-    
-    CanvasArray* array = toCanvasArray(args.at(2));
-    
-    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
-    return jsUndefined();
-}
-
-// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 3)
-        return throwError(exec, SyntaxError);
-
-    ExceptionCode ec = 0;
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    unsigned level = args.at(1).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-    
-    if (args.size() > 5) {
-        // This must be the bare array case.
-        if (args.size() != 9)
-            return throwError(exec, SyntaxError);
-            
-        unsigned internalformat = args.at(2).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned width = args.at(3).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned height = args.at(4).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned border = args.at(5).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned format = args.at(6).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        unsigned type = args.at(7).toInt32(exec);
-        if (exec->hadException())    
-            return jsUndefined();
-
-        CanvasArray* array = toCanvasArray(args.at(8));
-        if (exec->hadException())    
-            return jsUndefined();
-            
-        if (!array)
-            return throwError(exec, TypeError);
-        
-        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
-        // depending on the passed type parameter.
-        
-        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
-        return jsUndefined();
-    }
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(2);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
-JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
-{ 
-    if (args.size() < 7 || args.size() > 9)
-        return throwError(exec, SyntaxError);
-
-    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
-    unsigned target = args.at(0).toInt32(exec);
-    unsigned level = args.at(1).toInt32(exec);
-    unsigned xoff = args.at(2).toInt32(exec);
-    unsigned yoff = args.at(3).toInt32(exec);
-    unsigned width = args.at(4).toInt32(exec);
-    unsigned height = args.at(5).toInt32(exec);
-    
-    // The image parameter can be a <img> or <canvas> element.
-    JSValue value = args.at(6);
-    if (!value.isObject())
-        return throwError(exec, TypeError);
-    JSObject* o = asObject(value);
-    
-    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
-    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
-    
-    ExceptionCode ec = 0;
-    if (o->inherits(&JSHTMLImageElement::s_info)) {
-        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
-    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
-        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
-        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
-    } else {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-    }
-    
-    return jsUndefined();    
-}
-
-template<typename T>
-void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
-{
-    array = 0;
-    
-    if (!value.isObject())
-        return;
-        
-    JSC::JSObject* object = asObject(value);
-    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
-    void* tempValues;
-    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
-        return;
-    
-    T* values = static_cast<T*>(tempValues);
-    for (int i = 0; i < length; ++i) {
-        JSC::JSValue v = object->get(exec, i);
-        if (exec->hadException())
-            return;
-        values[i] = static_cast<T>(v.toNumber(exec));
-    }
-
-    array = values;
-    size = length;
-}
-
-enum DataFunctionToCall {
-    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
-    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
-};
-
-enum DataFunctionMatrixToCall {
-    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
-};
-
-static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
-            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
-            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
-            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
-            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1fv(location, array, size); break;
-        case f_uniform2v: context->uniform2fv(location, array, size); break;
-        case f_uniform3v: context->uniform3fv(location, array, size); break;
-        case f_uniform4v: context->uniform4fv(location, array, size); break;
-        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
-        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
-        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
-        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 2)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
-            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
-            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
-            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
-            default: break;
-        }
-        return jsUndefined();
-    }
-    
-    int* array;
-    int size;
-    toArray<int>(exec, args.at(1), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniform1v: context->uniform1iv(location, array, size); break;
-        case f_uniform2v: context->uniform2iv(location, array, size); break;
-        case f_uniform3v: context->uniform3iv(location, array, size); break;
-        case f_uniform4v: context->uniform4iv(location, array, size); break;
-        default: break;
-    }
-    return jsUndefined();
-}
-
-static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
-{
-    if (args.size() != 3)
-        return throwError(exec, SyntaxError);
-
-    long location = args.at(0).toInt32(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    bool transpose = args.at(1).toBoolean(exec);
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
-    if (exec->hadException())    
-        return jsUndefined();
-        
-    if (canvasArray) {
-        switch(f) {
-            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
-            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
-        }
-        return jsUndefined();
-    }
-    
-    float* array;
-    int size;
-    toArray<float>(exec, args.at(2), array, size);
-    
-    if (!array)
-        return throwError(exec, TypeError);
-
-    switch(f) {
-        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
-        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
-        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
-    }
-    return jsUndefined();
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
index 0cd2aa3..df24eb7 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -29,8 +29,8 @@
 #include "CanvasRenderingContext2D.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "CanvasRenderingContext3D.h"
-#include "JSCanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 
 using namespace JSC;
@@ -44,7 +44,7 @@ JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasR
 
 #if ENABLE(3D_CANVAS)
     if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+        return getDOMObjectWrapper<JSWebGLRenderingContext>(exec, globalObject, static_cast<WebGLRenderingContext*>(object));
 #endif
     ASSERT(object->is2d());
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
deleted file mode 100644
index 23c197f..0000000
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSCanvasUnsignedShortArrayConstructor_h
-#define JSCanvasUnsignedShortArrayConstructor_h
-
-#include "JSDOMBinding.h"
-#include "JSDocument.h"
-
-namespace WebCore {
-
-    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
-    public:
-        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    };
-
-}
-
-#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
index 9c48467..8366b39 100644
--- a/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSConsole.h"
 #include "JavaScriptProfile.h"
+#include "ScriptCallStack.h"
 #include <runtime/JSArray.h>
 
 #include "Console.h"
@@ -50,6 +51,22 @@ JSValue JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+JSValue JSConsole::profile(ExecState* exec, const ArgList& args)
+{
+    ScriptCallStack callStack(exec, args, 1);
+    const UString title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    impl()->profile(title, &callStack);
+    return jsUndefined();
+}
+
+JSValue JSConsole::profileEnd(ExecState* exec, const ArgList& args)
+{
+    ScriptCallStack callStack(exec, args, 1);
+    const UString title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    impl()->profileEnd(title, &callStack);
+    return jsUndefined();
+}
+
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index c2884d7..07cfc74 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
+    JSValue retval = JSC::call(exec, function, callType, callData, m_customResolver, args);
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index ef69c7b..f12c779 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -45,6 +45,7 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "ScriptCachedFrameData.h"
 #include "ScriptController.h"
 #include "Settings.h"
 #include "XMLHttpRequestException.h"
@@ -167,29 +168,6 @@ DOMWrapperWorld::~DOMWrapperWorld()
 
     for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
         forgetWorldOfDOMNodesForDocument(*iter, this);
-    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
-        (*iter)->forgetWorld(this);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
-{
-    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
-    ASSERT(clientData);
-    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
-    m_clientData->m_worldStack.append(isolatedWorld);
-}
-
-EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
-{
-    m_clientData->m_worldStack.removeLast();
 }
 
 class JSGlobalDataWorldIterator {
@@ -228,16 +206,9 @@ private:
     HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
-{
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
-}
-
 DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
 {
-    return currentWorld(exec->globalData());
+    return static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->world();
 }
 
 DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
@@ -250,16 +221,8 @@ DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
 DOMWrapperWorld* mainThreadNormalWorld()
 {
     ASSERT(isMainThread());
-    return normalWorld(*JSDOMWindow::commonJSGlobalData());
-}
-
-DOMWrapperWorld* mainThreadCurrentWorld()
-{
-    ASSERT(isMainThread());
-
-    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
-    ASSERT(clientData);
-    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+    static DOMWrapperWorld* cachedNormalWorld = normalWorld(*JSDOMWindow::commonJSGlobalData());
+    return cachedNormalWorld;
 }
 
 DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
@@ -274,28 +237,49 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
     return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
-inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
+static inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSC::ExecState* exec)
 {
-    return currentWorld(globalData)->m_wrappers;
+    return currentWorld(exec)->m_wrappers;
 }
 
-DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+bool hasCachedDOMObjectWrapper(JSGlobalData* globalData, void* objectHandle)
 {
-    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        if (worldIter->m_wrappers.contains(objectHandle))
+            return true;
+    }
+    return false;
 }
 
-void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+DOMObject* getCachedDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle) 
+{
+    return DOMObjectWrapperMapFor(exec).get(objectHandle);
+}
+
+void cacheDOMObjectWrapper(JSC::ExecState* exec, void* objectHandle, DOMObject* wrapper) 
 {
     addWrapper(wrapper);
-    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
+    DOMObjectWrapperMapFor(exec).set(objectHandle, wrapper);
+}
+
+bool hasCachedDOMNodeWrapper(Document* document, Node* node)
+{
+    if (!document)
+        return hasCachedDOMObjectWrapper(JSDOMWindow::commonJSGlobalData(), node);
+
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+        if (iter->second->contains(node))
+            return true;
+    }
+    return false;
 }
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
+JSNode* getCachedDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node)
 {
     if (document)
-        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
-    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+        return document->getWrapperCache(currentWorld(exec))->get(node);
+    return static_cast<JSNode*>(DOMObjectWrapperMapFor(exec).get(node));
 }
 
 void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
@@ -337,15 +321,15 @@ void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
     ASSERT(!wrapperSet().contains(wrapper));
 }
 
-void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+void cacheDOMNodeWrapper(JSC::ExecState* exec, Document* document, Node* node, JSNode* wrapper)
 {
     if (!document) {
         addWrapper(wrapper);
-        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
+        DOMObjectWrapperMapFor(exec).set(node, wrapper);
         return;
     }
     addWrapper(wrapper);
-    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
+    document->getWrapperCache(currentWorld(exec))->set(node, wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
@@ -537,6 +521,23 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
     }
 }
 
+void markDOMNodeWrapper(MarkStack& markStack, Document* document, Node* node)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->get(node))
+                markStack.append(wrapper);
+        }
+        return;
+    }
+
+    for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.get(node))
+            markStack.append(wrapper);
+    }
+}
+
 JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
@@ -810,28 +811,4 @@ bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDe
     return false;
 }
 
-JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
-{
-    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
-    return debuggerCallFrame.evaluate(script, exception);
-}
-
-JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::call(exec, function, callType, callData, thisValue, args);
-}
-
-JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::construct(exec, object, constructType, constructData, args);
-}
-
-Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
-{
-    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
-    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index ba41d85..3982dad 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class Node;
     class String;
     class ScriptController;
+    class ScriptCachedFrameData;
 
     typedef int ExceptionCode;
 
@@ -147,8 +148,6 @@ namespace WebCore {
 
         void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
         void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
-        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
-        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
 
         // FIXME: can we make this private?
         DOMObjectWrapperMap m_wrappers;
@@ -156,7 +155,6 @@ namespace WebCore {
     private:
         JSC::JSGlobalData* m_globalData;
         HashSet<Document*> documentsWithWrappers;
-        HashSet<ScriptController*> scriptControllersWithShells;
     };
 
     // Map from static HashTable instances to per-GlobalData ones.
@@ -184,21 +182,23 @@ namespace WebCore {
     };
 
     class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
-        friend class EnterDOMWrapperWorld;
         friend class JSGlobalDataWorldIterator;
 
     public:
         WebCoreJSClientData(JSC::JSGlobalData* globalData)
             : m_normalWorld(globalData)
         {
-            m_worldStack.append(&m_normalWorld);
             m_worldSet.add(&m_normalWorld);
         }
         // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
 
-        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
         DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
 
+        void getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+        {
+            copyToVector(m_worldSet, worlds);
+        }
+
         void rememberWorld(DOMWrapperWorld* world)
         {
             ASSERT(!m_worldSet.contains(world));
@@ -212,34 +212,26 @@ namespace WebCore {
 
         DOMObjectHashTableMap hashTableMap;
     private:
-        Vector<DOMWrapperWorld*> m_worldStack;
         HashSet<DOMWrapperWorld*> m_worldSet;
         DOMWrapperWorld m_normalWorld;
     };
 
-    class EnterDOMWrapperWorld {
-    public:
-        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
-        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
-        ~EnterDOMWrapperWorld();
-
-    private:
-        WebCoreJSClientData* m_clientData;
-    };
-
-    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
-    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
+    bool hasCachedDOMObjectWrapper(JSC::JSGlobalData*, void* objectHandle);
+    DOMObject* getCachedDOMObjectWrapper(JSC::ExecState*, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::ExecState*, void* objectHandle, DOMObject* wrapper);
     void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
     void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
-    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
-    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    bool hasCachedDOMNodeWrapper(Document*, Node*);
+    JSNode* getCachedDOMNodeWrapper(JSC::ExecState*, Document*, Node*);
+    void cacheDOMNodeWrapper(JSC::ExecState*, Document*, Node*, JSNode* wrapper);
     void forgetAllDOMNodesForDocument(Document*);
     void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
+    void markDOMNodeWrapper(JSC::MarkStack& markStack, Document* document, Node* node);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
@@ -248,7 +240,6 @@ namespace WebCore {
 
     DOMWrapperWorld* currentWorld(JSC::ExecState*);
     DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
-    DOMWrapperWorld* mainThreadCurrentWorld();
     DOMWrapperWorld* mainThreadNormalWorld();
     inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
     inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
@@ -283,17 +274,17 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         // FIXME: new (exec) could use a different globalData than the globalData this wrapper is cached on.
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object);
     }
@@ -303,16 +294,16 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         ASSERT(object);
-        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        ASSERT(!getCachedDOMObjectWrapper(exec, object));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, object, context);
-        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        cacheDOMObjectWrapper(exec, object, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
             return wrapper;
         return createDOMObjectWrapper<WrapperClass>(exec, globalObject, object, context);
     }
@@ -322,18 +313,18 @@ namespace WebCore {
     template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         ASSERT(node);
-        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
         WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec, globalObject), globalObject, node);
         // FIXME: The entire function can be removed, once we fix caching.
         // This function is a one-off hack to make Nodes cache in the right global object.
-        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        cacheDOMNodeWrapper(exec, node->document(), node, wrapper);
         return wrapper;
     }
     template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node))
             return wrapper;
         return createDOMNodeWrapper<WrapperClass>(exec, globalObject, node);
     }
@@ -404,11 +395,6 @@ namespace WebCore {
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
-    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
-    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
-    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
-    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
-
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 6b75a6f..647730c 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -66,17 +66,14 @@ namespace WebCore {
 
         virtual void markChildren(JSC::MarkStack&);
 
+        DOMWrapperWorld* world() { return d()->m_world.get(); }
+
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData()
-                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
-                , evt(0)
-            {
-            }
-
-            JSDOMGlobalObjectData(Destructor destructor)
+            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
                 : JSGlobalObjectData(destructor)
                 , evt(0)
+                , m_world(world)
             {
             }
 
@@ -84,6 +81,7 @@ namespace WebCore {
             JSDOMConstructorMap constructors;
 
             Event* evt;
+            RefPtr<DOMWrapperWorld> m_world;
         };
 
     private:
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index 86ff149..e3af13f 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,6 +42,13 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
+    , impl(window)
+    , shell(shell)
+{
+}
+
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
@@ -53,11 +60,10 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
+void JSDOMWindowBase::updateDocument()
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
-    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 31e2486..66af344 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -47,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument(DOMWrapperWorld*);
+        void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -77,12 +77,7 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
-                , impl(window)
-                , shell(shell)
-            {
-            }
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2804b3c..66fe926 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -53,14 +53,14 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArrayConstructor.h"
-#include "JSCanvasUnsignedByteArrayConstructor.h"
-#include "JSCanvasIntArrayConstructor.h"
-#include "JSCanvasUnsignedIntArrayConstructor.h"
-#include "JSCanvasShortArrayConstructor.h"
-#include "JSCanvasUnsignedShortArrayConstructor.h"
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 #endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
@@ -297,10 +297,10 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
 
 bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-    
+    // Never allow cross-domain getOwnPropertyDescriptor
+    if (!allowsAccessFrom(exec))
+        return false;
+
     const HashEntry* entry;
     
     // We don't want any properties other than "close" and "closed" on a closed window.
@@ -323,11 +323,6 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
         return true;
     }
 
-    String errorMessage;
-    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
-    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
-        return true;
-
     // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
     // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
     // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
@@ -335,51 +330,13 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
         if (entry->attributes() & Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    PropertySlot slot;
-                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
-                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
                 if (!DOMWindow::canShowModalDialog(impl()->frame())) {
                     descriptor.setUndefined();
                     return true;
                 }
             }
         }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                PropertySlot slot;
-                slot.setCustom(this, objectToStringFunctionGetter);
-                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
-                return true;
-            }
-        }
     }
     
     entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -406,13 +363,8 @@ bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pr
     // precedence over the index and name getters.  
     JSValue proto = prototype();
     if (proto.isObject()) {
-        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
-            if (!allowsAccess) {
-                printErrorMessage(errorMessage);
-                descriptor.setUndefined();
-            }
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor))
             return true;
-        }
     }
 
     bool ok;
@@ -482,14 +434,6 @@ void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& proper
     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    // Only allow getting property attributes properties by frames in the same origin.
-    if (!allowsAccessFrom(exec))
-        return false;
-    return Base::getPropertyAttributes(exec, propertyName, attributes);
-}
-
 void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
@@ -540,24 +484,24 @@ JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyNam
 JSValue JSDOMWindow::history(ExecState* exec) const
 {
     History* history = impl()->history();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, history))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    cacheDOMObjectWrapper(exec, history, jsHistory);
     return jsHistory;
 }
 
 JSValue JSDOMWindow::location(ExecState* exec) const
 {
     Location* location = impl()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -645,44 +589,44 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
 }
  
 #if ENABLE(3D_CANVAS)
-JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+JSValue JSDOMWindow::webGLArrayBuffer(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLArrayBufferConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedByteArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedByteArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedIntArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedIntArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLUnsignedShortArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLUnsignedShortArrayConstructor>(exec, this);
 }
  
-JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+JSValue JSDOMWindow::webGLFloatArray(ExecState* exec) const
 {
-    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+    return getDOMConstructor<JSWebGLFloatArrayConstructor>(exec, this);
 }
 #endif
  
@@ -744,6 +688,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     ASSERT(lexicalFrame);
     ASSERT(dynamicFrame);
 
+    // Sandboxed iframes cannot open new auxiliary browsing contexts.
+    if (lexicalFrame && lexicalFrame->loader()->isSandboxed(SandboxNavigation))
+        return 0;
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the dynamicGlobalObject to determine
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index 9072f91..09141ee 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -43,9 +43,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
-JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
     : Base(JSDOMWindowShell::createStructure(jsNull()))
     , m_window(0)
+    , m_world(world)
 {
     setWindow(window);
 }
@@ -123,11 +124,6 @@ void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& p
     m_window->getOwnPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
-{
-    return m_window->getPropertyAttributes(exec, propertyName, attributes);
-}
-
 void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     m_window->defineGetter(exec, propertyName, getterFunction, attributes);
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 36cb8d6..27036d4 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class JSDOMWindowShell : public DOMObject {
         typedef DOMObject Base;
     public:
-        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        JSDOMWindowShell(PassRefPtr<DOMWindow>, DOMWrapperWorld* world);
         virtual ~JSDOMWindowShell();
 
         JSDOMWindow* window() const { return m_window; }
@@ -63,6 +63,8 @@ namespace WebCore {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
+        DOMWrapperWorld* world() { return m_world.get(); }
+
     private:
         static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
 
@@ -75,7 +77,6 @@ namespace WebCore {
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
         virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
@@ -85,6 +86,7 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
+        RefPtr<DOMWrapperWorld> m_world;
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index d7f8725..4aa6583 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -26,7 +26,7 @@
 #include "HTMLDocument.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
@@ -65,11 +65,11 @@ JSValue JSDocument::location(ExecState* exec) const
         return jsNull();
 
     Location* location = frame->domWindow()->location();
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, location))
         return wrapper;
 
     JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, globalObject()), globalObject(), location);
-    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    cacheDOMObjectWrapper(exec, location, jsLocation);
     return jsLocation;
 }
 
@@ -96,7 +96,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* documen
     if (!document)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, document);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index fb64ff2..c725290 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -145,7 +145,7 @@ JSValue toJSNewlyCreated(ExecState* exec, JSDOMGlobalObject* globalObject, Eleme
     if (!element)
         return jsNull();
 
-    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+    ASSERT(!getCachedDOMNodeWrapper(exec, element->document(), element));
 
     JSNode* wrapper;        
     if (element->isHTMLElement())
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 28e38ac..06b2fe5 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -30,9 +30,11 @@
 #include "JSEvent.h"
 
 #include "Clipboard.h"
+#include "CompositionEvent.h"
 #include "Event.h"
 #include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
+#include "JSCompositionEvent.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
 #include "JSMessageEvent.h"
@@ -40,6 +42,7 @@
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
 #include "JSPageTransitionEvent.h"
+#include "JSPopStateEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -55,6 +58,7 @@
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
 #include "PageTransitionEvent.h"
+#include "PopStateEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -95,7 +99,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     if (!event)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, event);
     if (wrapper)
         return wrapper;
 
@@ -112,10 +116,15 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         else if (event->isSVGZoomEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, SVGZoomEvent, event);
 #endif
+<<<<<<< HEAD:WebCore/bindings/js/JSEventCustom.cpp
 #if ENABLE(TOUCH_EVENTS) // Android
         else if (event->isTouchEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, TouchEvent, event);
 #endif
+=======
+        else if (event->isCompositionEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, CompositionEvent, event);
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/JSEventCustom.cpp
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, UIEvent, event);
     } else if (event->isMutationEvent())
@@ -145,6 +154,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
     else if (event->isErrorEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
 #endif
+    else if (event->isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
     else
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
 
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 1a999a8..73060f1 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -86,13 +86,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     }
 
     ExecState* exec = globalObject->globalExec();
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
 
-    JSValue handleEventFunction;
-    {
-        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
-        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
-        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
-    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -114,8 +109,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
-            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
+            ? JSC::call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : JSC::call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -166,7 +161,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSValue returnValue = JSC::call(exec, jsFunction, callType, callData, thisValue, args);
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 8ecd287..751e7de 100644
--- a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -29,7 +29,7 @@
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)
-#include "JSCanvasRenderingContext3D.h"
+#include "JSWebGLRenderingContext.h"
 #endif
 #include <wtf/GetPtr.h>
 
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd4ceaa..ba61922 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -134,7 +134,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
     if (!collection)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, collection);
 
     if (wrapper)
         return wrapper;
diff --git a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index a65ca7c..7fde002 100644
--- a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -113,7 +113,7 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
+                return JSC::call(exec, function, callType, callData, wrapper, args);
             }
         }
         return jsUndefined();
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index b24b1ff..3076503 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -95,15 +95,15 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
 
 bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, impl()->frame(), message))
-        return false;
-    
+    if (!impl()->frame()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    // Throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
     if (entry) {
@@ -133,8 +133,7 @@ bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifi
             return true;
         }
     }
-    
-    printErrorMessageForFrame(impl()->frame(), message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -163,4 +162,52 @@ void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& property
     Base::getOwnPropertyNames(exec, propertyNames);
 }
 
+JSValue JSHistory::pushState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList& args)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() > 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageDataCustom.cpp b/WebCore/bindings/js/JSImageDataCustom.cpp
index fa3b1d5..61c5112 100644
--- a/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -41,7 +41,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     if (!imageData)
         return jsNull();
     
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, imageData);
     if (wrapper)
         return wrapper;
     
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 439f532..fcc9e5e 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -31,7 +31,7 @@
  */
 
 #include "config.h"
-#include "JSInspectorBackend.h"
+#include "JSInjectedScriptHost.h"
 
 #if ENABLE(INSPECTOR)
 
@@ -43,7 +43,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "InspectorBackend.h"
+#include "InjectedScriptHost.h"
 #include "InspectorController.h"
 #include "InspectorResource.h"
 #include "JSDOMWindow.h"
@@ -73,53 +73,8 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    impl()->highlight(args.at(0).toInt32(exec));
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    Node* node = toNode(args.at(0));
-    if (!node)
-        return jsUndefined();
-
-    String target = args.at(1).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    MarkedArgumentBuffer result;
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result.append(toJS(exec, resultRange.get()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return constructArray(exec, result);
-}
-
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -137,7 +92,7 @@ JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 }
 #endif
 
-JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
+JSValue JSInjectedScriptHost::inspectedWindow(ExecState*, const ArgList&)
 {
     InspectorController* ic = impl()->inspectorController();
     if (!ic)
@@ -146,89 +101,7 @@ JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
 }
 
-JSValue JSInspectorBackend::setting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 1)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return jsUndefined();
-        case InspectorController::Setting::StringType:
-            return jsString(exec, setting.string());
-        case InspectorController::Setting::DoubleType:
-            return jsNumber(exec, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return jsNumber(exec, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return jsBoolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            MarkedArgumentBuffer stringsArray;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray.append(jsString(exec, strings[i]));
-            return constructArray(exec, stringsArray);
-        }
-    }
-}
-
-JSValue JSInspectorBackend::setSetting(ExecState* exec, const ArgList& args)
-{
-    if (args.size() < 2)
-        return jsUndefined();
-
-    String key = args.at(0).toString(exec);
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController::Setting setting;
-
-    JSValue value = args.at(1);
-    if (value.isUndefined() || value.isNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value.isString())
-        setting.set(value.toString(exec));
-    else if (value.isNumber())
-        setting.set(value.toNumber(exec));
-    else if (value.isBoolean())
-        setting.set(value.toBoolean(exec));
-    else {
-        JSArray* jsArray = asArray(value);
-        if (!jsArray)
-            return jsUndefined();
-        Vector<String> strings;
-        for (unsigned i = 0; i < jsArray->length(); ++i) {
-            String item = jsArray->get(exec, i).toString(exec);
-            if (exec->hadException())
-                return jsUndefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    }
-
-    if (exec->hadException())
-        return jsUndefined();
-
-    InspectorController* ic = impl()->inspectorController();
-    if (ic)
-        ic->setSetting(key, setting);
-
-    return jsUndefined();
-}
-
-JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::wrapCallback(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -238,7 +111,7 @@ JSValue JSInspectorBackend::wrapCallback(ExecState* exec, const ArgList& args)
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
+JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec, const ArgList&)
 {
     JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
     if (!callFrame || !callFrame->isValid())
@@ -253,7 +126,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
 
 #endif
 
-JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::nodeForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -271,7 +144,7 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
-JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::wrapObject(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
@@ -279,7 +152,7 @@ JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
     return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
 }
 
-JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::unwrapObject(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -287,7 +160,7 @@ JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
     return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
 }
 
-JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+JSValue JSInjectedScriptHost::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return jsUndefined();
@@ -305,7 +178,7 @@ JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgLis
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+JSValue JSInjectedScriptHost::selectDatabase(ExecState*, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -322,7 +195,7 @@ JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+JSValue JSInjectedScriptHost::selectDOMStorage(ExecState*, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index ed79427..13f59b7 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -68,7 +68,8 @@ JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrapp
 
     if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrappedProto)));
 }
 
 JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 9c4330d..ff4fbb9 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -75,7 +75,8 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrappedProto.get()));
 }
 
 JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
diff --git a/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp b/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..1970bf7
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenuItem.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "InspectorController.h"
+#include "InspectorFrontendHost.h"
+#include "JSEvent.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "MouseEvent.h"
+#include "Node.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorFrontendHost::search(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    String target = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result.append(toJS(exec, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return constructArray(exec, result);
+}
+
+JSValue JSInspectorFrontendHost::showContextMenu(ExecState* execState, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Event* event = toEvent(args.at(0));
+
+    JSArray* array = asArray(args.at(1));
+    Vector<ContextMenuItem> items;
+
+    for (size_t i = 0; i < array->length(); ++i) {
+        JSObject* item = asObject(array->getIndex(i));
+        JSValue label = item->get(execState, Identifier(execState, "label"));
+        JSValue id = item->get(execState, Identifier(execState, "id"));
+        if (label.isUndefined() || id.isUndefined())
+            items.append(ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+        else {
+            ContextMenuAction typedId = static_cast<ContextMenuAction>(ContextMenuItemBaseCustomTag + id.toInt32(execState));
+            items.append(ContextMenuItem(ActionType, typedId, label.toString(execState)));
+        }
+    }
+
+    impl()->showContextMenu(event, items);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index c76a2b1..6c8e032 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -102,14 +102,9 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
         return true;
     }
     
-    // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
-    
-    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
-    // allowed, return false so the normal lookup will take place.
-    String message;
-    if (allowsAccessFromFrame(exec, frame, message))
-        return false;
+    // throw out all cross domain access
+    if (!allowsAccessFromFrame(exec, frame))
+        return true;
     
     // Check for the few functions that we allow, even when called cross-domain.
     const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -133,8 +128,7 @@ bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identif
     // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
     // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
     // such cases when normally the string form of Location would be the URL.
-    
-    printErrorMessageForFrame(frame, message);
+
     descriptor.setUndefined();
     return true;
 }
@@ -257,8 +251,9 @@ void JSLocation::setPort(ExecState* exec, JSValue value)
     const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
-        port = 0;
-    url.setPort(port);
+        url.removePort();
+    else
+        url.setPort(port);
 
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 1974ab0..d1bbeec 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -52,10 +52,8 @@ void JSNamedNodeMap::markChildren(MarkStack& markStack)
 
     // Mark the element so that this will work to access the attribute even if the last
     // other reference goes away.
-    if (Element* element = impl()->element()) {
-        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
-            markStack.append(wrapper);
-    }
+    if (Element* element = impl()->element())
+        markDOMNodeWrapper(markStack, element->document(), element);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index 2a4aa80..f375ae5 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -148,31 +148,34 @@ void JSNode::markChildren(MarkStack& markStack)
         return;
     }
 
-    // This is a node outside the document, so find the root of the tree it is in,
-    // and start marking from there.
+    // This is a node outside the document.
+    // Find the the root, and the highest ancestor with a wrapper.
     Node* root = node;
-    for (Node* current = m_impl.get(); current; current = current->parentNode())
+    Node* outermostNodeWithWrapper = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode()) {
         root = current;
+        if (hasCachedDOMNodeWrapper(current->document(), current))
+            outermostNodeWithWrapper = current;
+    }
 
-    // Nodes in a subtree are marked by the tree's root, so, if the root is already
-    // marking the tree, we don't need to explicitly mark any other nodes.
-    if (root->inSubtreeMark())
+    // Only nodes that have no ancestors with wrappers mark the subtree. In the common
+    // case, the root of the detached subtree has a wrapper, so the tree will only
+    // get marked once. Nodes that aren't outermost need to mark the outermost
+    // in case it is otherwise unreachable.
+    if (node != outermostNodeWithWrapper) {
+        markDOMNodeWrapper(markStack, m_impl->document(), outermostNodeWithWrapper);
         return;
+    }
 
     // Mark the whole tree subtree.
-    root->setInSubtreeMark(true);
-    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
-        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
-    root->setInSubtreeMark(false);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode())
+        markDOMNodeWrapper(markStack, m_impl->document(), nodeToMark);
 }
 
 static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
 {
     ASSERT(node);
-    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    ASSERT(!getCachedDOMNodeWrapper(exec, node->document(), node));
     
     JSNode* wrapper;    
     switch (node->nodeType()) {
@@ -239,7 +242,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Node* node)
     if (!node)
         return jsNull();
 
-    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
+    JSNode* wrapper = getCachedDOMNodeWrapper(exec, node->document(), node);
     if (wrapper)
         return wrapper;
 
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.cpp b/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 54dc020..d34f5c1 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
+    JSValue result = JSC::call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/WebCore/bindings/js/JSPopStateEventCustom.cpp b/WebCore/bindings/js/JSPopStateEventCustom.cpp
new file mode 100644
index 0000000..ee86a09
--- /dev/null
+++ b/WebCore/bindings/js/JSPopStateEventCustom.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSPopStateEvent.h"
+
+#include "PopStateEvent.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr<SerializedScriptValue> stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast<PopStateEvent*>(impl());
+    event->initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+JSC::JSValue JSPopStateEvent::state(JSC::ExecState* exec) const
+{
+    SerializedScriptValue* object = static_cast<PopStateEvent*>(impl())->state();
+    if (!object)
+        return JSC::jsNull();
+    
+    return object->deserialize(exec);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 2ab2c00..ea2f72f 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -245,9 +245,7 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
-
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
     JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
     ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
@@ -296,9 +294,7 @@ JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JS
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
-    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
-
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
     JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ba1cf22..5f26df3 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -43,9 +43,7 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // Mark the wrapper for our corresponding element, so it can mark its event handlers.
-    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
-    if (correspondingWrapper)
-        markStack.append(correspondingWrapper);
+    markDOMNodeWrapper(markStack, impl()->correspondingElement()->document(), impl()->correspondingElement());
 }
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
diff --git a/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index 35390b2..a9d0e54 100644
--- a/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,11 +25,30 @@
 
 #include "TransformationMatrix.h"
 #include "SVGException.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    if (!args.at(0).inherits(&JSSVGMatrix::s_info))
+        return throwError(exec, TypeError, "secondMatrix argument was not a SVGMatrix");
+
+    JSSVGMatrix* matrixObj = static_cast<JSSVGMatrix*>(asObject(args.at(0)));
+
+    TransformationMatrix m1(*impl());
+    TransformationMatrix m2(*(matrixObj->impl()));
+
+    JSC::JSValue result = toJS(exec, deprecatedGlobalObjectForPrototype(exec), JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(m1.multLeft(m2)).get(), m_context.get());
+
+    return result;
+}
+
 JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
diff --git a/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index 42fa878..d5be3fd 100644
--- a/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -64,7 +64,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, SVGPathSeg* objec
     if (!object)
         return jsNull();
 
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec, object))
         return wrapper;
 
     switch (object->pathSegType()) {
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index d711b6f..ecfc6a6 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -40,7 +40,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, StyleSheet* style
     if (!styleSheet)
         return jsNull();
 
-    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec, styleSheet);
     if (wrapper)
         return wrapper;
 
@@ -68,10 +68,8 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = sheet->ownerNode()) {
-        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
-            markStack.append(ownerNodeWrapper);
-    }
+    if (Node* ownerNode = sheet->ownerNode())
+        markDOMNodeWrapper(markStack, ownerNode->document(), ownerNode);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
index 93d53ca..9742db7 100644
--- a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.cpp
@@ -27,28 +27,28 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasArrayBufferConstructor.h"
+#include "JSWebGLArrayBufferConstructor.h"
 
 #include "Document.h"
-#include "CanvasArrayBuffer.h"
-#include "JSCanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+const ClassInfo JSWebGLArrayBufferConstructor::s_info = { "WebGLArrayBufferConstructor", 0, 0, 0 };
 
-JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLArrayBufferConstructor::JSWebGLArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLArrayBufferPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+    JSWebGLArrayBufferConstructor* jsConstructor = static_cast<JSWebGLArrayBufferConstructor*>(constructor);
 
     unsigned int size = 0;
     if (args.size() == 1) {
@@ -56,10 +56,10 @@ static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* construct
         if (isnan(size))
             size = 0;
     }
-    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+    return asObject(toJS(exec, jsConstructor->globalObject(), WebGLArrayBuffer::create(size)));
 }
 
-JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasArrayBuffer;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
index 5f1254e..98e364b 100644
--- a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
+++ b/WebCore/bindings/js/JSWebGLArrayBufferConstructor.h
@@ -23,26 +23,26 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasArrayBufferConstructor_h
-#define JSCanvasArrayBufferConstructor_h
+#ifndef JSWebGLArrayBufferConstructor_h
+#define JSWebGLArrayBufferConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
-#include "JSCanvasArrayBuffer.h"
+#include "JSWebGLArrayBuffer.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
-    class CanvasArray;
+    class WebGLArray;
 
     // Template function used by CanvasXXXArrayConstructors
     template<class C, typename T>
-    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    PassRefPtr<WebGLArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
     {
         // There are 3 constructors:
         //
         //  1) (in int size)
-        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  2) (in WebGLArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
         //  3) (in sequence<T>) - This ends up being a JS "array-like" object
         //
         RefPtr<C> arrayObject;
@@ -52,7 +52,7 @@ namespace WebCore {
             return C::create(0, 0, 0);
         
         if (args.at(0).isObject()) {
-            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            RefPtr<WebGLArrayBuffer> buffer = toWebGLArrayBuffer(args.at(0));
             if (buffer) {
                 int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
                 unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
@@ -82,9 +82,9 @@ namespace WebCore {
         return C::create(size);
     }
 
-    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    class JSWebGLArrayBufferConstructor : public DOMConstructorObject {
     public:
-        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -94,4 +94,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasArrayBufferConstructor_h
+#endif // JSWebGLArrayBufferConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLArrayCustom.cpp b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
new file mode 100644
index 0000000..9018544
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLArrayCustom.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLByteArray.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebGLShortArray.h"
+#include "JSWebGLUnsignedShortArray.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLUnsignedIntArray.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    if (object) {
+        if (object->isFloatArray())
+            return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, static_cast<WebGLFloatArray*>(object));
+        if (object->isUnsignedByteArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, static_cast<WebGLUnsignedByteArray*>(object));
+        if (object->isByteArray())
+            return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, static_cast<WebGLByteArray*>(object));
+        if (object->isIntArray())
+            return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, static_cast<WebGLIntArray*>(object));
+        if (object->isUnsignedIntArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, static_cast<WebGLUnsignedIntArray*>(object));
+        if (object->isShortArray())
+            return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, static_cast<WebGLShortArray*>(object));
+        if (object->isUnsignedShortArray())
+            return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, static_cast<WebGLUnsignedShortArray*>(object));
+    }
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSWebGLArrayHelper.h b/WebCore/bindings/js/JSWebGLArrayHelper.h
new file mode 100644
index 0000000..f538cce
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLArrayHelper.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLArrayHelper_h
+#define JSWebGLArrayHelper_h
+
+#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
+#include <runtime/Error.h>
+#include <runtime/JSObject.h>
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+template <class T>
+JSC::JSValue setWebGLArrayFromArray(JSC::ExecState* exec, T* webGLArray, JSC::ArgList const& args)
+{
+    if (args.at(0).isObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        JSC::JSObject* array = JSC::asObject(args.at(0));
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+        for (int i = 0; i < length; i++) {
+            JSC::JSValue v = array->get(exec, i);
+            if (exec->hadException())
+                return JSC::jsUndefined();
+            webGLArray->set(i + offset, v.toNumber(exec));
+        }
+
+        return JSC::jsUndefined();
+    }
+
+    return JSC::throwError(exec, JSC::SyntaxError);
+}
+
+}
+
+#endif // JSWebGLArrayHelper_h
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
index 6d57912..7db710f 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLByteArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArrayConstructor.h"
+#include "JSWebGLByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasIntArray.h"
+#include "WebGLByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLByteArrayConstructor::s_info = { "WebGLByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLByteArrayConstructor::JSWebGLByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
-    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    JSWebGLByteArrayConstructor* jsConstructor = static_cast<JSWebGLByteArrayConstructor*>(constructor);
+    RefPtr<WebGLByteArray> array = static_cast<WebGLByteArray*>(construct<WebGLByteArray, signed char>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasIntArray;
+    constructData.native.function = constructCanvasByteArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
index 5e19652..a201567 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasIntArrayConstructor_h
-#define JSCanvasIntArrayConstructor_h
+#ifndef JSWebGLByteArrayConstructor_h
+#define JSWebGLByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasIntArrayConstructor_h
+#endif // JSWebGLByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp b/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
new file mode 100644
index 0000000..f7872a8
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLByteArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLByteArray.h"
+
+#include "WebGLByteArray.h"
+
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLByteArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() < 1 || args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLByteArray* array = toWebGLByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
index ec1d66d..707fe56 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasByteArrayConstructor.h"
+#include "JSWebGLFloatArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasByteArray.h"
+#include "WebGLFloatArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLFloatArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLFloatArrayConstructor::s_info = { "WebGLFloatArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLFloatArrayConstructor::JSWebGLFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLFloatArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
-    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    JSWebGLFloatArrayConstructor* jsConstructor = static_cast<JSWebGLFloatArrayConstructor*>(constructor);
+    RefPtr<WebGLFloatArray> array = static_cast<WebGLFloatArray*>(construct<WebGLFloatArray, float>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasByteArray;
+    constructData.native.function = constructCanvasFloatArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.h b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
index 4d5dc11..faf90ff 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLFloatArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasByteArrayConstructor_h
-#define JSCanvasByteArrayConstructor_h
+#ifndef JSWebGLFloatArrayConstructor_h
+#define JSWebGLFloatArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLFloatArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasByteArrayConstructor_h
+#endif // JSWebGLFloatArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp b/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
new file mode 100644
index 0000000..5f5b24f
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLFloatArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLFloatArray.h"
+
+#include "WebGLFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLFloatArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLFloatArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLFloatArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLFloatArray* array = toWebGLFloatArray(args.at(0));
+    if (array) {
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
index 15e39c2..f2a0922 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLIntArrayConstructor.cpp
@@ -27,38 +27,38 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasFloatArrayConstructor.h"
+#include "JSWebGLIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasFloatArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasFloatArray.h"
+#include "WebGLIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLIntArrayConstructor::s_info = { "WebGLIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLIntArrayConstructor::JSWebGLIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
-static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
-    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    JSWebGLIntArrayConstructor* jsConstructor = static_cast<JSWebGLIntArrayConstructor*>(constructor);
+    RefPtr<WebGLIntArray> array = static_cast<WebGLIntArray*>(construct<WebGLIntArray, int>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
-    constructData.native.function = constructCanvasFloatArray;
+    constructData.native.function = constructCanvasIntArray;
     return ConstructTypeHost;
 }
 
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
index df21825..d42c046 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLIntArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasShortArrayConstructor_h
-#define JSCanvasShortArrayConstructor_h
+#ifndef JSWebGLIntArrayConstructor_h
+#define JSWebGLIntArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    class JSWebGLIntArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasShortArrayConstructor_h
+#endif // JSWebGLIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp b/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
new file mode 100644
index 0000000..9c384d8
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLIntArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLIntArray.h"
+
+#include "WebGLIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLIntArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLIntArray* array = toWebGLIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..3de9606
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -0,0 +1,708 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLRenderingContext.h"
+
+#include "WebGLRenderingContext.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebGLBuffer.h"
+#include "JSWebGLFloatArray.h"
+#include "JSWebGLFramebuffer.h"
+#include "JSWebGLIntArray.h"
+#include "JSWebGLProgram.h"
+#include "JSWebGLRenderbuffer.h"
+#include "JSWebGLShader.h"
+#include "JSWebGLTexture.h"
+#include "JSWebGLUniformLocation.h"
+#include "JSWebGLUnsignedByteArray.h"
+#include "JSWebKitCSSMatrix.h"
+#include "NotImplemented.h"
+#include "WebGLBuffer.h"
+#include "WebGLGetInfo.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebGLRenderingContext::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+    ExceptionCode ec = 0;
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, count, usage, ec);
+    } else {
+        WebGLArray* array = toWebGLArray(args.at(1));
+        static_cast<WebGLRenderingContext*>(impl())->bufferData(target, array, usage, ec);
+    }
+
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSWebGLRenderingContext::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    ExceptionCode ec = 0;
+    
+    WebGLArray* array = toWebGLArray(args.at(2));
+    
+    static_cast<WebGLRenderingContext*>(impl())->bufferSubData(target, offset, array, ec);
+
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return jsNumber(exec, info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return jsNumber(exec, info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return jsNull();
+    case WebGLGetInfo::kTypeString:
+        return jsString(exec, info.getString());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return jsNumber(exec, info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return toJS(exec, globalObject, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return toJS(exec, globalObject, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return toJS(exec, globalObject, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return toJS(exec, globalObject, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return toJS(exec, globalObject, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return toJS(exec, globalObject, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return toJS(exec, globalObject, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return toJS(exec, globalObject, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return jsUndefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static JSValue getObjectParameter(JSWebGLRenderingContext* obj, ExecState* exec, const ArgList& args, ObjectType objectType)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(obj->impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, obj->globalObject(), info);
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kBuffer);
+}
+
+JSValue JSWebGLRenderingContext::getFramebufferAttachmentParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned attachment = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    unsigned pname = args.at(2).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    unsigned pname = args.at(0).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getProgramParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getRenderbufferParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kRenderbuffer);
+}
+
+JSValue JSWebGLRenderingContext::getShaderParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLShader* shader = toWebGLShader(args.at(0));
+    unsigned pname = args.at(1).toInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getTexParameter(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kTexture);
+}
+
+JSValue JSWebGLRenderingContext::getUniform(ExecState* exec, const ArgList& args)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(args.at(0));
+    WebGLUniformLocation* loc = toWebGLUniformLocation(args.at(1));
+    if (exec->hadException())
+        return jsUndefined();
+    WebGLGetInfo info = context->getUniform(program, loc, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, globalObject(), info);
+}
+
+JSValue JSWebGLRenderingContext::getVertexAttrib(ExecState* exec, const ArgList& args)
+{
+    return getObjectParameter(this, exec, args, kVertexAttrib);
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSWebGLRenderingContext::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        WebGLArray* array = toWebGLArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure WebGLArray is a WebGLByteArray or WebGLShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSWebGLRenderingContext::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else
+        ec = TYPE_MISMATCH_ERR;
+    
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static bool functionForUniform(DataFunctionToCall f)
+{
+    switch (f) {
+    case f_uniform1v:
+    case f_uniform2v:
+    case f_uniform3v:
+    case f_uniform4v:
+        return true;
+        break;
+    default: break;
+    }
+    return false;
+}
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+    
+    WebGLUniformLocation* location = 0;
+    long index = -1;
+    
+    if (functionForUniform(f))
+        location = toWebGLUniformLocation(args.at(0));
+    else
+        index = args.at(0).toInt32(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, webGLArray.get(), ec); break;
+            case f_uniform2v: context->uniform2fv(location, webGLArray.get(), ec); break;
+            case f_uniform3v: context->uniform3fv(location, webGLArray.get(), ec); break;
+            case f_uniform4v: context->uniform4fv(location, webGLArray.get(), ec); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(index, webGLArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(index, webGLArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(index, webGLArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(index, webGLArray.get()); break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size, ec); break;
+        case f_uniform2v: context->uniform2fv(location, array, size, ec); break;
+        case f_uniform3v: context->uniform3fv(location, array, size, ec); break;
+        case f_uniform4v: context->uniform4fv(location, array, size, ec); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(index, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(index, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(index, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(index, array, size); break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+  
+    if (exec->hadException())
+        return jsUndefined();
+        
+    RefPtr<WebGLIntArray> webGLArray = toWebGLIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, webGLArray.get(), ec); break;
+            case f_uniform2v: context->uniform2iv(location, webGLArray.get(), ec); break;
+            case f_uniform3v: context->uniform3iv(location, webGLArray.get(), ec); break;
+            case f_uniform4v: context->uniform4iv(location, webGLArray.get(), ec); break;
+            default: break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size, ec); break;
+        case f_uniform2v: context->uniform2iv(location, array, size, ec); break;
+        case f_uniform3v: context->uniform3iv(location, array, size, ec); break;
+        case f_uniform4v: context->uniform4iv(location, array, size, ec); break;
+        default: break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, WebGLRenderingContext* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    WebGLUniformLocation* location = toWebGLUniformLocation(args.at(0));
+
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<WebGLFloatArray> webGLArray = toWebGLFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    ExceptionCode ec = 0;
+    if (webGLArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, webGLArray.get(), ec); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, webGLArray.get(), ec); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, webGLArray.get(), ec); break;
+        }
+        if (ec != 0)
+            setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size, ec); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size, ec); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size, ec); break;
+    }
+    if (ec != 0)
+        setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+JSC::JSValue JSWebGLRenderingContext::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<WebGLRenderingContext*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
index a885b7b..74bfe5c 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLShortArrayConstructor.cpp
@@ -27,37 +27,37 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasShortArrayConstructor.h"
+#include "JSWebGLShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasShortArray.h"
-#include "JSCanvasArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasShortArray.h"
+#include "WebGLShortArray.h"
+#include "JSWebGLArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLShortArrayConstructor::s_info = { "WebGLShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLShortArrayConstructor::JSWebGLShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
-    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    JSWebGLShortArrayConstructor* jsConstructor = static_cast<JSWebGLShortArrayConstructor*>(constructor);
+    RefPtr<WebGLShortArray> array = static_cast<WebGLShortArray*>(construct<WebGLShortArray, short>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasShortArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
index efea250..7807a13 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasFloatArrayConstructor_h
-#define JSCanvasFloatArrayConstructor_h
+#ifndef JSWebGLShortArrayConstructor_h
+#define JSWebGLShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    class JSWebGLShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasFloatArrayConstructor_h
+#endif // JSWebGLShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp b/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
new file mode 100644
index 0000000..462b09a
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLShortArrayCustom.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLShortArray.h"
+
+#include "WebGLShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebGLShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLShortArray* object)
+{
+    return getDOMObjectWrapper<JSWebGLShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLShortArray* shortArray = toWebGLShortArray(args.at(0));
+    if (shortArray) {
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(shortArray, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
index 5d0800e..d5597ce 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSWebGLUnsignedByteArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedByteArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedByteArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedByteArrayConstructor::s_info = { "WebGLUnsignedByteArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedByteArrayConstructor::JSWebGLUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedByteArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    JSWebGLUnsignedByteArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedByteArray> array = static_cast<WebGLUnsignedByteArray*>(construct<WebGLUnsignedByteArray, unsigned char>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedByteArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
index 6016159..d90ce96 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedIntArrayConstructor_h
-#define JSCanvasUnsignedIntArrayConstructor_h
+#ifndef JSWebGLUnsignedByteArrayConstructor_h
+#define JSWebGLUnsignedByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedIntArrayConstructor_h
+#endif // JSWebGLUnsignedByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
index f2b0c74..35a545d 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedByteArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedByteArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedByteArray.h"
 
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLUnsignedByteArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedByteArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedByteArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedByteArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedByteArray* array = toWebGLUnsignedByteArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
index 5f145a7..6fafa81 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSWebGLUnsignedIntArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedIntArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedIntArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedIntArrayConstructor::s_info = { "WebGLUnsignedIntArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedIntArrayConstructor::JSWebGLUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedIntArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    JSWebGLUnsignedIntArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedIntArray> array = static_cast<WebGLUnsignedIntArray*>(construct<WebGLUnsignedIntArray, unsigned int>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedIntArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..7eabbc1
--- /dev/null
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebGLUnsignedIntArrayConstructor_h
+#define JSWebGLUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSWebGLUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSWebGLUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSWebGLUnsignedIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
index 95a80a7..ea28111 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedIntArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedIntArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedIntArray.h"
 
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLUnsignedIntArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedIntArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedIntArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedIntArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedIntArray* array = toWebGLUnsignedIntArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
index 9735693..deaeffd 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.cpp
@@ -27,36 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSWebGLUnsignedShortArrayConstructor.h"
 
 #include "Document.h"
-#include "CanvasUnsignedShortArray.h"
-#include "JSCanvasArrayBuffer.h"
-#include "JSCanvasArrayBufferConstructor.h"
-#include "JSCanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
+#include "JSWebGLArrayBuffer.h"
+#include "JSWebGLArrayBufferConstructor.h"
+#include "JSWebGLUnsignedShortArray.h"
 #include <runtime/Error.h>
 
 namespace WebCore {
 
 using namespace JSC;
 
-const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+const ClassInfo JSWebGLUnsignedShortArrayConstructor::s_info = { "WebGLUnsignedShortArrayConstructor", &JSWebGLArray::s_info, 0, 0 };
 
-JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+JSWebGLUnsignedShortArrayConstructor::JSWebGLUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebGLUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
 {
-    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().prototype, JSWebGLUnsignedShortArrayPrototype::self(exec, globalObject), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
 }
 
 static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
-    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
-    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    JSWebGLUnsignedShortArrayConstructor* jsConstructor = static_cast<JSWebGLUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<WebGLUnsignedShortArray> array = static_cast<WebGLUnsignedShortArray*>(construct<WebGLUnsignedShortArray, unsigned short>(exec, args).get());
     return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
 }
 
-JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+JSC::ConstructType JSWebGLUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
 {
     constructData.native.function = constructCanvasUnsignedShortArray;
     return ConstructTypeHost;
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
index 9cfb721..5eba20d 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayConstructor.h
@@ -23,17 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSCanvasUnsignedByteArrayConstructor_h
-#define JSCanvasUnsignedByteArrayConstructor_h
+#ifndef JSWebGLUnsignedShortArrayConstructor_h
+#define JSWebGLUnsignedShortArrayConstructor_h
 
 #include "JSDOMBinding.h"
 #include "JSDocument.h"
 
 namespace WebCore {
 
-    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    class JSWebGLUnsignedShortArrayConstructor : public DOMConstructorObject {
     public:
-        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        JSWebGLUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
     private:
@@ -43,4 +43,4 @@ namespace WebCore {
 
 }
 
-#endif // JSCanvasUnsignedByteArrayConstructor_h
+#endif // JSWebGLUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
index 290cd4b..898cc06 100644
--- a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLUnsignedShortArrayCustom.cpp
@@ -27,22 +27,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasUnsignedShortArray.h"
+#include "JSWebGLArrayHelper.h"
+#include "JSWebGLUnsignedShortArray.h"
 
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLUnsignedShortArray.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void JSWebGLUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, WebGLUnsignedShortArray* object)
 {
-    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+    return getDOMObjectWrapper<JSWebGLUnsignedShortArray>(exec, globalObject, object);
+}
+
+JSC::JSValue JSWebGLUnsignedShortArray::set(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() > 2)
+        return throwError(exec, SyntaxError);
+
+    if (args.size() == 2 && args.at(0).isInt32()) {
+        // void set(in unsigned long index, in long value);
+        unsigned index = args.at(0).toUInt32(exec);
+        impl()->set(index, static_cast<signed char>(args.at(1).toInt32(exec)));
+        return jsUndefined();
+    }
+
+    WebGLUnsignedShortArray* array = toWebGLUnsignedShortArray(args.at(0));
+    if (array) {
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        unsigned offset = 0;
+        if (args.size() == 2)
+            offset = args.at(1).toInt32(exec);
+        ExceptionCode ec = 0;
+        impl()->set(array, offset, ec);
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return setWebGLArrayFromArray(exec, impl(), args);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 33c3fcd..238b041 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,7 +38,6 @@
 #include "KURL.h"
 #include "JSEventListener.h"
 #include "WebSocket.h"
-#include "NotImplemented.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index 741a269..f0c4efa 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -45,7 +45,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
+    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
     , m_impl(impl)
 {
 }
diff --git a/WebCore/bindings/js/ScheduledAction.cpp b/WebCore/bindings/js/ScheduledAction.cpp
index 9a21b6b..3223e53 100644
--- a/WebCore/bindings/js/ScheduledAction.cpp
+++ b/WebCore/bindings/js/ScheduledAction.cpp
@@ -103,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
+    JSC::call(exec, m_function, callType, callData, thisValue, args);
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -126,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
+        frame->script()->executeScriptInWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index e01324e..f2b64de 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -44,19 +44,26 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
+    : m_domWindow(0)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        m_window = windowShell->window();
-        scriptController->attachDebugger(0);
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        JSDOMWindow* window = iter->second->window();
+        m_windows.add(iter->first.get(), window);
+        m_domWindow = window->impl();
     }
+
+    scriptController->attachDebugger(0);
 }
 
-DOMWindow* ScriptCachedFrameData::domWindow() const {
-    return m_window ? m_window->impl() : 0;
+DOMWindow* ScriptCachedFrameData::domWindow() const
+{
+    return m_domWindow;
 }
 
 ScriptCachedFrameData::~ScriptCachedFrameData()
@@ -71,26 +78,33 @@ void ScriptCachedFrameData::restore(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
-    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
-        if (m_window)
-            windowShell->setWindow(m_window.get());
+    ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
+
+    ScriptController::ShellMap::iterator windowShellsEnd = windowShells.end();
+    for (ScriptController::ShellMap::iterator iter = windowShells.begin(); iter != windowShellsEnd; ++iter) {
+        DOMWrapperWorld* world = iter->first.get();
+        JSDOMWindowShell* windowShell = iter->second.get();
+
+        if (JSDOMWindow* window = m_windows.get(world))
+            windowShell->setWindow(window);
         else {
             windowShell->setWindow(frame->domWindow());
-            scriptController->attachDebugger(page->debugger());
-            windowShell->window()->setProfileGroup(page->group().identifier());
+            if (world == debuggerWorld()) {
+                scriptController->attachDebugger(page->debugger());
+                windowShell->window()->setProfileGroup(page->group().identifier());
+            }
         }
     }
 }
 
 void ScriptCachedFrameData::clear()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    if (m_windows.isEmpty())
+        return;
 
-    if (m_window) {
-        m_window = 0;
-        gcController().garbageCollectSoon();
-    }
+    JSLock lock(SilenceAssertionsOnly);
+    m_windows.clear();
+    gcController().garbageCollectSoon();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.h b/WebCore/bindings/js/ScriptCachedFrameData.h
index c661f28..5bcaed7 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.h
+++ b/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -38,8 +38,11 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class DOMWindow;
+    class DOMWrapperWorld;
 
     class ScriptCachedFrameData  {
+        typedef HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindow> > JSDOMWindowSet;
+
     public:
         ScriptCachedFrameData(Frame*);
         ~ScriptCachedFrameData();
@@ -49,7 +52,8 @@ namespace WebCore {
         DOMWindow* domWindow() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMWindow> m_window;
+        JSDOMWindowSet m_windows;
+        DOMWindow* m_domWindow;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCallStack.cpp b/WebCore/bindings/js/ScriptCallStack.cpp
index 021ede5..824a07b 100644
--- a/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/WebCore/bindings/js/ScriptCallStack.cpp
@@ -57,7 +57,7 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
@@ -94,7 +94,7 @@ void ScriptCallStack::initialize()
     while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(m_exec), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index b0696ba..3de3b23 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -25,8 +25,10 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
+#include "InspectorTimelineAgent.h"
 #include "JSDocument.h"
 #include "NP_jsobject.h"
 #include "Page.h"
@@ -43,6 +45,7 @@
 #include <runtime/JSLock.h>
 
 using namespace JSC;
+using namespace std;
 
 namespace WebCore {
 
@@ -79,9 +82,6 @@ ScriptController::ScriptController(Frame* frame)
 ScriptController::~ScriptController()
 {
     if (!m_windowShells.isEmpty()) {
-        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-            iter->first->forgetScriptController(this);
-
         m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
@@ -117,10 +117,20 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
+#endif
+
     exec->globalData().timeoutChecker.start();
-    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+#endif
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
@@ -156,42 +166,14 @@ public:
     static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
 };
 
-static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
-{
-    if (!worldID)
-        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-
-    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
-    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
-
-    WorldMap::iterator iter = isolatedWorlds.find(worldID);
-    if (iter != isolatedWorlds.end())
-        return iter->second;
-
-    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
-    isolatedWorlds.add(worldID, newWorld);
-    return newWorld;
-}
-
-JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+PassRefPtr<DOMWrapperWorld> ScriptController::createWorld()
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return windowShell(world.get())->window();
+    return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
 }
 
-ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
 {
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-    return evaluateInWorld(sourceCode, world.get());
-}
-
-void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
-{
-    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
-
-    unsigned size = sourceCode.size();
-    for (unsigned i = 0; i < size; ++i)
-        evaluateInWorld(sourceCode[i], world.get());
+    static_cast<WebCoreJSClientData*>(JSDOMWindow::commonJSGlobalData()->clientData)->getAllWorlds(worlds);
 }
 
 void ScriptController::clearWindowShell()
@@ -206,7 +188,7 @@ void ScriptController::clearWindowShell()
     attachDebugger(0);
 
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
-        DOMWrapperWorld* world = iter->first;
+        DOMWrapperWorld* world = iter->first.get();
         JSDOMWindowShell* windowShell = iter->second;
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
@@ -228,10 +210,9 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 
     JSLock lock(SilenceAssertionsOnly);
 
-    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow(), world);
     m_windowShells.add(world, windowShell);
-    world->rememberScriptController(this);
-    windowShell->window()->updateDocument(world);
+    windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         if (world == debuggerWorld())
@@ -239,10 +220,7 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
         windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    {
-        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
-        m_frame->loader()->dispatchWindowObjectAvailable();
-    }
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(world);
 
     return windowShell;
 }
@@ -264,9 +242,10 @@ bool ScriptController::processingUserGestureEvent() const
 
         const AtomicString& type = event->type();
         if ( // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
-            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
+            type == eventNames().clickEvent || type == eventNames().mousedownEvent 
+            || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent 
             // keyboard events
+<<<<<<< HEAD:WebCore/bindings/js/ScriptController.cpp
             type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
             type == eventNames().keyupEvent ||
 #if ENABLE(TOUCH_EVENTS) // Android
@@ -274,10 +253,14 @@ bool ScriptController::processingUserGestureEvent() const
             type == eventNames().touchstartEvent || type == eventNames().touchmoveEvent ||
             type == eventNames().touchendEvent || type == eventNames().touchcancelEvent ||
 #endif
+=======
+            || type == eventNames().keydownEvent || type == eventNames().keypressEvent
+            || type == eventNames().keyupEvent
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptController.cpp
             // other accepted events
-            type == eventNames().selectEvent || type == eventNames().changeEvent ||
-            type == eventNames().focusEvent || type == eventNames().blurEvent ||
-            type == eventNames().submitEvent)
+            || type == eventNames().selectEvent || type == eventNames().changeEvent
+            || type == eventNames().focusEvent || type == eventNames().blurEvent
+            || type == eventNames().submitEvent)
             return true;
     }
     
@@ -316,7 +299,7 @@ bool ScriptController::anyPageIsProcessingUserGesture() const
 bool ScriptController::isEnabled()
 {
     Settings* settings = m_frame->settings();
-    return (settings && settings->isJavaScriptEnabled());
+    return m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled() && !m_frame->loader()->isSandboxed(SandboxScripts));
 }
 
 void ScriptController::attachDebugger(JSC::Debugger* debugger)
@@ -340,7 +323,7 @@ void ScriptController::updateDocument()
 
     JSLock lock(SilenceAssertionsOnly);
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
-        iter->second->window()->updateDocument(iter->first);
+        iter->second->window()->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -473,27 +456,7 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
-ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
-{
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
-
-    if (!isEnabled() || isPaused())
-        return ScriptValue();
-
-    bool wasInExecuteScript = m_inExecuteScript;
-    m_inExecuteScript = true;
-
-    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
-
-    if (!wasInExecuteScript) {
-        m_inExecuteScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
-
-ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
 {
     ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
 
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index f2a497d..8801622 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -63,12 +63,15 @@ class XSSAuditor;
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
 class ScriptController {
-    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+    friend class ScriptCachedFrameData;
+    typedef WTF::HashMap< RefPtr<DOMWrapperWorld>, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
 
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
+    static PassRefPtr<DOMWrapperWorld> createWorld();
+
     JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
     {
         ShellMap::iterator iter = m_windowShells.find(world);
@@ -83,17 +86,12 @@ public:
     {
         return windowShell(world)->window();
     }
-    JSDOMWindow* globalObject(unsigned worldID);
 
-    void forgetWorld(DOMWrapperWorld* world)
-    {
-        m_windowShells.remove(world);
-    }
+    static void getAllWorlds(Vector<DOMWrapperWorld*>&);
 
     ScriptValue executeScript(const ScriptSourceCode&);
     ScriptValue executeScript(const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
-    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
@@ -104,8 +102,6 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
     ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
-    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/WebCore/bindings/js/ScriptFunctionCall.cpp b/WebCore/bindings/js/ScriptFunctionCall.cpp
index 91b2a57..e38acb9 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -72,6 +72,13 @@ void ScriptFunctionCall::appendArgument(const String& argument)
 
 void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
 {
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
     m_arguments.append(jsString(m_exec, argument));
 }
 
@@ -80,6 +87,12 @@ void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
     m_arguments.append(argument);
 }
 
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -92,6 +105,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(jsNumber(m_exec, argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -123,8 +142,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    // FIXME: Should this function take a worldID? - only used by inspector?
-    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -162,8 +180,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
-    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/WebCore/bindings/js/ScriptFunctionCall.h b/WebCore/bindings/js/ScriptFunctionCall.h
index 079ac21..7c5074f 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/WebCore/bindings/js/ScriptFunctionCall.h
@@ -55,10 +55,13 @@ namespace WebCore {
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
         void appendArgument(const JSC::UString&);
         void appendArgument(JSC::JSValue);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
@@ -70,6 +73,12 @@ namespace WebCore {
         ScriptObject m_thisObject;
         String m_name;
         JSC::MarkedArgumentBuffer m_arguments;
+
+    private:
+        // MarkedArgumentBuffer must be stack allocated, so prevent heap
+        // alloc of ScriptFunctionCall as well.
+        void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+        void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index f14145e..0e62903 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -36,7 +36,15 @@
 #include <runtime/JSLock.h>
 
 #if ENABLE(INSPECTOR)
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
+=======
+#include "JSInjectedScriptHost.h"
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptObject.cpp
 #include "JSInspectorBackend.h"
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
+=======
+#include "JSInspectorFrontendHost.h"
+>>>>>>> webkit.org at r51976:WebCore/bindings/js/ScriptObject.cpp
 #endif
 
 using namespace JSC;
@@ -90,6 +98,14 @@ bool ScriptObject::set(const char* name, double value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -114,6 +130,14 @@ bool ScriptObject::set(const char* name, unsigned value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -143,6 +167,22 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
+    return handleException(scriptState);
+}
 #endif // ENABLE(INSPECTOR)
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 31381f3..fed7339 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -38,7 +38,9 @@
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
 
     class ScriptObject : public ScriptValue {
     public:
@@ -50,9 +52,11 @@ namespace WebCore {
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -66,6 +70,8 @@ namespace WebCore {
         static bool set(ScriptState*, const char* name, const ScriptObject&);
 #if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
 #endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 313530f..0000000
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Document.h"
-#include "Frame.h"
-#include "JSDOMBinding.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSNode.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include <runtime/JSLock.h>
-
-#if ENABLE(DATABASE)
-#include "Database.h"
-#include "JSDatabase.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "JSStorage.h"
-#endif
-
-using namespace JSC;
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
-}
-
-#if ENABLE(DATABASE)
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, database))));
-
-    return true;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
-    ExecState* exec = globalObject->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, globalObject, storage))));
-
-    return true;
-}
-#endif
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ExecState* exec = scriptStateFromNode(node);
-    if (!exec)
-        return false;
-
-    JSLock lock(SilenceAssertionsOnly);
-    // FIXME: Should use some sort of globalObjectFromNode()
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, deprecatedGlobalObjectForPrototype(exec), node))));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
-    ExecState* exec = window->globalExec();
-
-    JSLock lock(SilenceAssertionsOnly);
-    quarantinedObject = ScriptObject(exec, asObject(JSInspectedObjectWrapper::wrap(exec, window)));
-
-    return true;
-}
-
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/ScriptState.cpp b/WebCore/bindings/js/ScriptState.cpp
index 60ba2a0..b9f78ef 100644
--- a/WebCore/bindings/js/ScriptState.cpp
+++ b/WebCore/bindings/js/ScriptState.cpp
@@ -38,7 +38,7 @@
 
 namespace WebCore {
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* scriptStateFromNode(DOMWrapperWorld* world, Node* node)
 {
     if (!node)
         return 0;
@@ -50,12 +50,12 @@ ScriptState* scriptStateFromNode(Node* node)
         return 0;
     if (!frame->script()->isEnabled())
         return 0;
-    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return frame->script()->globalObject(world)->globalExec();
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld* world, Page* page)
 {
-    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
+    return page->mainFrame()->script()->globalObject(world)->globalExec();
 }
 
 }
diff --git a/WebCore/bindings/js/ScriptState.h b/WebCore/bindings/js/ScriptState.h
index 279234e..6257929 100644
--- a/WebCore/bindings/js/ScriptState.h
+++ b/WebCore/bindings/js/ScriptState.h
@@ -45,8 +45,8 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index 6eac102..5444e0e 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -32,6 +32,8 @@
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSValueRef.h>
 
+#include "JSInspectedObjectWrapper.h"
+
 #include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -40,13 +42,21 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool ScriptValue::getString(String& result) const
+#if ENABLE(INSPECTOR)
+ScriptValue ScriptValue::quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
+}
+#endif
+
+bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
     JSLock lock(SilenceAssertionsOnly);
     UString ustring;
-    if (!m_value.get().getString(ustring))
+    if (!m_value.get().getString(scriptState, ustring))
         return false;
     result = ustring;
     return true;
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index 19bb693..e11fa55 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -41,11 +41,13 @@ class String;
 
 class ScriptValue {
 public:
+    static ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value);
+
     ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
     virtual ~ScriptValue() {}
 
     JSC::JSValue jsValue() const { return m_value.get(); }
-    bool getString(String& result) const;
+    bool getString(ScriptState*, String& result) const;
     String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
index 48cd92d..7c4ad62 100644
--- a/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -27,6 +27,11 @@
 #include "config.h"
 #include "SerializedScriptValue.h"
 
+#include "File.h"
+#include "JSDOMGlobalObject.h"
+#include "JSFile.h"
+#include "JSFileList.h"
+#include <JavaScriptCore/APICast.h>
 #include <runtime/DateInstance.h>
 #include <runtime/ExceptionHelpers.h>
 #include <runtime/PropertyNameArray.h>
@@ -148,6 +153,12 @@ SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> dat
 {
 }
 
+SerializedScriptValueData::SerializedScriptValueData(const File* file)
+    : m_type(FileType)
+    , m_string(file->path().crossThreadString())
+{
+}
+
 SerializedArray* SharedSerializedData::asArray()
 {
     return static_cast<SerializedArray*>(this);
@@ -470,7 +481,7 @@ struct SerializingTreeWalker : public BaseWalker {
             return SerializedScriptValueData(value);
 
         if (value.isString())
-            return SerializedScriptValueData(asString(value)->value());
+            return SerializedScriptValueData(asString(value)->value(m_exec));
 
         if (value.isNumber())
             return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
@@ -481,10 +492,15 @@ struct SerializingTreeWalker : public BaseWalker {
         if (isArray(value))
             return SerializedScriptValueData();
 
-        CallData unusedData;
-        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
-            return SerializedScriptValueData();
-
+        if (value.isObject()) {
+            JSObject* obj = asObject(value);
+            if (obj->inherits(&JSFile::s_info))
+                return SerializedScriptValueData(toFile(obj));
+                
+            CallData unusedData;
+            if (value.getCallData(unusedData) == CallTypeNone)
+                return SerializedScriptValueData();
+        }
         // Any other types are expected to serialize as null.
         return SerializedScriptValueData(jsNull());
     }
@@ -640,6 +656,8 @@ struct DeserializingTreeWalker : public BaseWalker {
                 return jsNumber(m_exec, value.asDouble());
             case SerializedScriptValueData::DateType:
                 return new (m_exec) DateInstance(m_exec, value.asDouble());
+            case SerializedScriptValueData::FileType:
+                return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), File::create(value.asString().crossThreadString()));
             default:
                 ASSERT_NOT_REACHED();
                 return JSValue();
@@ -836,4 +854,36 @@ void SerializedScriptValueData::tearDownSerializedData()
     walk<TeardownTreeWalker>(context, *this);
 }
 
+SerializedScriptValue::~SerializedScriptValue()
+{
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, JSValueRef* exception)
+{
+    ExecState* exec = toJS(originContext);
+    JSValue value = toJS(exec, apiValue);
+    PassRefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    
+    return serializedValue;
+}
+
+JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
+{
+    ExecState* exec = toJS(destinationContext);
+    JSValue value = deserialize(exec);
+    if (exec->hadException()) {
+        if (exception)
+            *exception = toRef(exec, exec->exception());
+        exec->clearException();
+        return 0;
+    }
+    return toRef(exec, value);
+}
+
 }
diff --git a/WebCore/bindings/js/SerializedScriptValue.h b/WebCore/bindings/js/SerializedScriptValue.h
index f8a126f..57a4a66 100644
--- a/WebCore/bindings/js/SerializedScriptValue.h
+++ b/WebCore/bindings/js/SerializedScriptValue.h
@@ -29,7 +29,11 @@
 
 #include "ScriptValue.h"
 
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+
 namespace WebCore {
+    class File;
     class SerializedObject;
     class SerializedArray;
 
@@ -51,7 +55,8 @@ namespace WebCore {
             ImmediateType,
             ObjectType,
             ArrayType,
-            StringType
+            StringType,
+            FileType
         };
 
         SerializedType type() const { return m_type; }
@@ -74,6 +79,8 @@ namespace WebCore {
             , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
         {
         }
+        
+        explicit SerializedScriptValueData(const File*);
 
         explicit SerializedScriptValueData(JSC::JSValue value)
             : m_type(ImmediateType)
@@ -105,7 +112,7 @@ namespace WebCore {
 
         String asString() const
         {
-            ASSERT(m_type == StringType);
+            ASSERT(m_type == StringType || m_type == FileType);
             return m_string;
         }
 
@@ -150,6 +157,8 @@ namespace WebCore {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
         }
 
+        static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
+
         static PassRefPtr<SerializedScriptValue> create(String string)
         {
             return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
@@ -182,7 +191,8 @@ namespace WebCore {
             return m_value.deserialize(exec, m_mustCopy);
         }
 
-        ~SerializedScriptValue() {}
+        JSValueRef deserialize(JSContextRef, JSValueRef* exception);
+        ~SerializedScriptValue();
 
     private:
         SerializedScriptValue(SerializedScriptValueData value)
diff --git a/WebCore/bindings/js/WorkerScriptController.cpp b/WebCore/bindings/js/WorkerScriptController.cpp
index b66b0e8..5e27ef7 100644
--- a/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/WebCore/bindings/js/WorkerScriptController.cpp
@@ -123,7 +123,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/WebCore/bindings/objc/DOMHTML.mm b/WebCore/bindings/objc/DOMHTML.mm
index 1043d8e..3488b35 100644
--- a/WebCore/bindings/objc/DOMHTML.mm
+++ b/WebCore/bindings/objc/DOMHTML.mm
@@ -140,7 +140,12 @@
         return NSMakeRange(start, end - start); 
     }
     return NSMakeRange(NSNotFound, 0);
-}    
+}
+
+- (BOOL)_isAutofilled
+{
+    return core(self)->isAutofilled();
+}
 
 - (void)_setAutofilled:(BOOL)filled
 {
@@ -156,8 +161,9 @@
 
 - (void)_activateItemAtIndex:(int)index
 {
+    // Use the setSelectedIndexByUser function so a change event will be fired. <rdar://problem/6760590>
     if (WebCore::HTMLSelectElement* select = core(self))
-        select->setSelectedIndex(index);
+        select->setSelectedIndexByUser(index, true, true);
 }
 
 @end
@@ -167,7 +173,7 @@
 - (BOOL)_isEdited
 {
     WebCore::RenderObject *renderer = core(self)->renderer();
-    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->isUserEdited();
+    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->lastChangeWasUserEdit();
 }
 
 @end
@@ -177,7 +183,7 @@
 - (BOOL)_isEdited
 {
     WebCore::RenderObject* renderer = core(self)->renderer();
-    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->isUserEdited();
+    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->lastChangeWasUserEdit();
 }
 
 @end
diff --git a/WebCore/bindings/objc/DOMPrivate.h b/WebCore/bindings/objc/DOMPrivate.h
index 4291cbc..b8e4460 100644
--- a/WebCore/bindings/objc/DOMPrivate.h
+++ b/WebCore/bindings/objc/DOMPrivate.h
@@ -67,10 +67,10 @@
 @end
 
 // All the methods in this category are used by Safari forms autofill and should not be used for any other purpose.
-// They are stopgap measures until we finish transitioning form controls to not use NSView. Each one should become
-// replaceable by public DOM API, and when that happens Safari will switch to implementations using that public API,
-// and these will be deleted.
+// Each one should eventually be replaced by public DOM API, and when that happens Safari will switch to implementations 
+// using that public API, and these will be deleted.
 @interface DOMHTMLInputElement (FormsAutoFillTransition)
+- (BOOL)_isAutofilled;
 - (BOOL)_isTextField;
 - (NSRect)_rectOnScreen; // bounding box of the text field, in screen coordinates
 - (void)_replaceCharactersInRange:(NSRange)targetRange withString:(NSString *)replacementString selectingFromIndex:(int)index;
diff --git a/WebCore/bindings/objc/WebScriptObject.mm b/WebCore/bindings/objc/WebScriptObject.mm
index 6d86001..1622a3c 100644
--- a/WebCore/bindings/objc/WebScriptObject.mm
+++ b/WebCore/bindings/objc/WebScriptObject.mm
@@ -299,7 +299,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         return nil;
 
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = callInWorld(exec, function, callType, callData, [self _imp], argList, pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, [self _imp], argList);
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
@@ -328,7 +328,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     JSLock lock(SilenceAssertionsOnly);
     
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = evaluateInWorld([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue(), pluginWorld());
+    Completion completion = JSC::evaluate([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue());
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
@@ -529,7 +529,8 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     }
 
     if (value.isString()) {
-        const UString& u = asString(value)->value();
+        ExecState* exec = rootObject->globalObject()->globalExec();
+        const UString& u = asString(value)->value(exec);
         return [NSString stringWithCharacters:u.data() length:u.size()];
     }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4ca441b..e98379b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -16,7 +16,7 @@
 # Library General Public License for more details.
 #
 # You should have received a copy of the GNU Library General Public License
-# aint with this library; see the file COPYING.LIB.  If not, write to
+# along with this library; see the file COPYING.LIB.  If not, write to
 # the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
 # Boston, MA 02111-1307, USA.
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index d8367ac..6ccf739 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -316,7 +316,14 @@ sub GenerateGetOwnPropertySlotBody
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
-        push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+
+        # If the item function returns a string then we let the ConvertNullStringTo handle the cases
+        # where the index is out of range.
+        if (IndexGetterReturnsStrings($implClassName)) {
+            push(@getOwnPropertySlotImpl, "    if (ok) {\n");
+        } else {
+            push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        }
         if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
@@ -368,6 +375,14 @@ sub GenerateGetOwnPropertyDescriptorBody
     my $namespaceMaybe = ($inlined ? "JSC::" : "");
     
     my @getOwnPropertyDescriptorImpl = ();
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+        if ($interfaceName eq "DOMWindow") {
+            push(@implContent, "    if (!static_cast<$className*>(thisObject)->allowsAccessFrom(exec))\n");
+        } else {
+            push(@implContent, "    if (!allowsAccessFromFrame(exec, static_cast<$className*>(thisObject)->impl()->frame()))\n");
+        }
+        push(@implContent, "        return false;\n");
+    }
     
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
@@ -643,9 +658,6 @@ sub GenerateHeader
         $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
     }
 
-    # Custom getPropertyAttributes function
-    push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
-
     # Custom defineGetter function
     push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 2e0f9ee..77e9512 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -7,8 +7,6 @@
 # Copyright (C) 2007, 2008, 2009 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
-# This file is part of the KDE project
-#
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
@@ -352,15 +350,16 @@ sub HolderToNative
     my $dataNode = shift;
     my $implClassName = shift;
     my $classIndex = shift;
+    my $holder = shift || "holder";   # optional param
 
     if (IsNodeSubType($dataNode)) {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertDOMWrapperToNode<$implClassName>(holder);
+    $implClassName* imp = v8DOMWrapperToNode<$implClassName>($holder);
 END
 
     } else {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8DOMWrapper::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
+    $implClassName* imp = v8DOMWrapperTo<$implClassName>(V8ClassIndex::$classIndex, $holder);
 END
 
   }
@@ -399,7 +398,7 @@ sub GenerateDomainSafeFunctionGetter
     }
 END
 
-  HolderToNative($dataNode, $implClassName, $classIndex);
+    HolderToNative($dataNode, $implClassName, $classIndex);
 
     push(@implContentDecls, <<END);
     if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
@@ -430,7 +429,7 @@ END
 
     if ($classIndex eq "DOMWINDOW") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    DOMWindow* window = v8DOMWrapperTo<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     // Get the proxy corresponding to the DOMWindow if possible to
     // make sure that the constructor function is constructed in the
     // context of the DOMWindow and not in the context of the caller.
@@ -439,11 +438,11 @@ END
     } elsif ($classIndex eq "DEDICATEDWORKERCONTEXT" or $classIndex eq "WORKERCONTEXT" or $classIndex eq "SHAREDWORKERCONTEXT") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         push(@implContentDecls, <<END);
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
+    WorkerContext* workerContext = v8DOMWrapperTo<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
     return V8DOMWrapper::getConstructor(type, workerContext);
 END
     } else {
-        push(@implContentDecls, "    return v8::Undefined();");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();");
     }
 
     push(@implContentDecls, <<END);
@@ -469,7 +468,7 @@ sub GenerateNormalAttrGetter
     my $attrType = GetTypeFromSignature($attribute->signature);
     my $attrIsPodType = IsPodType($attrType);
 
-    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, -1);
     my $isPodType = IsPodType($implClassName);
     my $skipContext = 0;
 
@@ -506,7 +505,7 @@ END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -524,22 +523,34 @@ END
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return v8::Handle<v8::Value>();
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     } else {
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        if ($getterStringUsesImp && $reflect && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute getter:
+            my $contentAttributeName = $reflect eq "1" ? $attrName : $reflect;
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    return getElementStringAttr(info, ${namespace}::${contentAttributeName}Attr);\n");
+            push(@implContentDecls, "  }\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+        
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     }
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Handle<v8::Value>();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Handle<v8::Value>();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -553,7 +564,12 @@ END
     }
 
     my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
-    $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
+
+    if ($codeGenerator->IsSVGAnimatedType($attribute->signature->type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name; rewrite as '_operator' to avoid clashes with C/C++
+        $getterFunc = "_" . $getterFunc if ($attrName =~ /operator/);
+        $getterFunc .= "Animated";
+    }
 
     my $returnType = GetTypeFromSignature($attribute->signature);
 
@@ -579,10 +595,6 @@ END
         $getterString = "imp_instance";
     }
 
-    if ($nativeType eq "String") {
-        $getterString = "toString($getterString)";
-    }
-
     my $result;
     my $wrapper;
 
@@ -619,7 +631,7 @@ END
     } else {
         if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
             push(@implContentDecls, "    if (!imp->document())\n");
-            push(@implContentDecls, "      return v8::Undefined();\n");
+            push(@implContentDecls, "      return v8::Handle<v8::Value>();\n");
         }
 
         if ($useExceptions) {
@@ -635,12 +647,12 @@ END
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
-        my $resultObject = $result;
         if ($attrIsPodType) {
-            $resultObject = "wrapper";
+            push(@implContentDecls, GenerateSVGContextAssignment($implClassName, "wrapper.get()", "    "));
+        } else {
+            push(@implContentDecls, GenerateSVGContextRetrieval($implClassName, "    "));
+            $result = "V8Proxy::withSVGContext($result, context)";
         }
-        $resultObject = "WTF::getPtr(" . $resultObject . ")";
-        push(@implContentDecls, GenerateSVGContextAssignment($implClassName, $resultObject, "    "));
     }
 
     if ($attrIsPodType) {
@@ -696,7 +708,7 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
@@ -712,12 +724,26 @@ END
     if (holder.IsEmpty()) return;
 END
       }
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     } else {
+        my $attrType = GetTypeFromSignature($attribute->signature);
+        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+        if (($reflect || $reflectURL) && IsNodeSubType($dataNode) && $codeGenerator->IsStringType($attrType)) {
+            # Generate super-compact call for regular attribute setter:
+            my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    setElementStringAttr(info, ${namespace}::${contentAttributeName}Attr, value);\n");
+            push(@implContentDecls, "  }\n\n");
+            return;
+            # Skip the rest of the function!
+        }
+
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = info.Holder();
 END
-        HolderToNative($dataNode, $implClassName, $classIndex);
+        HolderToNative($dataNode, $implClassName, $classIndex, "info");
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
@@ -726,7 +752,6 @@ END
             push(@implContentDecls, "    if (!imp->document())\n");
             push(@implContentDecls, "      return;\n");
         }
-        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
     } else {
         push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
     }
@@ -766,18 +791,10 @@ END
             $implIncludes{"V8AbstractEventListener.h"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
             $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
-            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
-            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
-            push(@implContentDecls, "    if (oldListener) {\n");
-            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
-            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
-            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
-            push(@implContentDecls, "    }\n");
-            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
-            push(@implContentDecls, "    if ($result)\n");
-            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
+            push(@implContentDecls, "    transferHiddenDependency(holder, imp->$attrName(), value, $cacheIndex);\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName(V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate)");
         } else {
-            push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result");
         }
         push(@implContentDecls, ", ec") if $useExceptions;
         push(@implContentDecls, ");\n");
@@ -807,12 +824,11 @@ END
     push(@implContentDecls, "  }\n\n");  # end of setter
 }
 
-sub GenerateNewFunctionTemplate
+sub GetFunctionTemplateCallbackName
 {
     $function = shift;
     $dataNode = shift;
-    $signature = shift;
-
+    
     my $interfaceName = $dataNode->name;
     my $name = $function->signature->name;
 
@@ -827,12 +843,22 @@ sub GenerateNewFunctionTemplate
         if ($customFunc eq 1) {
             $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
         }
-        return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "V8Custom::v8${customFunc}Callback";
     } else {
-        return "v8::FunctionTemplate::New(${interfaceName}Internal::${name}Callback, v8::Handle<v8::Value>(), $signature)";
+        return "${interfaceName}Internal::${name}Callback";
     }
 }
 
+sub GenerateNewFunctionTemplate
+{
+    $function = shift;
+    $dataNode = shift;
+    $signature = shift;
+
+    my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+    return "v8::FunctionTemplate::New($callback, v8::Handle<v8::Value>(), $signature)";
+}
+
 sub GenerateFunctionCallback
 {
     my $function = shift;
@@ -851,12 +877,12 @@ sub GenerateFunctionCallback
 
     if ($function->signature->extendedAttributes->{"RequiresAllArguments"}) {
         push(@implContentDecls,
-            "    if (args.Length() < $numParameters) return v8::Undefined();\n");
+            "    if (args.Length() < $numParameters) return v8::Handle<v8::Value>();\n");
     }
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = v8DOMWrapperTo<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
@@ -873,24 +899,39 @@ END
     # We have not find real use cases yet.
     push(@implContentDecls,
 "    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
-"      return v8::Undefined();\n" .
+"      return v8::Handle<v8::Value>();\n" .
 "    }\n");
     }
+    
+    my $raisesExceptions = @{$function->raisesExceptions};
+    if (!$raisesExceptions) {
+        foreach my $parameter (@{$function->parameters}) {
+            if (TypeCanFailConversion($parameter) or $parameter->extendedAttributes->{"IsIndex"}) {
+                $raisesExceptions = 1;
+            }
+        }
+    }
 
-
-    if (@{$function->raisesExceptions}) {
+    if ($raisesExceptions) {
         $implIncludes{"ExceptionCode.h"} = 1;
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+        push(@implContentDecls, "    {\n");
+        # The brace here is needed to prevent the ensuing 'goto fail's from jumping past constructors
+        # of objects (like Strings) declared later, causing compile errors. The block scope ends
+        # right before the label 'fail:'.
     }
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-        push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
+        push(@implContentDecls,
+"    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, $numParameters));\n".
+"    if (!callStack)\n".
+"        return v8::Undefined();\n");
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
     if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
         push(@implContentDecls,
 "    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
-"      return v8::Undefined();\n");
+"      return v8::Handle<v8::Value>();\n");
     }
 
     my $paramIndex = 0;
@@ -911,7 +952,7 @@ END
             push(@implContentDecls, "    bool ${parameterName}Ok;\n");
         }
 
-        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, 1) . " $parameterName = ");
+        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, $paramIndex) . " $parameterName = ");
         push(@implContentDecls, JSValueToNative($parameter, "args[$paramIndex]",
            BasicTypeCanFailConversion($parameter) ?  "${parameterName}Ok" : undef) . ";\n");
 
@@ -919,8 +960,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
-"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"      ec = TYPE_MISMATCH_ERR;\n" .
+"      goto fail;\n" .
 "    }\n");
         }
 
@@ -928,8 +969,8 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (UNLIKELY($parameterName < 0)) {\n" .
-"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
-"      return v8::Handle<v8::Value>();\n" .
+"      ec = INDEX_SIZE_ERR;\n" .
+"      goto fail;\n" .
 "    }\n");
         }
 
@@ -939,6 +980,14 @@ END
     # Build the function call string.
     my $callString = GenerateFunctionCallString($function, $paramIndex, "    ", $implClassName);
     push(@implContentDecls, "$callString");
+
+    if ($raisesExceptions) {
+        push(@implContentDecls, "    }\n");
+        push(@implContentDecls, "  fail:\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    return v8::Handle<v8::Value>();\n");
+    }
+    
     push(@implContentDecls, "  }\n\n");
 }
 
@@ -1217,6 +1266,38 @@ sub GenerateImplementation
         GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n");
     }
+    
+    # Setup table of standard callback functions
+    $num_callbacks = 0;
+    $has_callbacks = 0;
+    foreach my $function (@{$dataNode->functions}) {
+        my $attrExt = $function->signature->extendedAttributes;
+        # Don't put any nonstandard functions into this table:
+        if ($attrExt->{"V8OnInstance"}) {
+            next;
+        }
+        if ($attrExt->{"EnabledAtRuntime"} || RequiresCustomSignature($function) || $attrExt->{"V8DoNotCheckSignature"}) {
+            next;
+        }
+        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+            next;
+        }
+        if ($attrExt->{"DontEnum"} || $attrExt->{"V8ReadOnly"}) {
+            next;
+        }
+        if (!$has_callbacks) {
+            $has_callbacks = 1;
+            push(@implContent, "static const BatchedCallback ${interfaceName}_callbacks[] = {\n");
+        }
+        my $name = $function->signature->name;
+        my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+        push(@implContent, <<END);
+  {"$name", $callback},
+END
+        $num_callbacks++;
+    }
+    push(@implContent, "};\n")  if $has_callbacks;
 
     # Setup constants
     my $has_constants = 0;
@@ -1240,7 +1321,7 @@ END
 
     push(@implContentDecls, "} // namespace ${interfaceName}Internal\n\n");
 
-    my $access_check = "/* no access check */";
+    my $access_check = "";
     if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
         $access_check = "instance->SetAccessCheckCallbacks(V8Custom::v8${interfaceName}NamedSecurityCheck, V8Custom::v8${interfaceName}IndexedSecurityCheck, v8::Integer::New(V8ClassIndex::ToInt(V8ClassIndex::${classIndex})));";
     }
@@ -1259,35 +1340,59 @@ static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Pers
 END
     }
 
+    # find the super descriptor
+    my $parentClassIndex = "INVALID_CLASS_INDEX";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") { next; }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClassIndex = uc($codeGenerator->StripModule($parent));
+        last;
+    }
+
+    # find the field count
+    my $fieldCount = "V8Custom::kDefaultWrapperInternalFieldCount";
+    if (IsNodeSubType($dataNode)) {
+        $fieldCount = "V8Custom::kNodeMinimumInternalFieldCount";
+    }
+    
     # Generate the template configuration method
     push(@implContent,  <<END);
 static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
-  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+  v8::Local<v8::Signature> default_signature = configureTemplate(desc, \"${interfaceName}\",
+      V8ClassIndex::$parentClassIndex, $fieldCount,
 END
-    if (IsNodeSubType($dataNode)) {
+
+    # Set up our attributes if we have them
+    if ($has_attributes) {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+      ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs),
 END
     } else {
         push(@implContent, <<END);
-  instance->SetInternalFieldCount(V8Custom::kDefaultWrapperInternalFieldCount);
+      NULL, 0,
+END
+    }
+    
+    if ($has_callbacks) {
+        push(@implContent, <<END);
+      ${interfaceName}_callbacks, sizeof(${interfaceName}_callbacks)/sizeof(*${interfaceName}_callbacks));
+END
+    } else {
+        push(@implContent, <<END);
+      NULL, 0);
 END
     }
 
+    if ($access_check or @enabledAtRuntime or @{$dataNode->functions} or $has_constants) {
     push(@implContent,  <<END);
-  v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
+  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
   v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
-  $access_check
-END
-
-
-    # Set up our attributes if we have them
-    if ($has_attributes) {
-        push(@implContent, <<END);
-  batchConfigureAttributes(instance, proto, ${interfaceName}_attrs, sizeof(${interfaceName}_attrs)/sizeof(*${interfaceName}_attrs));
 END
     }
 
+    push(@implContent,  "  $access_check\n");
+    
     # Setup the enable-at-runtime attrs if we have them
     foreach my $runtime_attr (@enabledAtRuntime) {
         $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
@@ -1304,7 +1409,9 @@ END
     }
 
     # Define our functions with Set() or SetAccessor()
+    $total_functions = 0;
     foreach my $function (@{$dataNode->functions}) {
+        $total_functions++;
         my $attrExt = $function->signature->extendedAttributes;
         my $name = $function->signature->name;
 
@@ -1358,6 +1465,7 @@ END
       v8::ALL_CAN_READ,
       static_cast<v8::PropertyAttribute>($property_attributes));
 END
+          $num_callbacks++;
           next;
       }
 
@@ -1372,31 +1480,26 @@ END
       }
 
       # Normal function call is a template
-      my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
-
-
+      my $callback = GetFunctionTemplateCallbackName($function, $dataNode);
+      
+      if ($property_attributes eq "v8::DontDelete") {
+          $property_attributes = "";
+      } else {
+          $property_attributes = ", static_cast<v8::PropertyAttribute>($property_attributes)";
+      }
+      
+      if ($template eq "proto" && $conditional eq "" && $signature eq "default_signature" && $property_attributes eq "") {
+          # Standard type of callback, already created in the batch, so skip it here.
+          next;
+      }
+      
       push(@implContent, <<END);
-
-  // $commentInfo
-  $conditional ${template}->Set(
-      v8::String::New("$name"),
-      $templateFunction,
-      static_cast<v8::PropertyAttribute>($property_attributes));
+  ${conditional}createCallback($template, "$name", $callback, ${signature}$property_attributes);
 END
+      $num_callbacks++;
     }
-
-    # set the super descriptor
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
-        last;
-    }
-
-    # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
+    
+    die "Wrong number of callbacks generated for $interfaceName ($num_callbacks, should be $total_functions)" if $num_callbacks != $total_functions;
 
     if ($has_constants) {
         push(@implContent, <<END);
@@ -1409,19 +1512,12 @@ END
 }
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
-  if (${className}_raw_cache_.IsEmpty()) {
-    v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
-    ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
-  }
+  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_ = createRawTemplate();
   return ${className}_raw_cache_;
 }
 
 v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate() {
-  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_;
-  if (${className}_cache_.IsEmpty())
-    ${className}_cache_ = Configure${className}Template(GetRawTemplate());
+  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_ = Configure${className}Template(GetRawTemplate());
   return ${className}_cache_;
 }
 
@@ -1528,7 +1624,7 @@ sub GenerateFunctionCallString()
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if not $first;
-        $functionString .= "&callStack";
+        $functionString .= "callStack.get()";
         if ($first) { $first = 0; }
     }
 
@@ -1546,7 +1642,7 @@ sub GenerateFunctionCallString()
         # appendChild functions from Node.
         $result .= $indent . "bool success = $functionString;\n";
         if (@{$function->raisesExceptions}) {
-            $result .= GenerateSetDOMException($indent);
+            $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
         }
         $result .= $indent . "if (success)\n";
         $result .= $indent . "    " .
@@ -1570,7 +1666,7 @@ sub GenerateFunctionCallString()
     }
 
     if (@{$function->raisesExceptions}) {
-        $result .= GenerateSetDOMException($indent);
+        $result .= $indent . "if (UNLIKELY(ec)) goto fail;\n";
     }
 
     # If the return type is a POD type, separate out the wrapper generation
@@ -1627,19 +1723,14 @@ sub GetTypeFromSignature
 {
     my $signature = shift;
 
-    my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
-        $type = "AtomicString";
-    }
-
-    return $type;
+    return $codeGenerator->StripModule($signature->type);
 }
 
 
 sub GetNativeTypeFromSignature
 {
     my $signature = shift;
-    my $isParameter = shift;
+    my $parameterIndex = shift;
 
     my $type = GetTypeFromSignature($signature);
 
@@ -1648,32 +1739,28 @@ sub GetNativeTypeFromSignature
         return "int";
     }
 
-    return GetNativeType($type, $isParameter);
+    $type = GetNativeType($type, $parameterIndex >= 0 ? 1 : 0);
+    
+    if ($parameterIndex >= 0 && $type eq "V8Parameter") {
+        my $mode = "";
+        if ($signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"}) {
+            $mode = "WithUndefinedOrNullCheck";
+        } elsif ($signature->extendedAttributes->{"ConvertNullToNullString"}) {
+            $mode = "WithNullCheck";
+        }
+        $type .= "<$mode>";
+    }
+    
+    return $type;
 }
 
 sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
-    return 1 if $type eq "CanvasActiveInfo";
-    return 1 if $type eq "CanvasArray";
-    return 1 if $type eq "CanvasArrayBuffer";
     return 1 if $type eq "CanvasBooleanArray";
-    return 1 if $type eq "CanvasByteArray";
-    return 1 if $type eq "CanvasBuffer";
-    return 1 if $type eq "CanvasFloatArray";
-    return 1 if $type eq "CanvasFramebuffer";
     return 1 if $type eq "CanvasGradient";
-    return 1 if $type eq "CanvasIntArray";
     return 1 if $type eq "CanvasObject";
-    return 1 if $type eq "CanvasProgram";
-    return 1 if $type eq "CanvasRenderbuffer";
-    return 1 if $type eq "CanvasShader";
-    return 1 if $type eq "CanvasShortArray";
-    return 1 if $type eq "CanvasTexture";
-    return 1 if $type eq "CanvasUnsignedByteArray";
-    return 1 if $type eq "CanvasUnsignedIntArray";
-    return 1 if $type eq "CanvasUnsignedShortArray";
     return 1 if $type eq "ClientRect";
     return 1 if $type eq "ClientRectList";
     return 1 if $type eq "CDATASection";
@@ -1721,6 +1808,23 @@ sub IsRefPtrType
     return 1 if $type eq "TextMetrics";
     return 1 if $type eq "TimeRanges";
     return 1 if $type eq "TreeWalker";
+    return 1 if $type eq "WebGLActiveInfo";
+    return 1 if $type eq "WebGLArray";
+    return 1 if $type eq "WebGLArrayBuffer";
+    return 1 if $type eq "WebGLByteArray";
+    return 1 if $type eq "WebGLBuffer";
+    return 1 if $type eq "WebGLFloatArray";
+    return 1 if $type eq "WebGLFramebuffer";
+    return 1 if $type eq "WebGLIntArray";
+    return 1 if $type eq "WebGLProgram";
+    return 1 if $type eq "WebGLRenderbuffer";
+    return 1 if $type eq "WebGLShader";
+    return 1 if $type eq "WebGLShortArray";
+    return 1 if $type eq "WebGLTexture";
+    return 1 if $type eq "WebGLUniformLocation";
+    return 1 if $type eq "WebGLUnsignedByteArray";
+    return 1 if $type eq "WebGLUnsignedIntArray";
+    return 1 if $type eq "WebGLUnsignedShortArray";
     return 1 if $type eq "WebKitCSSMatrix";
     return 1 if $type eq "WebKitPoint";
     return 1 if $type eq "XPathExpression";
@@ -1766,10 +1870,11 @@ sub GetNativeType
     my $type = shift;
     my $isParameter = shift;
 
-    if ($type eq "float" or $type eq "AtomicString" or $type eq "double") {
+    if ($type eq "float" or $type eq "double") {
         return $type;
     }
 
+    return "V8Parameter" if ($type eq "DOMString" or $type eq "DOMUserData") and $isParameter;
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
     return "unsigned" if $type eq "unsigned long";
@@ -1805,21 +1910,21 @@ sub GetNativeType
 
 
 my %typeCanFailConversion = (
-    "AtomicString" => 0,
     "Attr" => 1,
-    "CanvasArray" => 0,
-    "CanvasBuffer" => 0,
-    "CanvasByteArray" => 0,
-    "CanvasFloatArray" => 0,
-    "CanvasFramebuffer" => 0,
+    "WebGLArray" => 0,
+    "WebGLBuffer" => 0,
+    "WebGLByteArray" => 0,
+    "WebGLFloatArray" => 0,
+    "WebGLFramebuffer" => 0,
     "CanvasGradient" => 0,
-    "CanvasIntArray" => 0,
+    "WebGLIntArray" => 0,
     "CanvasPixelArray" => 0,
-    "CanvasProgram" => 0,
-    "CanvasRenderbuffer" => 0,
-    "CanvasShader" => 0,
-    "CanvasShortArray" => 0,
-    "CanvasTexture" => 0,
+    "WebGLProgram" => 0,
+    "WebGLRenderbuffer" => 0,
+    "WebGLShader" => 0,
+    "WebGLShortArray" => 0,
+    "WebGLTexture" => 0,
+    "WebGLUniformLocation" => 0,
     "CompareHow" => 0,
     "DataGridColumn" => 0,
     "DOMString" => 0,
@@ -1921,16 +2026,8 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
 
-    if ($type eq "AtomicString") {
-        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "v8ValueToAtomicWebCoreString($value)";
-    }
-
-    return "toWebCoreString($value)" if $type eq "DOMUserData";
-    if ($type eq "DOMString") {
-        return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
-        return "toWebCoreStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "toWebCoreString($value)";
+    if ($type eq "DOMString" or $type eq "DOMUserData") {
+        return $value;
     }
 
     if ($type eq "SerializedScriptValue") {
@@ -1956,7 +2053,7 @@ sub JSValueToNative
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8Node::HasInstance($value) ? v8DOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
     if ($type eq "XPathNSResolver") {
@@ -1971,7 +2068,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? v8DOMWrapperToNode<${type}>(v8::Handle<v8::Object>::Cast($value)) : 0";
     } else {
         # TODO: Temporary to avoid Window name conflict.
         my $classIndex = uc($type);
@@ -1990,7 +2087,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8DOMWrapper::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
+        return "V8${type}::HasInstance($value) ? v8DOMWrapperTo<${implClassName}>(V8ClassIndex::${classIndex}, v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 }
 
@@ -2054,7 +2151,6 @@ sub RequiresCustomSignature
 
 my %non_wrapper_types = (
     'float' => 1,
-    'AtomicString' => 1,
     'double' => 1,
     'short' => 1,
     'unsigned short' => 1,
@@ -2123,8 +2219,8 @@ sub ReturnNativeToJSValue
     my $className= "V8$type";
 
     return "return v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
-    return "return $value ? v8::True() : v8::False()" if $type eq "boolean";
-    return "return v8::Undefined()" if $type eq "void";
+    return "return v8Boolean($value)" if $type eq "boolean";
+    return "return v8::Handle<v8::Value>()" if $type eq "void";     # equivalent to v8::Undefined()
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
diff --git a/WebCore/bindings/scripts/IDLParser.pm b/WebCore/bindings/scripts/IDLParser.pm
index 4abdb45..5affe94 100644
--- a/WebCore/bindings/scripts/IDLParser.pm
+++ b/WebCore/bindings/scripts/IDLParser.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
diff --git a/WebCore/bindings/scripts/IDLStructure.pm b/WebCore/bindings/scripts/IDLStructure.pm
index 5a59ff1..f5970b4 100644
--- a/WebCore/bindings/scripts/IDLStructure.pm
+++ b/WebCore/bindings/scripts/IDLStructure.pm
@@ -3,8 +3,6 @@
 #
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # 
-# This file is part of the KDE project
-# 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
 # License as published by the Free Software Foundation; either
diff --git a/WebCore/bindings/v8/DOMData.cpp b/WebCore/bindings/v8/DOMData.cpp
index 07254fe..54bcc55 100644
--- a/WebCore/bindings/v8/DOMData.cpp
+++ b/WebCore/bindings/v8/DOMData.cpp
@@ -33,6 +33,7 @@
 
 #include "ChildThreadDOMData.h"
 #include "MainThreadDOMData.h"
+#include "WebGLUniformLocation.h"
 
 namespace WebCore {
 
@@ -46,19 +47,12 @@ DOMData::DOMData()
 DOMData* DOMData::getCurrent()
 {
     if (WTF::isMainThread())
-        return getCurrentMainThread();
+        return MainThreadDOMData::getCurrent();
 
     DEFINE_STATIC_LOCAL(WTF::ThreadSpecific<ChildThreadDOMData>, childThreadDOMData, ());
     return childThreadDOMData;
 }
 
-DOMData* DOMData::getCurrentMainThread()
-{
-    ASSERT(WTF::isMainThread());
-    DEFINE_STATIC_LOCAL(MainThreadDOMData, mainThreadDOMData, ());
-    return &mainThreadDOMData;
-}
-
 void DOMData::ensureDeref(V8ClassIndex::V8WrapperType type, void* domObject)
 {
     if (m_owningThread == WTF::currentThread()) {
diff --git a/WebCore/bindings/v8/DOMData.h b/WebCore/bindings/v8/DOMData.h
index e67adb4..7bf9f91 100644
--- a/WebCore/bindings/v8/DOMData.h
+++ b/WebCore/bindings/v8/DOMData.h
@@ -50,7 +50,6 @@ namespace WebCore {
 #endif
 
         static DOMData* getCurrent();
-        static DOMData* getCurrentMainThread(); // Caller must be on the main thread.
         virtual DOMDataStore& getStore() = 0;
 
         template<typename T>
@@ -87,20 +86,10 @@ namespace WebCore {
         ThreadIdentifier m_owningThread;
     };
 
-    // Called when the dead object is not in GC thread's map. Go through all
-    // thread maps to find the one containing it.  Then clear the JS reference
-    // and push the DOM object into the delayed queue for it to be deref-ed at
-    // later time from the owning thread.
-    //
-    // * This is called when the GC thread is not the owning thread.
-    // * This can be called on any thread that has GC running.
-    // * Only one V8 instance is running at a time due to V8::Locker. So we don't need to worry about concurrency.
-    //
     template<typename T>
     void DOMData::handleWeakObject(DOMDataStore::DOMWrapperMapType mapType, v8::Handle<v8::Object> v8Object, T* domObject)
     {
-
-        WTF::MutexLocker locker(DOMDataStore::allStoresMutex());
+        ASSERT(WTF::isMainThread());
         DOMDataList& list = DOMDataStore::allStores();
         for (size_t i = 0; i < list.size(); ++i) {
             DOMDataStore* store = list[i];
@@ -111,7 +100,8 @@ namespace WebCore {
             if (*wrapper == *v8Object) {
                 // Clear the JS reference.
                 domMap->forgetOnly(domObject);
-                store->domData()->ensureDeref(V8DOMWrapper::domWrapperType(v8Object), domObject);
+                ASSERT(store->domData()->owningThread() == WTF::currentThread());
+                store->domData()->derefObject(V8DOMWrapper::domWrapperType(v8Object), domObject);
             }
         }
     }
diff --git a/WebCore/bindings/v8/DOMObjectsInclude.h b/WebCore/bindings/v8/DOMObjectsInclude.h
index 213873b..6ed14be 100644
--- a/WebCore/bindings/v8/DOMObjectsInclude.h
+++ b/WebCore/bindings/v8/DOMObjectsInclude.h
@@ -31,36 +31,38 @@
 #ifndef DOMObjectsInclude_h
 #define DOMObjectsInclude_h
 
+#include "Attr.h"
 #include "BarInfo.h"
 #include "BeforeLoadEvent.h"
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasArrayBuffer.h"
-#include "CanvasBuffer.h"
-#include "CanvasByteArray.h"
-#include "CanvasFloatArray.h"
-#include "CanvasFramebuffer.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLBuffer.h"
+#include "WebGLByteArray.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
 #include "CanvasGradient.h"
-#include "CanvasIntArray.h"
+#include "WebGLIntArray.h"
 #include "CanvasObject.h"
 #include "CanvasPattern.h"
 #include "CanvasPixelArray.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
 #include "CanvasRenderingContext.h"
 #include "CanvasRenderingContext2D.h"
-#include "CanvasRenderingContext3D.h"
-#include "CanvasShader.h"
-#include "CanvasShortArray.h"
-#include "CanvasUnsignedByteArray.h"
-#include "CanvasUnsignedIntArray.h"
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLRenderingContext.h"
+#include "WebGLShader.h"
+#include "WebGLShortArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "WebGLUnsignedIntArray.h"
+#include "WebGLUnsignedShortArray.h"
 #include "CanvasStyle.h"
-#include "CanvasTexture.h"
+#include "WebGLTexture.h"
 #include "CharacterData.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "Clipboard.h"
+#include "CompositionEvent.h"
 #include "Console.h"
 #include "Counter.h"
 #include "CSSCharsetRule.h"
@@ -271,7 +273,9 @@
 #endif // XSLT
 
 #if ENABLE(INSPECTOR)
+#include "InjectedScriptHost.h"
 #include "InspectorBackend.h"
+#include "InspectorFrontendHost.h"
 #endif // INSPECTOR
 
 namespace WebCore {
diff --git a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
index 0a88da7..bd2bb7b 100644
--- a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+++ b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
@@ -31,38 +31,45 @@
 // This source file coalesces the V8 derived sources into a single object file to
 // reduce bloat and allow us to link release builds on 32-bit Windows.
 
+// Require explicit conversion to AtomicString. This helps catch cases where
+// the generated bindings cause an expensive implicit conversion.
+#define NO_IMPLICIT_ATOMICSTRING
+
 #include "bindings/V8Attr.cpp"
 #include "bindings/V8BarInfo.cpp"
 #include "bindings/V8BeforeLoadEvent.cpp"
-#include "bindings/V8CanvasActiveInfo.cpp"
-#include "bindings/V8CanvasArray.cpp"
-#include "bindings/V8CanvasArrayBuffer.cpp"
-#include "bindings/V8CanvasBuffer.cpp"
-#include "bindings/V8CanvasByteArray.cpp"
-#include "bindings/V8CanvasFloatArray.cpp"
-#include "bindings/V8CanvasFramebuffer.cpp"
+#include "bindings/V8WebGLActiveInfo.cpp"
+#include "bindings/V8WebGLArray.cpp"
+#include "bindings/V8WebGLArrayBuffer.cpp"
+#include "bindings/V8WebGLBuffer.cpp"
+#include "bindings/V8WebGLByteArray.cpp"
+#include "bindings/V8WebGLFloatArray.cpp"
+#include "bindings/V8WebGLFramebuffer.cpp"
 #include "bindings/V8CanvasGradient.cpp"
-#include "bindings/V8CanvasIntArray.cpp"
+#include "bindings/V8WebGLIntArray.cpp"
 #include "bindings/V8CanvasPattern.cpp"
 #include "bindings/V8CanvasPixelArray.cpp"
-#include "bindings/V8CanvasProgram.cpp"
-#include "bindings/V8CanvasRenderbuffer.cpp"
+#include "bindings/V8WebGLProgram.cpp"
+#include "bindings/V8WebGLRenderbuffer.cpp"
 #include "bindings/V8CanvasRenderingContext.cpp"
 #include "bindings/V8CanvasRenderingContext2D.cpp"
-#include "bindings/V8CanvasRenderingContext3D.cpp"
-#include "bindings/V8CanvasShader.cpp"
-#include "bindings/V8CanvasShortArray.cpp"
-#include "bindings/V8CanvasTexture.cpp"
-#include "bindings/V8CanvasUnsignedByteArray.cpp"
-#include "bindings/V8CanvasUnsignedIntArray.cpp"
-#include "bindings/V8CanvasUnsignedShortArray.cpp"
+#include "bindings/V8WebGLRenderingContext.cpp"
+#include "bindings/V8WebGLShader.cpp"
+#include "bindings/V8WebGLShortArray.cpp"
+#include "bindings/V8WebGLTexture.cpp"
+#include "bindings/V8WebGLUniformLocation.cpp"
+#include "bindings/V8WebGLUnsignedByteArray.cpp"
+#include "bindings/V8WebGLUnsignedIntArray.cpp"
+#include "bindings/V8WebGLUnsignedShortArray.cpp"
 #include "bindings/V8CDATASection.cpp"
 #include "bindings/V8CharacterData.cpp"
 #include "bindings/V8ClientRect.cpp"
 #include "bindings/V8ClientRectList.cpp"
 #include "bindings/V8Clipboard.cpp"
 #include "bindings/V8Comment.cpp"
+#include "bindings/V8CompositionEvent.cpp"
 #include "bindings/V8Console.cpp"
+#include "bindings/V8Coordinates.cpp"
 #include "bindings/V8Counter.cpp"
 #include "bindings/V8CSSCharsetRule.cpp"
 #include "bindings/V8CSSFontFaceRule.cpp"
@@ -97,6 +104,8 @@
 #include "bindings/V8EventException.cpp"
 #include "bindings/V8File.cpp"
 #include "bindings/V8FileList.cpp"
+#include "bindings/V8Geolocation.cpp"
+#include "bindings/V8Geoposition.cpp"
 #include "bindings/V8History.cpp"
 #include "bindings/V8HTMLAllCollection.cpp"
 #include "bindings/V8HTMLAnchorElement.cpp"
@@ -193,6 +202,7 @@
 #include "bindings/V8PageTransitionEvent.cpp"
 #include "bindings/V8Plugin.cpp"
 #include "bindings/V8PluginArray.cpp"
+#include "bindings/V8PositionError.cpp"
 #include "bindings/V8ProcessingInstruction.cpp"
 #include "bindings/V8ProgressEvent.cpp"
 #include "bindings/V8Range.cpp"
@@ -282,6 +292,7 @@
 #include "bindings/V8SVGCircleElement.cpp"
 #include "bindings/V8SVGClipPathElement.cpp"
 #include "bindings/V8SVGColor.cpp"
+#include "bindings/V8SVGComponentTransferFunctionElement.cpp"
 #include "bindings/V8SVGCursorElement.cpp"
 #include "bindings/V8SVGDefsElement.cpp"
 #include "bindings/V8SVGDescElement.cpp"
@@ -291,6 +302,30 @@
 #include "bindings/V8SVGElementInstanceList.cpp"
 #include "bindings/V8SVGEllipseElement.cpp"
 #include "bindings/V8SVGException.cpp"
+#include "bindings/V8SVGFEBlendElement.cpp"
+#include "bindings/V8SVGFEColorMatrixElement.cpp"
+#include "bindings/V8SVGFEComponentTransferElement.cpp"
+#include "bindings/V8SVGFECompositeElement.cpp"
+#include "bindings/V8SVGFEDiffuseLightingElement.cpp"
+#include "bindings/V8SVGFEDisplacementMapElement.cpp"
+#include "bindings/V8SVGFEDistantLightElement.cpp"
+#include "bindings/V8SVGFEFloodElement.cpp"
+#include "bindings/V8SVGFEFuncAElement.cpp"
+#include "bindings/V8SVGFEFuncBElement.cpp"
+#include "bindings/V8SVGFEFuncGElement.cpp"
+#include "bindings/V8SVGFEFuncRElement.cpp"
+#include "bindings/V8SVGFEGaussianBlurElement.cpp"
+#include "bindings/V8SVGFEImageElement.cpp"
+#include "bindings/V8SVGFEMergeElement.cpp"
+#include "bindings/V8SVGFEMergeNodeElement.cpp"
+#include "bindings/V8SVGFEMorphologyElement.cpp"
+#include "bindings/V8SVGFEOffsetElement.cpp"
+#include "bindings/V8SVGFEPointLightElement.cpp"
+#include "bindings/V8SVGFESpecularLightingElement.cpp"
+#include "bindings/V8SVGFESpotLightElement.cpp"
+#include "bindings/V8SVGFETileElement.cpp"
+#include "bindings/V8SVGFETurbulenceElement.cpp"
+#include "bindings/V8SVGFilterElement.cpp"
 #include "bindings/V8SVGFontElement.cpp"
 #include "bindings/V8SVGFontFaceElement.cpp"
 #include "bindings/V8SVGFontFaceFormatElement.cpp"
@@ -382,5 +417,7 @@
 #endif
 
 #if ENABLE(INSPECTOR)
+#include "bindings/V8InjectedScriptHost.cpp"
 #include "bindings/V8InspectorBackend.cpp"
+#include "bindings/V8InspectorFrontendHost.cpp"
 #endif
diff --git a/WebCore/bindings/v8/MainThreadDOMData.cpp b/WebCore/bindings/v8/MainThreadDOMData.cpp
index ea34444..b1b63bf 100644
--- a/WebCore/bindings/v8/MainThreadDOMData.cpp
+++ b/WebCore/bindings/v8/MainThreadDOMData.cpp
@@ -39,14 +39,30 @@ MainThreadDOMData::MainThreadDOMData()
     : m_defaultStore(this)
 {
 }
+    
+MainThreadDOMData* MainThreadDOMData::getCurrent()
+{
+    ASSERT(WTF::isMainThread());
+    DEFINE_STATIC_LOCAL(MainThreadDOMData, mainThreadDOMData, ());
+    return &mainThreadDOMData;
+}
 
-DOMDataStore& MainThreadDOMData::getStore()
+DOMDataStore& MainThreadDOMData::getMainThreadStore()
 {
+    // This is broken out as a separate non-virtual method from getStore()
+    // so that it can be inlined by getCurrentMainThreadStore, which is
+    // a hot spot in Dromaeo DOM tests.
     ASSERT(WTF::isMainThread());
     V8IsolatedWorld* world = V8IsolatedWorld::getEntered();
-    if (world)
+    if (UNLIKELY(world != 0))
         return *world->getDOMDataStore();
     return m_defaultStore;
 }
 
+DOMDataStore& MainThreadDOMData::getCurrentMainThreadStore()
+{
+    return getCurrent()->getMainThreadStore();
+}
+
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/MainThreadDOMData.h b/WebCore/bindings/v8/MainThreadDOMData.h
index 5c78cec..e8f99c9 100644
--- a/WebCore/bindings/v8/MainThreadDOMData.h
+++ b/WebCore/bindings/v8/MainThreadDOMData.h
@@ -38,10 +38,16 @@ namespace WebCore {
 
     class MainThreadDOMData : public DOMData {
     public:
-        MainThreadDOMData();
-        DOMDataStore& getStore();
+        static MainThreadDOMData* getCurrent(); // Caller must be on the main thread.
+        static DOMDataStore& getCurrentMainThreadStore();
+                
+        virtual DOMDataStore& getStore() { return getMainThreadStore(); }
+        
 
     private:
+        MainThreadDOMData();
+        DOMDataStore& getMainThreadStore();
+
         StaticDOMDataStore m_defaultStore;
         // Note: The DOMDataStores for isolated world are owned by the world object.
     };
diff --git a/WebCore/bindings/v8/NPV8Object.cpp b/WebCore/bindings/v8/NPV8Object.cpp
index 13403ec..69cd303 100644
--- a/WebCore/bindings/v8/NPV8Object.cpp
+++ b/WebCore/bindings/v8/NPV8Object.cpp
@@ -413,7 +413,7 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject* npObject, const NPUTF8 *message)
 {
-    if (npObject->_class != npScriptObjectClass) {
+    if (!npObject || npObject->_class != npScriptObjectClass) {
         // We won't be able to find a proper scope for this exception, so just throw it.
         // This is consistent with JSC, which throws a global exception all the time.
         V8Proxy::throwError(V8Proxy::GeneralError, message);
diff --git a/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
index 21293a5..cf97b5b 100644
--- a/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
@@ -36,5 +36,7 @@ namespace WebCore {
 bool RuntimeEnabledFeatures::isDatabaseEnabled = false;
 bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
 bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+bool RuntimeEnabledFeatures::isNotificationsEnabled = false;
+bool RuntimeEnabledFeatures::isApplicationCacheEnabled = false;
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/RuntimeEnabledFeatures.h b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
index fa42024..d8078c5 100644
--- a/WebCore/bindings/v8/RuntimeEnabledFeatures.h
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
@@ -45,6 +45,12 @@ public:
     static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
     static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
 
+    static void setNotificationsEnabled(bool isEnabled) { isNotificationsEnabled = isEnabled; }
+    static bool notificationsEnabled() { return isNotificationsEnabled; }
+
+    static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
+    static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -52,6 +58,8 @@ private:
     static bool isDatabaseEnabled;
     static bool isLocalStorageEnabled;
     static bool isSessionStorageEnabled;
+    static bool isNotificationsEnabled;
+    static bool isApplicationCacheEnabled;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptCallStack.cpp b/WebCore/bindings/v8/ScriptCallStack.cpp
index 8eb9478..d9b2fcf 100644
--- a/WebCore/bindings/v8/ScriptCallStack.cpp
+++ b/WebCore/bindings/v8/ScriptCallStack.cpp
@@ -38,8 +38,21 @@
 
 namespace WebCore {
 
-ScriptCallStack::ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount)
-    : m_lastCaller(String(), V8Proxy::sourceName(), V8Proxy::sourceLineNumber() + 1, arguments, skipArgumentCount)
+ScriptCallStack* ScriptCallStack::create(const v8::Arguments& arguments, unsigned skipArgumentCount) {
+    String sourceName;
+    int sourceLineNumber;
+    if (!V8Proxy::sourceName(sourceName)) {
+        return 0;
+    }
+    if (!V8Proxy::sourceLineNumber(sourceLineNumber)) {
+        return 0;
+    }
+    sourceLineNumber += 1;
+    return new ScriptCallStack(arguments, skipArgumentCount, sourceName, sourceLineNumber);
+}
+
+ScriptCallStack::ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount, String sourceName, int sourceLineNumber)
+    : m_lastCaller(String(), sourceName, sourceLineNumber, arguments, skipArgumentCount)
     , m_scriptState(new ScriptState(V8Proxy::retrieveFrameForCurrentContext()))
 {
 }
diff --git a/WebCore/bindings/v8/ScriptCallStack.h b/WebCore/bindings/v8/ScriptCallStack.h
index 3ba01c5..f6a7e39 100644
--- a/WebCore/bindings/v8/ScriptCallStack.h
+++ b/WebCore/bindings/v8/ScriptCallStack.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
     class ScriptCallStack : public Noncopyable {
     public:
-        ScriptCallStack(const v8::Arguments&, unsigned skipArgumentCount = 0);
+        static ScriptCallStack* create(const v8::Arguments&, unsigned skipArgumentCount = 0);
         ~ScriptCallStack();
 
         const ScriptCallFrame& at(unsigned) const;
@@ -55,6 +55,8 @@ namespace WebCore {
         ScriptState* state() const { return m_scriptState.get(); }
 
     private:
+        ScriptCallStack(const v8::Arguments& arguments, unsigned skipArgumentCount, String sourceName, int sourceLineNumber);
+    
         ScriptCallFrame m_lastCaller;
         OwnPtr<ScriptState> m_scriptState;
     };
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 35a2d73..5b4dbc2 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -45,18 +45,21 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderClient.h"
 #include "Node.h"
 #include "NotImplemented.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
 #include "ScriptSourceCode.h"
-#include "Widget.h"
-#include "XSSAuditor.h"
-
+#include "ScriptState.h"
+#include "Settings.h"
 #include "V8Binding.h"
 #include "V8NPObject.h"
 #include "V8Proxy.h"
+#include "Widget.h"
+#include "XSSAuditor.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -295,7 +298,8 @@ bool ScriptController::haveInterpreter() const
 
 bool ScriptController::isEnabled() const
 {
-    return m_proxy->isEnabled();
+    Settings* settings = m_proxy->frame()->settings();
+    return m_proxy->frame()->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled() && !m_frame->loader()->isSandboxed(SandboxScripts));
 }
 
 PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)
@@ -362,6 +366,18 @@ void ScriptController::cleanupScriptObjectsForPlugin(Widget* nativeHandle)
     m_pluginObjects.remove(it);
 }
 
+void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)
+{
+    worlds.append(mainThreadNormalWorld());
+}
+
+ScriptState* ScriptController::mainWorldScriptState()
+{
+    if (!m_mainWorldScriptState)
+        m_mainWorldScriptState.set(new ScriptState(m_frame, V8Proxy::mainWorldContext(m_frame)));
+    return m_mainWorldScriptState.get();
+}
+
 static NPObject* createNoScriptObject()
 {
     notImplemented();
@@ -440,10 +456,4 @@ void ScriptController::updateDocument()
     m_proxy->updateDocument();
 }
 
-// FIXME: Stub method so we compile.  Currently called from FrameLoader.cpp.
-DOMWrapperWorld* mainThreadNormalWorld()
-{
-    return 0;
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index a958ead..fb7bbee 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -39,6 +39,7 @@
 #include <v8.h>
 
 #include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -47,6 +48,7 @@ namespace WebCore {
     class Frame;
     class HTMLPlugInElement;
     class ScriptSourceCode;
+    class ScriptState;
     class String;
     class Widget;
     class XSSAuditor;
@@ -165,6 +167,13 @@ namespace WebCore {
         NPObject* windowScriptNPObject();
 #endif
 
+        // Dummy method to avoid a bunch of ifdef's in WebCore.
+        void evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*) { }
+        static void getAllWorlds(Vector<DOMWrapperWorld*>& worlds);
+
+        // Script state for the main world context.
+        ScriptState* mainWorldScriptState();
+
     private:
         Frame* m_frame;
         const String* m_sourceURL;
@@ -187,9 +196,10 @@ namespace WebCore {
 #endif
         // The XSSAuditor associated with this ScriptController.
         OwnPtr<XSSAuditor> m_XSSAuditor;
-    };
 
-    DOMWrapperWorld* mainThreadNormalWorld();
+        // Script state for the main world context.
+        OwnPtr<ScriptState> m_mainWorldScriptState;
+    };
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index 03713be..51d53ab 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -68,7 +68,7 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, lineNumber, columnNumber);
+    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, lineNumber, columnNumber, WorldContextHandle(UseMainWorld));
 }
 
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -95,7 +95,7 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
         columnNumber = frame->document()->tokenizer()->columnNumber();
     }
     sourceURL = frame->document()->url().string();
-    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber);
+    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber, WorldContextHandle(UseMainWorld));
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* listener)
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 9ff6b8c..a232acd 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -74,6 +74,18 @@ void ScriptFunctionCall::appendArgument(const String& argument)
     m_arguments.append(v8String(argument));
 }
 
+void ScriptFunctionCall::appendArgument(const char* argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8String(argument));
+}
+
+void ScriptFunctionCall::appendArgument(long argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
 void ScriptFunctionCall::appendArgument(long long argument)
 {
     ScriptScope scope(m_scriptState);
@@ -86,6 +98,12 @@ void ScriptFunctionCall::appendArgument(unsigned int argument)
     m_arguments.append(v8::Number::New(argument));
 }
 
+void ScriptFunctionCall::appendArgument(unsigned long argument)
+{
+    ScriptScope scope(m_scriptState);
+    m_arguments.append(v8::Number::New(argument));
+}
+
 void ScriptFunctionCall::appendArgument(int argument)
 {
     ScriptScope scope(m_scriptState);
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.h b/WebCore/bindings/v8/ScriptFunctionCall.h
index 8365a4e..6203402 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.h
+++ b/WebCore/bindings/v8/ScriptFunctionCall.h
@@ -50,8 +50,11 @@ namespace WebCore {
         void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
+        void appendArgument(const char*);
+        void appendArgument(long);
         void appendArgument(long long);
         void appendArgument(unsigned int);
+        void appendArgument(unsigned long);
         void appendArgument(int);
         void appendArgument(bool);
         ScriptValue call(bool& hadException, bool reportExceptions = true);
diff --git a/WebCore/bindings/v8/ScriptObject.cpp b/WebCore/bindings/v8/ScriptObject.cpp
index ac8051d..5f5609c 100644
--- a/WebCore/bindings/v8/ScriptObject.cpp
+++ b/WebCore/bindings/v8/ScriptObject.cpp
@@ -36,6 +36,8 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "InspectorBackend.h"
+#include "InspectorFrontendHost.h"
 #include "V8Binding.h"
 #include "V8Proxy.h"
 
@@ -83,6 +85,13 @@ bool ScriptObject::set(const char* name, double value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, long value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, long long value)
 {
     ScriptScope scope(m_scriptState);
@@ -104,6 +113,13 @@ bool ScriptObject::set(const char* name, unsigned value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, unsigned long value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     ScriptScope scope(m_scriptState);
@@ -124,6 +140,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return scope.success();
 }
 
+#if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     ScriptScope scope(scriptState);
@@ -133,6 +150,21 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     return scope.success();
 }
 
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), V8DOMWrapper::convertToV8Object(V8ClassIndex::INSPECTORFRONTENDHOST, value));
+    return scope.success();
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
+{
+    ScriptScope scope(scriptState);
+    scope.global()->Set(v8::String::New(name), V8DOMWrapper::convertToV8Object(V8ClassIndex::INJECTEDSCRIPTHOST, value));
+    return scope.success();
+}
+#endif
+
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
     ScriptScope scope(scriptState);
diff --git a/WebCore/bindings/v8/ScriptObject.h b/WebCore/bindings/v8/ScriptObject.h
index f741f89..630d3b9 100644
--- a/WebCore/bindings/v8/ScriptObject.h
+++ b/WebCore/bindings/v8/ScriptObject.h
@@ -36,7 +36,9 @@
 #include <v8.h>
 
 namespace WebCore {
+    class InjectedScriptHost;
     class InspectorBackend;
+    class InspectorFrontendHost;
     class ScriptState;
 
     class ScriptObject : public ScriptValue {
@@ -51,9 +53,11 @@ namespace WebCore {
         bool set(const char* name, const ScriptObject&);
         bool set(const char* name, const String&);
         bool set(const char* name, double);
+        bool set(const char* name, long);
         bool set(const char* name, long long);
         bool set(const char* name, int);
         bool set(const char* name, unsigned);
+        bool set(const char* name, unsigned long);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -65,6 +69,8 @@ namespace WebCore {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+        static bool set(ScriptState*, const char* name, InspectorFrontendHost*);
+        static bool set(ScriptState*, const char* name, InjectedScriptHost*);
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
deleted file mode 100644
index 6528c9d..0000000
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ScriptObjectQuarantine.h"
-
-#include "Database.h"
-#include "Document.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "InspectorController.h"
-#include "Page.h"
-#include "ScriptObject.h"
-#include "ScriptValue.h"
-#include "Storage.h"
-
-#include "V8Binding.h"
-#include "V8Proxy.h"
-
-#include <v8.h>
-
-namespace WebCore {
-
-ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
-{
-    return value;
-}
-
-bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
-{
-    ASSERT(database);
-
-#if ENABLE(DATABASE)
-    v8::HandleScope handleScope;
-    Frame* frame = database->document()->frame();
-    if (!frame)
-        return false;
-
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    if (context.IsEmpty())
-        return false;
-
-    v8::Context::Scope scope(context);
-    v8::Handle<v8::Value> v8Database = V8DOMWrapper::convertToV8Object(V8ClassIndex::DATABASE, database);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Database)));
-#else
-    ASSERT_NOT_REACHED();
-    quarantinedObject = ScriptObject();
-#endif
-    return true;
-}
-
-bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
-{
-    ASSERT(storage);
-    Frame* frame = storage->frame();
-    ASSERT(frame);
-
-#if ENABLE(DOM_STORAGE)
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    if (context.IsEmpty())
-        return false;
-
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8Storage = V8DOMWrapper::convertToV8Object(V8ClassIndex::STORAGE, storage);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
-#else
-    ASSERT_NOT_REACHED();
-    quarantinedObject = ScriptObject();
-#endif
-    return true;
-}
-
-bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
-{
-    ASSERT(node);
-
-    v8::HandleScope handleScope;
-    // FIXME: What if document() is null?
-    // FIXME: Why are we grabbing the mainFrame?
-    Frame* frame = node->document()->page()->mainFrame();
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    // FIXME: What if context.IsEmpty()?
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8Node = V8DOMWrapper::convertNodeToV8Object(node);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
-
-    return true;
-}
-
-bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
-{
-    ASSERT(domWindow);
-
-    v8::HandleScope handleScope;
-    Frame* frame = domWindow->frame();
-    // FIXME: What if frame is null?
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
-    // FIXME: What if context.IsEmpty()?
-    v8::Context::Scope scope(context);
-
-    v8::Handle<v8::Value> v8DomWindow = V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, domWindow);
-    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
-    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
-
-    return true;
-}
-
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptState.cpp b/WebCore/bindings/v8/ScriptState.cpp
index 99557b5..68593e7 100644
--- a/WebCore/bindings/v8/ScriptState.cpp
+++ b/WebCore/bindings/v8/ScriptState.cpp
@@ -37,6 +37,7 @@
 #include "ScriptController.h"
 
 #include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -58,7 +59,7 @@ ScriptState::~ScriptState()
     m_context.Clear();
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node* node)
 {
     // This should be never reached with V8 bindings (WebKit only uses it
     // for non-JS bindings)
@@ -66,11 +67,17 @@ ScriptState* scriptStateFromNode(Node* node)
     return 0;
 }
 
-ScriptState* scriptStateFromPage(Page* page)
+ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page* page)
 {
-    // This should be never reached with V8 bindings.
-    ASSERT_NOT_REACHED();
-    return 0;
+    // This should be only reached with V8 bindings from single process layout tests.
+    return page->mainFrame()->script()->mainWorldScriptState();
+}
+
+// FIXME: Stub method so we compile.  Currently called from FrameLoader.cpp.
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    DEFINE_STATIC_LOCAL(DOMWrapperWorld, oneWorld, ());
+    return &oneWorld;
 }
 
 }
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index e44e914..12a1388 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -33,8 +33,10 @@
 
 #include <v8.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
+    class DOMWrapperWorld;
     class Node;
     class Page;
     class Frame;
@@ -65,8 +67,17 @@ namespace WebCore {
         v8::Persistent<v8::Context> m_context;
     };
 
-    ScriptState* scriptStateFromNode(Node*);
-    ScriptState* scriptStateFromPage(Page*);
+    ScriptState* scriptStateFromNode(DOMWrapperWorld*, Node*);
+    ScriptState* scriptStateFromPage(DOMWrapperWorld*, Page*);
+
+    DOMWrapperWorld* mainThreadNormalWorld();
+    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
+    // Dummy class to avoid a bunch of ifdef's in WebCore.
+    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+    };
+
 }
 
 #endif // ScriptState_h
diff --git a/WebCore/bindings/v8/ScriptValue.h b/WebCore/bindings/v8/ScriptValue.h
index a429593..c0ba8d5 100644
--- a/WebCore/bindings/v8/ScriptValue.h
+++ b/WebCore/bindings/v8/ScriptValue.h
@@ -44,6 +44,11 @@ namespace WebCore {
 
 class ScriptValue {
 public:
+    static ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+    {
+        return value;
+    }
+
     ScriptValue() {}
 
     ScriptValue(v8::Handle<v8::Value> value) 
@@ -139,6 +144,7 @@ public:
     }
 
     v8::Handle<v8::Value> v8Value() const { return m_value; }
+    bool getString(ScriptState*, String& result) const { return getString(result); }
     bool getString(String& result) const;
     String toString(ScriptState*) const;
 
diff --git a/WebCore/bindings/v8/SharedPersistent.h b/WebCore/bindings/v8/SharedPersistent.h
index c1232ae..8825bd5 100644
--- a/WebCore/bindings/v8/SharedPersistent.h
+++ b/WebCore/bindings/v8/SharedPersistent.h
@@ -32,6 +32,8 @@
 #define SharedPersistent_h
 
 #include <v8.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -40,7 +42,7 @@ namespace WebCore {
     // object and when it should no longer be accessible the object's
     // owner can clear it.
     template <typename T>
-    class SharedPersistent : public WTF::RefCounted<SharedPersistent<T> > {
+    class SharedPersistent : public RefCounted<SharedPersistent<T> > {
     public:
         void set(v8::Persistent<T> value)
         {
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index f27c619..0f5b5c8 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -50,11 +50,11 @@ static void weakEventListenerCallback(v8::Persistent<v8::Value>, void* parameter
     listener->disposeListenerObject();
 }
 
-V8AbstractEventListener::V8AbstractEventListener(PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
+V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldContextHandle& worldContext)
     : EventListener(JSEventListenerType)
     , m_isWeak(true)
     , m_isAttribute(isAttribute)
-    , m_guard(guard)
+    , m_worldContext(worldContext)
 {
 }
 
@@ -70,17 +70,13 @@ V8AbstractEventListener::~V8AbstractEventListener()
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
-    // EventListener could be disconnected from the frame.
-    if (disconnected())
-        return;
-
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
     // See issue 889829.
     RefPtr<V8AbstractEventListener> protect(this);
 
     v8::HandleScope handleScope;
 
-    v8::Local<v8::Context> v8Context = toV8Context(context);
+    v8::Local<v8::Context> v8Context = toV8Context(context, worldContext());
     if (v8Context.IsEmpty())
         return;
 
@@ -120,7 +116,7 @@ void V8AbstractEventListener::setListenerObject(v8::Handle<v8::Object> listener)
 void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context, Event* event, v8::Handle<v8::Value> jsEvent)
 {
 
-    v8::Local<v8::Context> v8Context = toV8Context(context);
+    v8::Local<v8::Context> v8Context = toV8Context(context, worldContext());
     if (v8Context.IsEmpty())
         return;
 
@@ -146,7 +142,6 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         tryCatch.Reset();
 
         // Call the event handler.
-        tryCatch.SetVerbose(false); // We do not want to report the exception to the inspector console.
         returnValue = callListenerFunction(context, jsEvent, event);
         if (!tryCatch.CanContinue())
             return;
@@ -158,7 +153,6 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         }
 
         // Restore the old event. This must be done for all exit paths through this method.
-        tryCatch.SetVerbose(true);
         if (savedEvent.IsEmpty())
             v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
         else
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index ceff001..0afbed5 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -32,8 +32,8 @@
 #define V8AbstractEventListener_h
 
 #include "EventListener.h"
-#include "OwnHandle.h"
-#include "SharedPersistent.h"
+#include "WorldContextHandle.h"
+
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -44,29 +44,6 @@ namespace WebCore {
     class Frame;
     class V8Proxy;
 
-    // Shared by listener objects and V8Proxy so that V8Proxy can
-    // silence listeners when needed.
-    class V8ListenerGuard : public RefCounted<V8ListenerGuard> {
-      public:
-        static PassRefPtr<V8ListenerGuard> create()
-        {
-            return adoptRef(new V8ListenerGuard);
-        }
-
-        bool isDisconnected() const { return m_disconnected; }
-
-        void disconnectListeners()
-        {
-            m_disconnected = true;
-        }
-
-      private:
-        V8ListenerGuard()
-            : m_disconnected(false) { }
-
-        bool m_disconnected;
-    };
-
     // There are two kinds of event listeners: HTML or non-HMTL. onload,
     // onfocus, etc (attributes) are always HTML event handler type; Event
     // listeners added by Window.addEventListener or
@@ -119,10 +96,8 @@ namespace WebCore {
         // Dispose listener object and clear the handle.
         void disposeListenerObject();
 
-        virtual bool disconnected() const { return m_guard && m_guard->isDisconnected(); }
-
     protected:
-        V8AbstractEventListener(PassRefPtr<V8ListenerGuard>, bool isAttribute);
+        V8AbstractEventListener(bool isAttribute, const WorldContextHandle& worldContext);
 
         virtual void prepareListenerObject(ScriptExecutionContext*) { }
 
@@ -132,6 +107,9 @@ namespace WebCore {
 
         // Get the receiver object to use for event listener call.
         v8::Local<v8::Object> getReceiverObject(Event*);
+
+        const WorldContextHandle& worldContext() const { return m_worldContext; }
+
     private:
         // Implementation of EventListener function.
         virtual bool virtualisAttribute() const { return m_isAttribute; }
@@ -146,7 +124,7 @@ namespace WebCore {
         // Indicates if this is an HTML type listener.
         bool m_isAttribute;
 
-        RefPtr<V8ListenerGuard> m_guard;
+        WorldContextHandle m_worldContext;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.cpp b/WebCore/bindings/v8/V8Binding.cpp
index 9ac7eae..00286e5 100644
--- a/WebCore/bindings/v8/V8Binding.cpp
+++ b/WebCore/bindings/v8/V8Binding.cpp
@@ -33,8 +33,10 @@
 
 #include "AtomicString.h"
 #include "CString.h"
+#include "Element.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
+#include "QualifiedName.h"
 #include "StdLibExtras.h"
 #include "StringBuffer.h"
 #include "StringHash.h"
@@ -104,10 +106,6 @@ public:
         return m_atomicString;
     }
 
-    // Returns right string type based on a dummy parameter.
-    String string(String) { return webcoreString(); }
-    AtomicString string(AtomicString) { return atomicString(); }
-
     static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
     {
         return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
@@ -128,17 +126,177 @@ private:
 #endif
 };
 
-enum ExternalMode {
-    Externalize,
-    DoNotExternalize
+
+void* v8DOMWrapperToNative(v8::Handle<v8::Object> object) {
+    return object->GetPointerFromInternalField(V8Custom::kDOMWrapperObjectIndex);
+}
+    
+void* v8DOMWrapperToNative(const v8::AccessorInfo& info) {
+    return info.Holder()->GetPointerFromInternalField(V8Custom::kDOMWrapperObjectIndex);
+}
+    
+
+String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+{
+    if (value->IsString())
+        return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
+    return v8NonStringValueToWebCoreString(value);
+}
+
+AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
+{
+    if (value->IsString())
+        return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
+    return v8NonStringValueToAtomicWebCoreString(value);
+}
+
+int toInt32(v8::Handle<v8::Value> value, bool& ok)
+{
+    ok = true;
+    
+    // Fast case.  The value is already a 32-bit integer.
+    if (value->IsInt32())
+        return value->Int32Value();
+    
+    // Can the value be converted to a number?
+    v8::Local<v8::Number> numberObject = value->ToNumber();
+    if (numberObject.IsEmpty()) {
+        ok = false;
+        return 0;
+    }
+    
+    // Does the value convert to nan or to an infinity?
+    double numberValue = numberObject->Value();
+    if (isnan(numberValue) || isinf(numberValue)) {
+        ok = false;
+        return 0;
+    }
+    
+    // Can the value be converted to a 32-bit integer?
+    v8::Local<v8::Int32> intValue = value->ToInt32();
+    if (intValue.IsEmpty()) {
+        ok = false;
+        return 0;
+    }
+    
+    // Return the result of the int32 conversion.
+    return intValue->Value();
+}
+    
+String toWebCoreString(const v8::Arguments& args, int index) {
+    return v8ValueToWebCoreString(args[index]);
+}
+
+    
+String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull()) 
+        return String();
+    return v8ValueToWebCoreString(value);
+}
+
+AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull())
+        return AtomicString();
+    return v8ValueToAtomicWebCoreString(value);
+}
+
+String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull() || value->IsUndefined())
+        return String();
+    return toWebCoreString(value);
+}
+
+bool isUndefinedOrNull(v8::Handle<v8::Value> value)
+{
+    return value->IsNull() || value->IsUndefined();
+}
+
+v8::Handle<v8::Boolean> v8Boolean(bool value)
+{
+    return value ? v8::True() : v8::False();
+}
+
+v8::Handle<v8::String> v8UndetectableString(const String& str)
+{
+    return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
+}
+
+v8::Handle<v8::Value> v8StringOrNull(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+v8::Handle<v8::Value> v8StringOrFalse(const String& str)
+{
+    return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
+}
+
+
+template <class S> struct StringTraits
+{
+    static S fromStringResource(WebCoreStringResource* resource);
+
+    static S fromV8String(v8::Handle<v8::String> v8String, int length);
+};
+
+template<>
+struct StringTraits<String>
+{
+    static String fromStringResource(WebCoreStringResource* resource)
+    {
+        return resource->webcoreString();
+    }
+
+    static String fromV8String(v8::Handle<v8::String> v8String, int length)
+    {
+        ASSERT(v8String->Length() == length);
+        // NOTE: as of now, String(const UChar*, int) performs String::createUninitialized
+        // anyway, so no need to optimize like we do for AtomicString below.
+        UChar* buffer;
+        String result = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        return result;
+    }
+};
+
+template<>
+struct StringTraits<AtomicString>
+{
+    static AtomicString fromStringResource(WebCoreStringResource* resource)
+    {
+        return resource->atomicString();
+    }
+
+    static AtomicString fromV8String(v8::Handle<v8::String> v8String, int length)
+    {
+        ASSERT(v8String->Length() == length);
+        static const int inlineBufferSize = 16;
+        if (length <= inlineBufferSize) {
+            UChar inlineBuffer[inlineBufferSize];
+            v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
+            return AtomicString(inlineBuffer, length);
+        }
+        UChar* buffer;
+        String tmp = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        return AtomicString(tmp);
+    }
 };
 
 template <typename StringType>
-static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
+StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
 {
     WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
     if (stringResource)
-        return stringResource->string(StringType());
+        return StringTraits<StringType>::fromStringResource(stringResource);
 
     int length = v8String->Length();
     if (!length) {
@@ -146,18 +304,7 @@ static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, Exter
         return StringImpl::empty();
     }
 
-    StringType result;
-    static const int inlineBufferSize = 16;
-    if (length <= inlineBufferSize) {
-        UChar inlineBuffer[inlineBufferSize];
-        v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
-        result = StringType(inlineBuffer, length);
-    } else {
-        UChar* buffer;
-        String tmp = String::createUninitialized(length, buffer);
-        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
-        result = StringType(tmp);
-    }
+    StringType result(StringTraits<StringType>::fromV8String(v8String, length));
 
     if (external == Externalize && v8String->CanMakeExternal()) {
         stringResource = new WebCoreStringResource(result);
@@ -168,16 +315,12 @@ static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, Exter
     }
     return result;
 }
+    
+// Explicitly instantiate the above template with the expected parameterizations,
+// to ensure the compiler generates the code; otherwise link errors can result in GCC 4.4.
+template String v8StringToWebCoreString<String>(v8::Handle<v8::String>, ExternalMode);
+template AtomicString v8StringToWebCoreString<AtomicString>(v8::Handle<v8::String>, ExternalMode);
 
-String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
-{
-    return v8StringToWebCoreString<String>(v8String, Externalize);
-}
-
-AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
-{
-    return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
-}
 
 String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
 {
@@ -254,13 +397,13 @@ static void cachedStringCallback(v8::Persistent<v8::Value> wrapper, void* parame
 
 v8::Local<v8::String> v8ExternalString(const String& string)
 {
-    if (!string.length())
+    StringImpl* stringImpl = string.impl();
+    if (!stringImpl || !stringImpl->length())
         return v8::String::Empty();
 
     if (!stringImplCacheEnabled)
         return makeExternalString(string);
 
-    StringImpl* stringImpl = string.impl();
     StringCache& stringCache = getStringCache();
     v8::String* cachedV8String = stringCache.get(stringImpl);
     if (cachedV8String)
@@ -280,5 +423,65 @@ v8::Local<v8::String> v8ExternalString(const String& string)
 
     return newString;
 }
+    
+v8::Persistent<v8::FunctionTemplate> createRawTemplate()
+{
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
+    return v8::Persistent<v8::FunctionTemplate>::New(result);
+}        
+
+v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>desc,
+                                           const char *interfaceName,
+                                           V8ClassIndex::V8WrapperType parentClassIndex,
+                                           int fieldCount,
+                                           const BatchedAttribute* attributes, 
+                                           size_t attributeCount,
+                                           const BatchedCallback* callbacks,
+                                           size_t callbackCount)
+{
+    desc->SetClassName(v8::String::New(interfaceName));
+    v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+    instance->SetInternalFieldCount(fieldCount);
+    if (parentClassIndex)
+        desc->Inherit(V8DOMWrapper::getTemplate(parentClassIndex));
+    if (attributeCount)
+        batchConfigureAttributes(instance, desc->PrototypeTemplate(),
+                                 attributes, attributeCount);
+    v8::Local<v8::Signature> defaultSignature = v8::Signature::New(desc);
+    if (callbackCount)
+        batchConfigureCallbacks(desc->PrototypeTemplate(),
+                                defaultSignature,
+                                static_cast<v8::PropertyAttribute>(v8::DontDelete),
+                                callbacks, callbackCount);
+    return defaultSignature;
+}
+
+void createCallback(v8::Local<v8::ObjectTemplate> proto,
+                    const char *name,
+                    v8::InvocationCallback callback,
+                    v8::Handle<v8::Signature> signature,
+                    v8::PropertyAttribute attribute)
+{
+    proto->Set(v8::String::New(name),
+               v8::FunctionTemplate::New(callback, v8::Handle<v8::Value>(), signature),
+               attribute);
+}
+    
+v8::Handle<v8::Value> getElementStringAttr(const v8::AccessorInfo& info,
+                                           const QualifiedName& name) 
+{
+    Element *imp = v8DOMWrapperToNode<Element>(info);
+    return v8ExternalString(imp->getAttribute(name));
+}
+
+void setElementStringAttr(const v8::AccessorInfo& info,
+                          const QualifiedName& name,
+                          v8::Local<v8::Value> value)
+{
+    Element* imp = v8DOMWrapperToNode<Element>(info);
+    AtomicString v = toAtomicWebCoreStringWithNullCheck(value);
+    imp->setAttribute(name, v);
+}
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index 237bc4d..de5bb4c 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -34,37 +34,107 @@
 #include "AtomicString.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
+#include "V8DOMWrapper.h"
+#include "V8Index.h"
 
 #include <v8.h>
 
 namespace WebCore {
+    
+    class EventListener;
+    class EventTarget;
+    
+    // A helper function extract native object pointer from a DOM wrapper
+    // and cast to the specified type.
+    void* v8DOMWrapperToNative(v8::Handle<v8::Object>);
+    
+    template <class C>
+    C* v8DOMWrapperTo(v8::Handle<v8::Object> object)
+    {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(object));
+    }
+    template <class C>
+    C* v8DOMWrapperToNode(v8::Handle<v8::Object> object)
+    {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        ASSERT(V8DOMWrapper::domWrapperType(object) == V8ClassIndex::NODE);
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(object));
+    }
+    
+    void* v8DOMWrapperToNative(const v8::AccessorInfo&);
+    
+    template <class C>
+    C* v8DOMWrapperTo(const v8::AccessorInfo& info) {
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+    }
+    template <class C>
+    C* v8DOMWrapperToNode(const v8::AccessorInfo& info) {
+        ASSERT(V8DOMWrapper::domWrapperType(info.Holder()) == V8ClassIndex::NODE);
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+    }
+    
+    template <class C>
+    C* v8DOMWrapperTo(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
+    {
+        // Native event listener is per frame, it cannot be handled by this generic function.
+        ASSERT(type != V8ClassIndex::EVENTLISTENER);
+        ASSERT(type != V8ClassIndex::EVENTTARGET);
+        
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(object));
+        
+#ifndef NDEBUG
+        const bool typeIsValid =
+#define MAKE_CASE(TYPE, NAME) (type != V8ClassIndex::TYPE) &&
+        DOM_NODE_TYPES(MAKE_CASE)
+#if ENABLE(SVG)
+        SVG_NODE_TYPES(MAKE_CASE)
+#endif
+#undef MAKE_CASE
+        true;
+        ASSERT(typeIsValid);
+#endif
+        
+        return v8DOMWrapperTo<C>(object);
+    }
+    
+    template <class C>
+    C* v8DOMWrapperTo(V8ClassIndex::V8WrapperType type, const v8::AccessorInfo& info)
+    {
+#ifndef NDEBUG
+        return v8DOMWrapperTo<C>(type, info.Holder());
+#else
+        return reinterpret_cast<C*>(v8DOMWrapperToNative(info));
+#endif
+    }
+
+    
+    enum ExternalMode {
+        Externalize,
+        DoNotExternalize
+    };
+    
+    template <typename StringType>
+    StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external);
 
     // Convert v8 types to a WebCore::String. If the V8 string is not already
     // an external string then it is transformed into an external string at this
     // point to avoid repeated conversions.
-    String v8StringToWebCoreString(v8::Handle<v8::String>);
-    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
-    inline String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+    inline String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
     {
-        if (value->IsString())
-            return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
-        return v8NonStringValueToWebCoreString(value);
+        return v8StringToWebCoreString<String>(v8String, Externalize);
     }
+    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
+    String v8ValueToWebCoreString(v8::Handle<v8::Value> value);
 
     // Convert v8 types to a WebCore::AtomicString.
-    AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String>);
-    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
-    inline AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
-    {
-        if (value->IsString())
-            return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
-        return v8NonStringValueToAtomicWebCoreString(value);
-    }
-
-    inline const String& toString(const String& string)
+    inline AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
     {
-        return string;
+        return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
     }
+    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
+    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value);
 
     // Return a V8 external string that shares the underlying buffer with the given
     // WebCore string. The reference counting mechanism is used to keep the
@@ -84,38 +154,7 @@ namespace WebCore {
 
     // Convert a value to a 32-bit integer.  The conversion fails if the
     // value cannot be converted to an integer or converts to nan or to an infinity.
-    inline int toInt32(v8::Handle<v8::Value> value, bool& ok)
-    {
-        ok = true;
-
-        // Fast case.  The value is already a 32-bit integer.
-        if (value->IsInt32())
-            return value->Int32Value();
-
-        // Can the value be converted to a number?
-        v8::Local<v8::Number> numberObject = value->ToNumber();
-        if (numberObject.IsEmpty()) {
-            ok = false;
-            return 0;
-        }
-
-        // Does the value convert to nan or to an infinity?
-        double numberValue = numberObject->Value();
-        if (isnan(numberValue) || isinf(numberValue)) {
-            ok = false;
-            return 0;
-        }
-
-        // Can the value be converted to a 32-bit integer?
-        v8::Local<v8::Int32> intValue = value->ToInt32();
-        if (intValue.IsEmpty()) {
-            ok = false;
-            return 0;
-        }
-
-        // Return the result of the int32 conversion.
-        return intValue->Value();
-    }
+    int toInt32(v8::Handle<v8::Value> value, bool& ok);
 
     // Convert a value to a 32-bit integer assuming the conversion cannot fail.
     inline int toInt32(v8::Handle<v8::Value> value)
@@ -134,6 +173,8 @@ namespace WebCore {
     {
         return v8ValueToWebCoreString(object);
     }
+    
+    String toWebCoreString(const v8::Arguments&, int index);
 
     // The string returned by this function is still owned by the argument
     // and will be deallocated when the argument is deallocated.
@@ -142,56 +183,78 @@ namespace WebCore {
         return reinterpret_cast<const uint16_t*>(str.characters());
     }
 
-    inline bool isUndefinedOrNull(v8::Handle<v8::Value> value)
-    {
-        return value->IsNull() || value->IsUndefined();
-    }
+    bool isUndefinedOrNull(v8::Handle<v8::Value> value);
 
-    inline v8::Handle<v8::Boolean> v8Boolean(bool value)
-    {
-        return value ? v8::True() : v8::False();
-    }
+    v8::Handle<v8::Boolean> v8Boolean(bool value);
 
-    inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull()) 
-            return String();
-        return v8ValueToWebCoreString(value);
-    }
+    String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
 
-    inline AtomicString v8ValueToAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull())
-            return AtomicString();
-        return v8ValueToAtomicWebCoreString(value);
-    }
+    AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
 
-    inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
-    {
-        if (value->IsNull() || value->IsUndefined())
-            return String();
-        return toWebCoreString(value);
-    }
+    String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value);
  
-    inline v8::Handle<v8::String> v8UndetectableString(const String& str)
-    {
-        return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
-    }
+    v8::Handle<v8::String> v8UndetectableString(const String& str);
 
-    inline v8::Handle<v8::Value> v8StringOrNull(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
-    }
+    v8::Handle<v8::Value> v8StringOrNull(const String& str);
 
-    inline v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
-    }
+    v8::Handle<v8::Value> v8StringOrUndefined(const String& str);
+
+    v8::Handle<v8::Value> v8StringOrFalse(const String& str);
+    
+    v8::Persistent<v8::FunctionTemplate> createRawTemplate();
+
+    struct BatchedAttribute;
+    struct BatchedCallback;
+    
+    v8::Local<v8::Signature> configureTemplate(v8::Persistent<v8::FunctionTemplate>,
+                                               const char *interfaceName,
+                                               V8ClassIndex::V8WrapperType parentClassIndex,
+                                               int fieldCount,
+                                               const BatchedAttribute*, 
+                                               size_t attributeCount,
+                                               const BatchedCallback*,
+                                               size_t callbackCount);
+    
+    void createCallback(v8::Local<v8::ObjectTemplate> proto,
+                        const char *name,
+                        v8::InvocationCallback,
+                        v8::Handle<v8::Signature>,
+                        v8::PropertyAttribute attributes = v8::DontDelete);
+    
+    v8::Handle<v8::Value> getElementStringAttr(const v8::AccessorInfo&,
+                                               const QualifiedName&);
+    void setElementStringAttr(const v8::AccessorInfo&,
+                              const QualifiedName&,
+                              v8::Local<v8::Value>);
+
+    v8::Handle<v8::Value> getElementEventHandlerAttr(const v8::AccessorInfo&,
+                                                     const AtomicString&);
+    
+    // V8Parameter is an adapter class that converts V8 values to Strings
+    // or AtomicStrings as appropriate, using multiple typecast operators.
+    enum V8ParameterMode {
+        DefaultMode,
+        WithNullCheck,
+        WithUndefinedOrNullCheck
+    };
+    template <V8ParameterMode MODE = DefaultMode>
+    class V8Parameter {
+    public:
+        V8Parameter (v8::Local<v8::Value> object) :m_v8Object(object) { }
+        operator String();
+        operator AtomicString();
+    private:
+        v8::Local<v8::Value> m_v8Object;
+    };
+    
+    template<> inline V8Parameter<DefaultMode>::operator String() { return toWebCoreString(m_v8Object); }
+    template<> inline V8Parameter<WithNullCheck>::operator String() { return toWebCoreStringWithNullCheck(m_v8Object); }
+    template<> inline V8Parameter<WithUndefinedOrNullCheck>::operator String() { return toWebCoreStringWithNullOrUndefinedCheck(m_v8Object); }
+
+    template<> inline V8Parameter<DefaultMode>::operator AtomicString() { return v8ValueToAtomicWebCoreString(m_v8Object); }
+    template<> inline V8Parameter<WithNullCheck>::operator AtomicString() { return toAtomicWebCoreStringWithNullCheck(m_v8Object); }
+    template<> inline V8Parameter<WithUndefinedOrNullCheck>::operator AtomicString() { return toAtomicWebCoreStringWithNullCheck(m_v8Object); }
 
-    inline v8::Handle<v8::Value> v8StringOrFalse(const String& str)
-    {
-        return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
-    }
 } // namespace WebCore
 
 #endif // V8Binding_h
diff --git a/WebCore/bindings/v8/V8Collection.h b/WebCore/bindings/v8/V8Collection.h
index e72dc07..0a4134e 100644
--- a/WebCore/bindings/v8/V8Collection.h
+++ b/WebCore/bindings/v8/V8Collection.h
@@ -177,6 +177,18 @@ namespace WebCore {
     }
 
 
+    // A template for indexed getters on collections of strings.
+    template<class Collection> static v8::Handle<v8::Value> collectionStringIndexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
+    {
+        // FIXME: assert that object must be a collection type
+        ASSERT(V8DOMWrapper::maybeDOMWrapper(info.Holder()));
+        V8ClassIndex::V8WrapperType wrapperType = V8DOMWrapper::domWrapperType(info.Holder());
+        Collection* collection = V8DOMWrapper::convertToNativeObject<Collection>(wrapperType, info.Holder());
+        String result = collection->item(index);
+        return v8String(result);
+    }
+
+
     // Add indexed getter to the function template for a collection.
     template<class Collection, class ItemType> static void setCollectionIndexedGetter(v8::Handle<v8::FunctionTemplate> desc, V8ClassIndex::V8WrapperType type)
     {
@@ -208,6 +220,13 @@ namespace WebCore {
         desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringOrNullIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
     }
 
+
+    // Add indexed getter returning a string to a function template for a collection.
+    template<class Collection> static void setCollectionStringIndexedGetter(v8::Handle<v8::FunctionTemplate> desc)
+    {
+        desc->InstanceTemplate()->SetIndexedPropertyHandler(collectionStringIndexedPropertyGetter<Collection>, 0, 0, 0, collectionIndexedPropertyEnumerator<Collection>);
+    }
+
     v8::Handle<v8::Value> toOptionsCollectionSetter(uint32_t index, v8::Handle<v8::Value>, HTMLSelectElement*);
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8DOMMap.cpp b/WebCore/bindings/v8/V8DOMMap.cpp
index 1bd68f7..acd88ec 100644
--- a/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/WebCore/bindings/v8/V8DOMMap.cpp
@@ -34,6 +34,7 @@
 #include "DOMData.h"
 #include "DOMDataStore.h"
 #include "DOMObjectsInclude.h"
+#include "MainThreadDOMData.h"
 #include "ScopedDOMDataStore.h"
 
 namespace WebCore {
@@ -47,33 +48,49 @@ DOMDataStoreHandle::~DOMDataStoreHandle()
 {
 }
 
+static bool fasterDOMStoreAccess = false;
+
+static inline DOMDataStore& getDOMDataStore()
+{
+    if (LIKELY(fasterDOMStoreAccess)) {
+        ASSERT(WTF::isMainThread());
+        return MainThreadDOMData::getCurrentMainThreadStore();
+    }
+
+    return DOMData::getCurrent()->getStore();
+}
+
+void enableFasterDOMStoreAccess()
+{
+    fasterDOMStoreAccess = true;
+}
+
 DOMWrapperMap<Node>& getDOMNodeMap()
 {
-    // Nodes only exist on the main thread.
-    return DOMData::getCurrentMainThread()->getStore().domNodeMap();
+    return getDOMDataStore().domNodeMap();
 }
 
 DOMWrapperMap<void>& getDOMObjectMap()
 {
-    return DOMData::getCurrent()->getStore().domObjectMap();
+    return getDOMDataStore().domObjectMap();
 }
 
 DOMWrapperMap<void>& getActiveDOMObjectMap()
 {
-    return DOMData::getCurrent()->getStore().activeDomObjectMap();
+    return getDOMDataStore().activeDomObjectMap();
 }
 
 #if ENABLE(SVG)
 
 DOMWrapperMap<SVGElementInstance>& getDOMSVGElementInstanceMap()
 {
-    return DOMData::getCurrent()->getStore().domSvgElementInstanceMap();
+    return getDOMDataStore().domSvgElementInstanceMap();
 }
 
 // Map of SVG objects with contexts to V8 objects
 DOMWrapperMap<void>& getDOMSVGObjectWithContextMap()
 {
-    return DOMData::getCurrent()->getStore().domSvgObjectWithContextMap();
+    return getDOMDataStore().domSvgObjectWithContextMap();
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/bindings/v8/V8DOMMap.h b/WebCore/bindings/v8/V8DOMMap.h
index 754ac3a..b6861d4 100644
--- a/WebCore/bindings/v8/V8DOMMap.h
+++ b/WebCore/bindings/v8/V8DOMMap.h
@@ -140,6 +140,8 @@ namespace WebCore {
     DOMWrapperMap<void>& getDOMSVGObjectWithContextMap();
     void visitDOMSVGObjectsInCurrentThread(DOMWrapperMap<void>::Visitor*);
 #endif
+
+    void enableFasterDOMStoreAccess();
 } // namespace WebCore
 
 #endif // V8DOMMap_h
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index 4e41a8c..7ecc29c 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -57,6 +57,8 @@
 #include "V8Index.h"
 #include "V8IsolatedWorld.h"
 #include "V8Proxy.h"
+#include "WebGLArray.h"
+#include "WebGLUniformLocation.h"
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
@@ -156,11 +158,64 @@ v8::Handle<v8::Value> V8DOMWrapper::convertSVGObjectWithContextToV8Object(V8Clas
 
 #endif
 
+#if ENABLE(3D_CANVAS)
+void V8DOMWrapper::setIndexedPropertiesToExternalArray(v8::Handle<v8::Object> wrapper,
+                                                       int index,
+                                                       void* address,
+                                                       int length)
+{
+    v8::ExternalArrayType array_type = v8::kExternalByteArray;
+    V8ClassIndex::V8WrapperType classIndex = V8ClassIndex::FromInt(index);
+    switch (classIndex) {
+    case V8ClassIndex::WEBGLBYTEARRAY:
+        array_type = v8::kExternalByteArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+        array_type = v8::kExternalUnsignedByteArray;
+        break;
+    case V8ClassIndex::WEBGLSHORTARRAY:
+        array_type = v8::kExternalShortArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+        array_type = v8::kExternalUnsignedShortArray;
+        break;
+    case V8ClassIndex::WEBGLINTARRAY:
+        array_type = v8::kExternalIntArray;
+        break;
+    case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+        array_type = v8::kExternalUnsignedIntArray;
+        break;
+    case V8ClassIndex::WEBGLFLOATARRAY:
+        array_type = v8::kExternalFloatArray;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    wrapper->SetIndexedPropertiesToExternalArrayData(address,
+                                                     array_type,
+                                                     length);
+}
+#endif
+
 bool V8DOMWrapper::domObjectHasJSWrapper(void* object)
 {
     return getDOMObjectMap().contains(object) || getActiveDOMObjectMap().contains(object);
 }
 
+v8::Persistent<v8::Object> V8DOMWrapper::jsWrapperForDOMObject(void* object)
+{
+    v8::Persistent<v8::Object> wrapper = getDOMObjectMap().get(object);
+    ASSERT(!wrapper.IsEmpty());
+    return wrapper;
+}
+
+v8::Persistent<v8::Object> V8DOMWrapper::jsWrapperForActiveDOMObject(void* object)
+{
+    v8::Persistent<v8::Object> wrapper = getActiveDOMObjectMap().get(object);
+    ASSERT(!wrapper.IsEmpty());
+    return wrapper;
+}
+
 // The caller must have increased obj's ref count.
 void V8DOMWrapper::setJSWrapperForDOMObject(void* object, v8::Persistent<v8::Object> wrapper)
 {
@@ -228,7 +283,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         // setter. Therefore, the interceptor has to be on the object
         // itself and not on the prototype object.
         descriptor->InstanceTemplate()->SetNamedPropertyHandler( USE_NAMED_PROPERTY_GETTER(CSSStyleDeclaration), USE_NAMED_PROPERTY_SETTER(CSSStyleDeclaration));
-        setCollectionStringOrNullIndexedGetter<CSSStyleDeclaration>(descriptor);
+        setCollectionStringIndexedGetter<CSSStyleDeclaration>(descriptor);
         break;
     case V8ClassIndex::CSSRULELIST:
         setCollectionIndexedGetter<CSSRuleList, CSSRule>(descriptor,  V8ClassIndex::CSSRULE);
@@ -237,7 +292,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         setCollectionIndexedGetter<CSSValueList, CSSValue>(descriptor, V8ClassIndex::CSSVALUE);
         break;
     case V8ClassIndex::CSSVARIABLESDECLARATION:
-        setCollectionStringOrNullIndexedGetter<CSSVariablesDeclaration>(descriptor);
+        setCollectionStringIndexedGetter<CSSVariablesDeclaration>(descriptor);
         break;
     case V8ClassIndex::WEBKITCSSTRANSFORMVALUE:
         setCollectionIndexedGetter<WebKitCSSTransformValue, CSSValue>(descriptor, V8ClassIndex::CSSVALUE);
@@ -319,10 +374,15 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::MIMETYPEARRAY:
         setCollectionIndexedAndNamedGetters<MimeTypeArray, MimeType>(descriptor, V8ClassIndex::MIMETYPE);
         break;
-    case V8ClassIndex::NAMEDNODEMAP:
-        descriptor->InstanceTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(NamedNodeMap));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(NamedNodeMap), 0, 0, 0, collectionIndexedPropertyEnumerator<NamedNodeMap>, v8::Integer::New(V8ClassIndex::NODE));
+    case V8ClassIndex::NAMEDNODEMAP: {
+        // We add an extra internal field to hold a reference to the owner node.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        ASSERT(instanceTemplate->InternalFieldCount() == V8Custom::kDefaultWrapperInternalFieldCount);
+        instanceTemplate->SetInternalFieldCount(V8Custom::kNamedNodeMapInternalFieldCount);
+        instanceTemplate->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(NamedNodeMap));
+        instanceTemplate->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(NamedNodeMap), 0, 0, 0, collectionIndexedPropertyEnumerator<NamedNodeMap>, v8::Integer::New(V8ClassIndex::NODE));
         break;
+    }
 #if ENABLE(DOM_STORAGE)
     case V8ClassIndex::STORAGE:
         descriptor->InstanceTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(Storage), USE_NAMED_PROPERTY_SETTER(Storage), 0, USE_NAMED_PROPERTY_DELETER(Storage), V8Custom::v8StorageNamedPropertyEnumerator);
@@ -474,36 +534,29 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
 
 #if ENABLE(3D_CANVAS)
     // The following objects are created from JavaScript.
-    case V8ClassIndex::CANVASARRAYBUFFER:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasArrayBufferConstructor));
+    case V8ClassIndex::WEBGLARRAYBUFFER:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLArrayBufferConstructor));
         break;
-    case V8ClassIndex::CANVASBYTEARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasByteArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasByteArray));
+    case V8ClassIndex::WEBGLBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLByteArrayConstructor));
         break;
-    case V8ClassIndex::CANVASFLOATARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasFloatArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasFloatArray), USE_INDEXED_PROPERTY_SETTER(CanvasFloatArray));
+    case V8ClassIndex::WEBGLFLOATARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLFloatArrayConstructor));
         break;
-    case V8ClassIndex::CANVASINTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasIntArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasIntArray));
+    case V8ClassIndex::WEBGLINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLIntArrayConstructor));
         break;
-    case V8ClassIndex::CANVASSHORTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasShortArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasShortArray));
+    case V8ClassIndex::WEBGLSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLShortArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDBYTEARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedByteArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray));
+    case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedByteArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDINTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedIntArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray));
+    case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedIntArrayConstructor));
         break;
-    case V8ClassIndex::CANVASUNSIGNEDSHORTARRAY:
-        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedShortArrayConstructor));
-        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray));
+    case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(WebGLUnsignedShortArrayConstructor));
         break;
 #endif
     case V8ClassIndex::DOMPARSER:
@@ -670,6 +723,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
         return convertStyleSheetToV8Object(static_cast<StyleSheet*>(impl));
     case V8ClassIndex::DOMWINDOW:
         return convertWindowToV8Object(static_cast<DOMWindow*>(impl));
+    case V8ClassIndex::NAMEDNODEMAP:
+        return convertNamedNodeMapToV8Object(static_cast<NamedNodeMap*>(impl));
 #if ENABLE(SVG)
         SVG_NONNODE_TYPES(MAKE_CASE)
         if (type == V8ClassIndex::SVGELEMENTINSTANCE)
@@ -692,6 +747,27 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
     // Non DOM node
     v8::Persistent<v8::Object> result = isActiveDomObject ? getActiveDOMObjectMap().get(impl) : getDOMObjectMap().get(impl);
     if (result.IsEmpty()) {
+#if ENABLE(3D_CANVAS)
+        if (type == V8ClassIndex::WEBGLARRAY && impl) {
+            // Determine which subclass we are wrapping.
+            WebGLArray* array = reinterpret_cast<WebGLArray*>(impl);
+            if (array->isByteArray())
+                type = V8ClassIndex::WEBGLBYTEARRAY;
+            else if (array->isFloatArray())
+                type = V8ClassIndex::WEBGLFLOATARRAY;
+            else if (array->isIntArray())
+                type = V8ClassIndex::WEBGLINTARRAY;
+            else if (array->isShortArray())
+                type = V8ClassIndex::WEBGLSHORTARRAY;
+            else if (array->isUnsignedByteArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY;
+            else if (array->isUnsignedIntArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDINTARRAY;
+            else if (array->isUnsignedShortArray())
+                type = V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY;
+        }
+#endif
+
         v8::Local<v8::Object> v8Object = instantiateV8Object(type, type, impl);
         if (!v8Object.IsEmpty()) {
             // Go through big switch statement, it has some duplications
@@ -715,6 +791,28 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
                 result->SetIndexedPropertiesToPixelData(pixels->data()->data(), pixels->length());
             }
 
+#if ENABLE(3D_CANVAS)
+            // Set up WebGLArray subclasses' accesses similarly.
+            switch (type) {
+            case V8ClassIndex::WEBGLBYTEARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY:
+            case V8ClassIndex::WEBGLSHORTARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY:
+            case V8ClassIndex::WEBGLINTARRAY:
+            case V8ClassIndex::WEBGLUNSIGNEDINTARRAY:
+            case V8ClassIndex::WEBGLFLOATARRAY: {
+                WebGLArray* array = reinterpret_cast<WebGLArray*>(impl);
+                setIndexedPropertiesToExternalArray(result,
+                                                    V8ClassIndex::ToInt(type),
+                                                    array->baseAddress(),
+                                                    array->length());
+                break;
+            }
+            default:
+                break;
+            }
+#endif
+
             // Special case for non-node objects associated with a
             // DOMWindow. Both Safari and FF let the JS wrappers for these
             // objects survive GC. To mimic their behavior, V8 creates
@@ -849,13 +947,6 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, V8ClassI
     return instance;
 }
 
-void V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object> object, int type, void* cptr)
-{
-    ASSERT(object->InternalFieldCount() >= 2);
-    object->SetPointerInInternalField(V8Custom::kDOMWrapperObjectIndex, cptr);
-    object->SetInternalField(V8Custom::kDOMWrapperTypeIndex, v8::Integer::New(type));
-}
-
 #ifndef NDEBUG
 bool V8DOMWrapper::maybeDOMWrapper(v8::Handle<v8::Value> value)
 {
@@ -1034,7 +1125,7 @@ V8ClassIndex::V8WrapperType V8DOMWrapper::htmlElementType(HTMLElement* element)
 #define FOR_EACH_ANIMATION_TAG(macro)
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #define FOR_EACH_FILTERS_TAG(macro) \
     macro(feBlend, FEBLEND) \
     macro(feColorMatrix, FECOLORMATRIX) \
@@ -1179,6 +1270,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventToV8Object(Event* event)
         else if (event->isSVGZoomEvent())
             type = V8ClassIndex::SVGZOOMEVENT;
 #endif
+        else if (event->isCompositionEvent())
+            type = V8ClassIndex::COMPOSITIONEVENT;
         else
             type = V8ClassIndex::UIEVENT;
     } else if (event->isMutationEvent())
@@ -1260,6 +1353,23 @@ v8::Handle<v8::Value> V8DOMWrapper::convertDocumentToV8Object(Document* document
     return wrapper;
 }
 
+v8::Handle<v8::Value> V8DOMWrapper::convertNodeToV8Object(Node* node)
+{
+    if (!node)
+        return v8::Null();
+    
+    Document* document = node->document();
+    if (node == document)
+        return convertDocumentToV8Object(document);
+    
+    DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
+    v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
+    if (wrapper.IsEmpty())
+        return convertNewNodeToV8Object(node, 0, domNodeMap);
+    
+    return wrapper;
+}
+    
 // Caller checks node is not null.
 v8::Handle<v8::Value> V8DOMWrapper::convertNewNodeToV8Object(Node* node, V8Proxy* proxy, DOMWrapperMap<Node>& domNodeMap)
 {
@@ -1358,6 +1468,12 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 #endif // WORKERS
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorker* sharedWorker = target->toSharedWorker();
+    if (sharedWorker)
+        return convertToV8Object(V8ClassIndex::SHAREDWORKER, sharedWorker);
+#endif // SHARED_WORKERS
+
 #if ENABLE(NOTIFICATIONS)
     Notification* notification = target->toNotification();
     if (notification)
@@ -1422,30 +1538,23 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(ScriptExecuti
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    ScriptExecutionContext* context = node->scriptExecutionContext();
-    if (!context)
-        return 0;
-
-    V8Proxy* proxy = V8Proxy::retrieve(context);
-    // The document might be created using createDocument, which does
-    // not have a frame, use the active frame.
-    if (!proxy)
-        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
-
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if ENABLE(SVG)
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
     return getEventListener(element->correspondingElement(), value, isAttribute, lookup);
 }
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8DOMWrapper.cpp
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
@@ -1455,11 +1564,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker,
         return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
     }
 
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
 #if ENABLE(NOTIFICATIONS)
@@ -1471,11 +1576,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Notification* notificat
         return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
     }
 
-    V8Proxy* proxy = V8Proxy::retrieve(notification->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 #endif
 
@@ -1495,9 +1596,8 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(XMLHttpRequestUpload* u
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    V8Proxy* proxy = V8Proxy::retrieve(eventTarget->scriptExecutionContext());
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
+    if (V8Proxy::retrieve(eventTarget->scriptExecutionContext()))
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 
 #if ENABLE(WORKERS)
     WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
@@ -1510,10 +1610,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarge
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
-    if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
-
-    return 0;
+    return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(value, isAttribute);
 }
 
 v8::Handle<v8::Value> V8DOMWrapper::convertDOMImplementationToV8Object(DOMImplementation* impl)
@@ -1679,4 +1776,30 @@ v8::Handle<v8::Value> V8DOMWrapper::convertWindowToV8Object(DOMWindow* window)
     return global;
 }
 
+v8::Handle<v8::Value> V8DOMWrapper::convertNamedNodeMapToV8Object(NamedNodeMap* map)
+{
+    if (!map)
+        return v8::Null();
+
+    v8::Handle<v8::Object> wrapper = getDOMObjectMap().get(map);
+    if (!wrapper.IsEmpty())
+        return wrapper;
+
+    v8::Handle<v8::Object> result = instantiateV8Object(V8ClassIndex::NAMEDNODEMAP, V8ClassIndex::NAMEDNODEMAP, map);
+    if (result.IsEmpty())
+        return result;
+
+    // Only update the DOM object map if the result is non-empty.
+    map->ref();
+    setJSWrapperForDOMObject(map, v8::Persistent<v8::Object>::New(result));
+
+    // Add a hidden reference from named node map to its owner node.
+    if (Element* element = map->element()) {
+        v8::Handle<v8::Object> owner = v8::Handle<v8::Object>::Cast(convertNodeToV8Object(element));
+        result->SetInternalField(V8Custom::kNamedNodeMapOwnerNodeIndex, owner);
+    }
+
+    return result;
+}
+
 }  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8DOMWrapper.h b/WebCore/bindings/v8/V8DOMWrapper.h
index 3d50af3..660b827 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/WebCore/bindings/v8/V8DOMWrapper.h
@@ -109,7 +109,12 @@ namespace WebCore {
 #endif
 
         // Sets contents of a DOM wrapper.
-        static void setDOMWrapper(v8::Handle<v8::Object>, int type, void* ptr);
+        static void setDOMWrapper(v8::Handle<v8::Object> object, int type, void* cptr)
+        {
+            ASSERT(object->InternalFieldCount() >= 2);
+            object->SetPointerInInternalField(V8Custom::kDOMWrapperObjectIndex, cptr);
+            object->SetInternalField(V8Custom::kDOMWrapperTypeIndex, v8::Integer::New(type));
+        }
 
         static v8::Handle<v8::Object> lookupDOMWrapper(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
         {
@@ -147,22 +152,7 @@ namespace WebCore {
             return convertNodeToV8Object(node.get());
         }
 
-        static v8::Handle<v8::Value> convertNodeToV8Object(Node* node)
-        {
-            if (!node)
-                return v8::Null();
-
-            Document* document = node->document();
-            if (node == document)
-                return convertDocumentToV8Object(document);
-
-            DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
-            v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
-            if (wrapper.IsEmpty())
-                return convertNewNodeToV8Object(node, 0, domNodeMap);
-
-            return wrapper;
-        }
+        static v8::Handle<v8::Value> convertNodeToV8Object(Node*);
 
         static v8::Handle<v8::Value> convertDocumentToV8Object(Document*);
 
@@ -256,13 +246,13 @@ namespace WebCore {
 // TODO: upstream XPATH guard.
 #if ENABLE(XPATH)
         // XPath-related utilities
-        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value)
+        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value, V8Proxy* proxy = 0)
         {
             RefPtr<XPathNSResolver> resolver;
             if (V8XPathNSResolver::HasInstance(value))
                 resolver = convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(value));
             else if (value->IsObject())
-                resolver = V8CustomXPathNSResolver::create(value->ToObject());
+                resolver = V8CustomXPathNSResolver::create(proxy, value->ToObject());
             return resolver;
         }
 #endif
@@ -284,6 +274,10 @@ namespace WebCore {
 
         // Checks whether a DOM object has a JS wrapper.
         static bool domObjectHasJSWrapper(void*);
+        // Get JS wrapper of an existing DOM object, assuming that the wrapper
+        // exists.
+        static v8::Persistent<v8::Object> jsWrapperForDOMObject(void*);
+        static v8::Persistent<v8::Object> jsWrapperForActiveDOMObject(void*);
         // Set JS wrapper of a DOM object, the caller in charge of increase ref.
         static void setJSWrapperForDOMObject(void*, v8::Persistent<v8::Object>);
         static void setJSWrapperForActiveDOMObject(void*, v8::Persistent<v8::Object>);
@@ -303,12 +297,20 @@ namespace WebCore {
         // Returns the JS wrapper of a window object, initializes the environment
         // of the window frame if needed.
         static v8::Handle<v8::Value> convertWindowToV8Object(DOMWindow*);
+        static v8::Handle<v8::Value> convertNamedNodeMapToV8Object(NamedNodeMap*);
 
 #if ENABLE(SVG)
         static v8::Handle<v8::Value> convertSVGElementInstanceToV8Object(SVGElementInstance*);
         static v8::Handle<v8::Value> convertSVGObjectWithContextToV8Object(V8ClassIndex::V8WrapperType, void*);
 #endif
 
+#if ENABLE(3D_CANVAS)
+        static void setIndexedPropertiesToExternalArray(v8::Handle<v8::Object>,
+                                                        int,
+                                                        void*,
+                                                        int);
+#endif
+
     private:
         // Set hidden references in a DOMWindow object of a frame.
         static void setHiddenWindowReference(Frame*, const int internalIndex, v8::Handle<v8::Object>);
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
index 29b4874..fdf211d 100644
--- a/WebCore/bindings/v8/V8EventListenerList.h
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -31,15 +31,14 @@
 #ifndef V8EventListenerList_h
 #define V8EventListenerList_h
 
-#include <v8.h>
-
-#include "PassRefPtr.h"
 #include "V8CustomEventListener.h"
 #include "V8HiddenPropertyName.h"
 
+#include <v8.h>
+#include <wtf/PassRefPtr.h>
+
 namespace WebCore {
     class Frame;
-    class V8EventListener;
 
     // This is a container for V8EventListener objects that uses hidden properties of v8::Object to speed up lookups.
     class V8EventListenerList {
@@ -55,7 +54,7 @@ namespace WebCore {
         }
 
         template<typename WrapperType>
-        static PassRefPtr<V8EventListener> findOrCreateWrapper(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
+        static PassRefPtr<V8EventListener> findOrCreateWrapper(v8::Local<v8::Value>, bool isAttribute);
 
         static void clearWrapper(v8::Handle<v8::Object> listenerObject, bool isAttribute)
         {
@@ -81,7 +80,7 @@ namespace WebCore {
     };
 
     template<typename WrapperType>
-    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
+    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(v8::Local<v8::Value> value, bool isAttribute)
     {
         ASSERT(v8::Context::InContext());
         if (!value->IsObject())
@@ -94,7 +93,7 @@ namespace WebCore {
         if (wrapper)
             return wrapper;
 
-        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(guard, object, isAttribute);
+        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(object, isAttribute, WorldContextHandle(UseCurrentWorld));
         if (wrapperPtr)
             object->SetHiddenValue(wrapperProperty, v8::External::Wrap(wrapperPtr.get()));
 
diff --git a/WebCore/bindings/v8/V8GCController.cpp b/WebCore/bindings/v8/V8GCController.cpp
index 242954c..e08cf66 100644
--- a/WebCore/bindings/v8/V8GCController.cpp
+++ b/WebCore/bindings/v8/V8GCController.cpp
@@ -204,35 +204,11 @@ public:
     // has the drawback that the wrappers are "entangled/unentangled" for each
     // GC even though their entaglement most likely is still the same.
     if (type == V8ClassIndex::MESSAGEPORT) {
-        // Get the port and its entangled port.
+        // Mark each port as in-use if it's entangled. For simplicity's sake, we assume all ports are remotely entangled,
+        // since the Chromium port implementation can't tell the difference.
         MessagePort* port1 = static_cast<MessagePort*>(object);
-        MessagePort* port2 = port1->locallyEntangledPort();
-
-        // If we are remotely entangled, then mark this object as reachable
-        // (we can't determine reachability directly as the remote object is
-        // out-of-proc).
-        if (port1->isEntangled() && !port2)
+        if (port1->isEntangled())
             wrapper.ClearWeak();
-
-        if (port2) {
-            // As ports are always entangled in pairs only perform the entanglement
-            // once for each pair (see ASSERT in MessagePort::unentangle()).
-            if (port1 < port2) {
-                v8::Handle<v8::Value> port1Wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port1);
-                v8::Handle<v8::Value> port2Wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port2);
-                ASSERT(port1Wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(port1Wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, port2Wrapper);
-                ASSERT(port2Wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(port2Wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, port1Wrapper);
-            }
-        } else {
-            // Remove the wrapper entanglement when a port is not entangled.
-            if (V8DOMWrapper::domObjectHasJSWrapper(port1)) {
-                v8::Handle<v8::Value> wrapper = V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, port1);
-                ASSERT(wrapper->IsObject());
-                v8::Handle<v8::Object>::Cast(wrapper)->SetInternalField(V8Custom::kMessagePortEntangledPortIndex, v8::Undefined());
-            }
-        }
     }
 }
 };
@@ -296,14 +272,21 @@ public:
             groupId = reinterpret_cast<uintptr_t>(node->document());
         else {
             Node* root = node;
-            while (root->parent())
-                root = root->parent();
-
-            // If the node is alone in its DOM tree (doesn't have a parent or any
-            // children) then the group will be filtered out later anyway.
-            if (root == node && !node->hasChildNodes())
-                return;
-
+            if (node->isAttributeNode()) {
+                root = static_cast<Attr*>(node)->ownerElement();
+                // If the attribute has no element, no need to put it in the group,
+                // because it'll always be a group of 1.
+                if (!root)
+                    return;
+            } else {
+                while (root->parent())
+                    root = root->parent();
+
+                // If the node is alone in its DOM tree (doesn't have a parent or any
+                // children) then the group will be filtered out later anyway.
+                if (root == node && !node->hasChildNodes() && !node->hasAttributes())
+                    return;
+            }
             groupId = reinterpret_cast<uintptr_t>(root);
         }
         m_grouper.append(GrouperItem(groupId, node, wrapper));
@@ -419,17 +402,30 @@ ACTIVE_DOM_OBJECT_TYPES(MAKE_CASE)
 
         if (type == V8ClassIndex::MESSAGEPORT) {
             MessagePort* port1 = static_cast<MessagePort*>(object);
-            MessagePort* port2 = port1->locallyEntangledPort();
-            if (port1->isEntangled() && !port2) {
-                // We marked this port as reachable in GCPrologueVisitor.  Undo this now since the
-                // port could be not reachable in the future if it gets disentangled (and also
-                // GCPrologueVisitor expects to see all handles marked as weak).
+            // We marked this port as reachable in GCPrologueVisitor.  Undo this now since the
+            // port could be not reachable in the future if it gets disentangled (and also
+            // GCPrologueVisitor expects to see all handles marked as weak).
+            if (!wrapper.IsWeak() && !wrapper.IsNearDeath())
                 wrapper.MakeWeak(port1, &DOMDataStore::weakActiveDOMObjectCallback);
-            }
         }
     }
 };
 
+int V8GCController::workingSetEstimateMB = 0;
+
+namespace {
+
+int getMemoryUsageInMB()
+{
+#if PLATFORM(CHROMIUM)
+    return ChromiumBridge::memoryUsageMB();
+#else
+    return 0;
+#endif
+}
+
+}  // anonymous namespace
+
 void V8GCController::gcEpilogue()
 {
     v8::HandleScope scope;
@@ -439,6 +435,8 @@ void V8GCController::gcEpilogue()
     GCEpilogueVisitor epilogueVisitor;
     visitActiveDOMObjectsInCurrentThread(&epilogueVisitor);
 
+    workingSetEstimateMB = getMemoryUsageInMB();
+
 #ifndef NDEBUG
     // Check all survivals are weak.
     DOMObjectVisitor domObjectVisitor;
@@ -452,4 +450,19 @@ void V8GCController::gcEpilogue()
 #endif
 }
 
+void V8GCController::checkMemoryUsage()
+{
+#if PLATFORM(CHROMIUM)
+    // These values are appropriate for Chromium only.
+    const int lowUsageMB = 256;  // If memory usage is below this threshold, do not bother forcing GC.
+    const int highUsageMB = 1024;  // If memory usage is above this threshold, force GC more aggresively.
+    const int highUsageDeltaMB = 128;  // Delta of memory usage growth (vs. last workingSetEstimateMB) to force GC when memory usage is high.
+
+    int memoryUsageMB = getMemoryUsageInMB();
+    if ((memoryUsageMB > lowUsageMB && memoryUsageMB > 2 * workingSetEstimateMB) || (memoryUsageMB > highUsageMB && memoryUsageMB > workingSetEstimateMB + highUsageDeltaMB))
+        v8::V8::LowMemoryNotification();
+#endif
+}
+
+
 }  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8GCController.h b/WebCore/bindings/v8/V8GCController.h
index 7441bf0..484be24 100644
--- a/WebCore/bindings/v8/V8GCController.h
+++ b/WebCore/bindings/v8/V8GCController.h
@@ -78,6 +78,12 @@ namespace WebCore {
 
         static void gcPrologue();
         static void gcEpilogue();
+
+        static void checkMemoryUsage();
+
+    private:
+        // Estimate of current working set.
+        static int workingSetEstimateMB;
     };
 
 }
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.h b/WebCore/bindings/v8/V8HiddenPropertyName.h
index 5ef89cb..bb1ca4c 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
 #define V8_HIDDEN_PROPERTIES(V) \
     V(objectPrototype) \
-    V(isolatedWorld) \
     V(listener) \
     V(attributeListener) \
     V(sleepFunction) \
diff --git a/WebCore/bindings/v8/V8Index.cpp b/WebCore/bindings/v8/V8Index.cpp
index c6369dd..7acaf89 100644
--- a/WebCore/bindings/v8/V8Index.cpp
+++ b/WebCore/bindings/v8/V8Index.cpp
@@ -34,7 +34,7 @@
 #include "V8Attr.h"
 #include "V8BarInfo.h"
 #include "V8BeforeLoadEvent.h"
-#include "V8CanvasActiveInfo.h"
+#include "V8WebGLActiveInfo.h"
 #include "V8CanvasRenderingContext.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CanvasGradient.h"
@@ -46,6 +46,7 @@
 #include "V8ClientRectList.h"
 #include "V8Clipboard.h"
 #include "V8Comment.h"
+#include "V8CompositionEvent.h"
 #include "V8Console.h"
 #include "V8Counter.h"
 #include "V8CSSStyleDeclaration.h"
@@ -219,7 +220,7 @@
 #include "V8SVGSetElement.h"
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #include "V8SVGComponentTransferFunctionElement.h"
 #include "V8SVGFEBlendElement.h"
 #include "V8SVGFEColorMatrixElement.h"
@@ -237,6 +238,7 @@
 #include "V8SVGFEImageElement.h"
 #include "V8SVGFEMergeElement.h"
 #include "V8SVGFEMergeNodeElement.h"
+#include "V8SVGFEMorphologyElement.h"
 #include "V8SVGFEOffsetElement.h"
 #include "V8SVGFEPointLightElement.h"
 #include "V8SVGFESpecularLightingElement.h"
@@ -393,22 +395,23 @@
 #endif
 
 #if ENABLE(3D_CANVAS)
-#include "V8CanvasRenderingContext3D.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArray.h"
-#include "V8CanvasByteArray.h"
-#include "V8CanvasBuffer.h"
-#include "V8CanvasFloatArray.h"
-#include "V8CanvasFramebuffer.h"
-#include "V8CanvasIntArray.h"
-#include "V8CanvasProgram.h"
-#include "V8CanvasRenderbuffer.h"
-#include "V8CanvasShader.h"
-#include "V8CanvasShortArray.h"
-#include "V8CanvasTexture.h"
-#include "V8CanvasUnsignedByteArray.h"
-#include "V8CanvasUnsignedIntArray.h"
-#include "V8CanvasUnsignedShortArray.h"
+#include "V8WebGLRenderingContext.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArray.h"
+#include "V8WebGLByteArray.h"
+#include "V8WebGLBuffer.h"
+#include "V8WebGLFloatArray.h"
+#include "V8WebGLFramebuffer.h"
+#include "V8WebGLIntArray.h"
+#include "V8WebGLProgram.h"
+#include "V8WebGLRenderbuffer.h"
+#include "V8WebGLShader.h"
+#include "V8WebGLShortArray.h"
+#include "V8WebGLTexture.h"
+#include "V8WebGLUniformLocation.h"
+#include "V8WebGLUnsignedByteArray.h"
+#include "V8WebGLUnsignedIntArray.h"
+#include "V8WebGLUnsignedShortArray.h"
 #endif
 
 #if ENABLE(DATABASE)
@@ -432,7 +435,9 @@
 #endif
 
 #if ENABLE(INSPECTOR)
+#include "V8InjectedScriptHost.h"
 #include "V8InspectorBackend.h"
+#include "V8InspectorFrontendHost.h"
 #endif
 
 // Geolocation
@@ -441,6 +446,7 @@
 #include "V8Geoposition.h"
 #include "V8PositionError.h"
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.cpp
 #if PLATFORM(ANDROID)
 // TODO: Upstream these guards to webkit.org
 #if ENABLE(TOUCH_EVENTS)
@@ -452,6 +458,8 @@
 #include "V8VoidCallback.h"
 #endif  // PLATFORM(ANDROID)
 
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.cpp
 namespace WebCore {
 
 FunctionTemplateFactory V8ClassIndex::GetFactory(V8WrapperType type)
diff --git a/WebCore/bindings/v8/V8Index.h b/WebCore/bindings/v8/V8Index.h
index fb53948..6184f5a 100644
--- a/WebCore/bindings/v8/V8Index.h
+++ b/WebCore/bindings/v8/V8Index.h
@@ -197,7 +197,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define SVG_ANIMATION_ELEMENT_TYPES(V)
 #endif
 
-#if ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 #define SVG_FILTERS_ELEMENT_TYPES(V)                                    \
     V(SVGCOMPONENTTRANSFERFUNCTIONELEMENT, SVGComponentTransferFunctionElement)\
     V(SVGFEBLENDELEMENT, SVGFEBlendElement)                             \
@@ -216,6 +216,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(SVGFEIMAGEELEMENT, SVGFEImageElement)                             \
     V(SVGFEMERGEELEMENT, SVGFEMergeElement)                             \
     V(SVGFEMERGENODEELEMENT, SVGFEMergeNodeElement)                     \
+    V(SVGFEMORPHOLOGYELEMENT, SVGFEMorphologyElement)                   \
     V(SVGFEOFFSETELEMENT, SVGFEOffsetElement)                           \
     V(SVGFEPOINTLIGHTELEMENT, SVGFEPointLightElement)                   \
     V(SVGFESPECULARLIGHTINGELEMENT, SVGFESpecularLightingElement)       \
@@ -332,6 +333,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(CLIENTRECTLIST, ClientRectList)                                   \
     V(CLIPBOARD, Clipboard)                                             \
     V(CONSOLE, Console)                                                 \
+    V(COMPOSITIONEVENT, CompositionEvent)                               \
     V(COUNTER, Counter)                                                 \
     V(CSSCHARSETRULE, CSSCharsetRule)                                   \
     V(CSSFONTFACERULE, CSSFontFaceRule)                                 \
@@ -445,23 +447,24 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(3D_CANVAS)
 #define DOM_OBJECT_3D_CANVAS_TYPES(V)                                   \
-    V(CANVASACTIVEINFO, CanvasActiveInfo)                               \
-    V(CANVASARRAY, CanvasArray)                                         \
-    V(CANVASARRAYBUFFER, CanvasArrayBuffer)                             \
-    V(CANVASBUFFER, CanvasBuffer)                                       \
-    V(CANVASBYTEARRAY, CanvasByteArray)                                 \
-    V(CANVASFLOATARRAY, CanvasFloatArray)                               \
-    V(CANVASFRAMEBUFFER, CanvasFramebuffer)                             \
-    V(CANVASINTARRAY, CanvasIntArray)                                   \
-    V(CANVASPROGRAM, CanvasProgram)                                     \
-    V(CANVASRENDERBUFFER, CanvasRenderbuffer)                           \
-    V(CANVASRENDERINGCONTEXT3D, CanvasRenderingContext3D)               \
-    V(CANVASSHADER, CanvasShader)                                       \
-    V(CANVASSHORTARRAY, CanvasShortArray)                               \
-    V(CANVASTEXTURE, CanvasTexture)                                     \
-    V(CANVASUNSIGNEDBYTEARRAY, CanvasUnsignedByteArray)                 \
-    V(CANVASUNSIGNEDINTARRAY, CanvasUnsignedIntArray)                   \
-    V(CANVASUNSIGNEDSHORTARRAY, CanvasUnsignedShortArray)
+    V(WEBGLACTIVEINFO, WebGLActiveInfo)                                 \
+    V(WEBGLARRAY, WebGLArray)                                           \
+    V(WEBGLARRAYBUFFER, WebGLArrayBuffer)                               \
+    V(WEBGLBUFFER, WebGLBuffer)                                         \
+    V(WEBGLBYTEARRAY, WebGLByteArray)                                   \
+    V(WEBGLFLOATARRAY, WebGLFloatArray)                                 \
+    V(WEBGLFRAMEBUFFER, WebGLFramebuffer)                               \
+    V(WEBGLINTARRAY, WebGLIntArray)                                     \
+    V(WEBGLPROGRAM, WebGLProgram)                                       \
+    V(WEBGLRENDERBUFFER, WebGLRenderbuffer)                             \
+    V(WEBGLRENDERINGCONTEXT, WebGLRenderingContext)                     \
+    V(WEBGLSHADER, WebGLShader)                                         \
+    V(WEBGLSHORTARRAY, WebGLShortArray)                                 \
+    V(WEBGLTEXTURE, WebGLTexture)                                       \
+    V(WEBGLUNIFORMLOCATION, WebGLUniformLocation)                       \
+    V(WEBGLUNSIGNEDBYTEARRAY, WebGLUnsignedByteArray)                   \
+    V(WEBGLUNSIGNEDINTARRAY, WebGLUnsignedIntArray)                     \
+    V(WEBGLUNSIGNEDSHORTARRAY, WebGLUnsignedShortArray)
 #else
 #define DOM_OBJECT_3D_CANVAS_TYPES(V)
 #endif
@@ -486,7 +489,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(INSPECTOR)
 #define DOM_OBJECT_INSPECTOR_TYPES(V)                                   \
-    V(INSPECTORBACKEND, InspectorBackend)
+    V(INSPECTORBACKEND, InspectorBackend)                               \
+    V(INSPECTORFRONTENDHOST, InspectorFrontendHost)                     \
+    V(INJECTEDSCRIPTHOST, InjectedScriptHost)
 #else
 #define DOM_OBJECT_INSPECTOR_TYPES(V)
 #endif
@@ -497,6 +502,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(GEOPOSITION, Geoposition)                                         \
     V(POSITIONERROR, PositionError)
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if PLATFORM(ANDROID)
 // TODO: Upstream this guard.
 #if ENABLE(TOUCH_EVENTS)
@@ -518,6 +524,8 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if PLATFORM(ANDROID)
 // This block is modified, but is not Android-specific.
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_TYPES(V)                                             \
     DOM_OBJECT_TYPES_1(V)                                               \
     DOM_OBJECT_TYPES_2(V)                                               \
@@ -528,10 +536,14 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     DOM_OBJECT_XPATH_TYPES(V)                                           \
     DOM_OBJECT_XSLT_TYPES(V)                                            \
     DOM_OBJECT_INSPECTOR_TYPES(V)                                       \
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_GEOLOCATION_TYPES(V)                                     \
     DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                     \
     DOM_OBJECT_VOIDCALLBACK_TYPES(V)
 #endif
+=======
+    DOM_OBJECT_GEOLOCATION_TYPES(V)
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Index.h
 
 #if ENABLE(SVG)
 // SVG_OBJECT_TYPES are svg non-node, non-pod types.
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.cpp b/WebCore/bindings/v8/V8IsolatedWorld.cpp
index d4e4f52..cb65097 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.cpp
+++ b/WebCore/bindings/v8/V8IsolatedWorld.cpp
@@ -58,11 +58,13 @@ V8IsolatedWorld::V8IsolatedWorld(V8Proxy* proxy, int extensionGroup)
 
     v8::HandleScope scope;
     m_context = SharedPersistent<v8::Context>::create(proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup));
+    if (m_context->get().IsEmpty())
+        return;
 
     // Run code in the new context.
     v8::Context::Scope context_scope(m_context->get());
 
-    m_context->get()->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
+    getGlobalObject(m_context->get())->SetPointerInInternalField(V8Custom::kDOMWindowEnteredIsolatedWorldIndex, this);
 
     V8Proxy::installHiddenObjectPrototype(m_context->get());
     proxy->installDOMWindow(m_context->get(), proxy->frame()->domWindow());
@@ -89,17 +91,4 @@ V8IsolatedWorld::~V8IsolatedWorld()
     m_context->disposeHandle();
 }
 
-V8IsolatedWorld* V8IsolatedWorld::getEnteredImpl()
-{
-    if (!v8::Context::InContext())
-        return 0;
-    v8::HandleScope scope;
-
-    v8::Local<v8::Value> world = v8::Context::GetEntered()->Global()->GetHiddenValue(V8HiddenPropertyName::isolatedWorld());
-    if (world.IsEmpty())
-        return 0;
-
-    return static_cast<V8IsolatedWorld*>(v8::External::Unwrap(world));
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.h b/WebCore/bindings/v8/V8IsolatedWorld.h
index 663f4bd..6313da8 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.h
+++ b/WebCore/bindings/v8/V8IsolatedWorld.h
@@ -61,6 +61,7 @@ namespace WebCore {
         // Creates an isolated world. To destroy it, call destroy().
         // This will delete the isolated world when the context it owns is GC'd.
         V8IsolatedWorld(V8Proxy* proxy, int extensionGroup);
+        ~V8IsolatedWorld();
 
         // Call this to destroy the isolated world. It will be deleted sometime
         // after this call, once all script references to the world's context
@@ -84,7 +85,9 @@ namespace WebCore {
             // worlds at all.
             if (!isolatedWorldCount)
                 return 0;
-            return getEnteredImpl();
+            if (!v8::Context::InContext())
+                return 0;
+            return reinterpret_cast<V8IsolatedWorld*>(getGlobalObject(v8::Context::GetEntered())->GetPointerFromInternalField(V8Custom::kDOMWindowEnteredIsolatedWorldIndex));
         }
 
         v8::Handle<v8::Context> context() { return m_context->get(); }
@@ -93,9 +96,10 @@ namespace WebCore {
         DOMDataStore* getDOMDataStore() const { return m_domDataStore.getStore(); }
 
     private:
-        ~V8IsolatedWorld();
-
-        static V8IsolatedWorld* getEnteredImpl();
+        static v8::Handle<v8::Object> getGlobalObject(v8::Handle<v8::Context> context)
+        {
+            return v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype());
+        }
 
         // Called by the garbage collector when our JavaScript context is about
         // to be destroyed.
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index 54740a9..16b21d6 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -35,13 +35,14 @@
 #include "V8Binding.h"
 #include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
+#include "WorldContextHandle.h"
 
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber)
-    : V8AbstractEventListener(0, true)
+V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext)
+    : V8AbstractEventListener(true, worldContext)
     , m_functionName(functionName)
     , m_isSVGEvent(isSVGEvent)
     , m_code(code)
@@ -83,7 +84,7 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
         return;
 
     // Use the outer scope to hold context.
-    v8::Handle<v8::Context> v8Context = proxy->context();
+    v8::Local<v8::Context> v8Context = worldContext().adjustedContext(proxy);
     // Bail out if we cannot get the context.
     if (v8Context.IsEmpty())
         return;
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index 699460b..078dcf1 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -45,9 +45,9 @@ namespace WebCore {
     // A V8LazyEventListener is always a HTML event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, int lineNumber, int columnNumber)
+        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, lineNumber, columnNumber));
+            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, lineNumber, columnNumber, worldContext));
         }
 
         virtual bool isLazy() const { return true; }
@@ -56,7 +56,7 @@ namespace WebCore {
         virtual void prepareListenerObject(ScriptExecutionContext*);
 
     private:
-        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber);
+        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber, const WorldContextHandle& worldContext);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
 
diff --git a/WebCore/bindings/v8/V8NPObject.cpp b/WebCore/bindings/v8/V8NPObject.cpp
index 75163f1..bab3688 100644
--- a/WebCore/bindings/v8/V8NPObject.cpp
+++ b/WebCore/bindings/v8/V8NPObject.cpp
@@ -33,6 +33,7 @@
 #include "V8NPObject.h"
 
 #include "HTMLPlugInElement.h"
+#include "IdentifierRep.h"
 #include "NPV8Object.h"
 #include "V8CustomBinding.h"
 #include "V8DOMMap.h"
@@ -44,7 +45,7 @@
 #include "V8Proxy.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
-#include "wtf/OwnArrayPtr.h"
+#include <wtf/OwnArrayPtr.h>
 
 using namespace WebCore;
 
@@ -117,7 +118,7 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
     if (!retval)
         throwError("Error calling method on NPObject!", V8Proxy::GeneralError);
 
-    for (int i=0; i < numArgs; i++)
+    for (int i = 0; i < numArgs; i++)
         _NPN_ReleaseVariantValue(&npArgs[i]);
 
     // Unwrap return values.
@@ -138,8 +139,8 @@ v8::Handle<v8::Value> npObjectInvokeDefaultHandler(const v8::Arguments& args)
 {
     if (args.IsConstructCall())
         return npObjectInvokeImpl(args, InvokeConstruct);
-    else
-        return npObjectInvokeImpl(args, InvokeDefault);
+
+    return npObjectInvokeImpl(args, InvokeDefault);
 }
 
 
@@ -180,7 +181,9 @@ static v8::Handle<v8::Value> npObjectGetProperty(v8::Local<v8::Object> self, NPI
         _NPN_ReleaseVariantValue(&result);
         return returnValue;
 
-    } else if (key->IsString() && npObject->_class->hasMethod && npObject->_class->hasMethod(npObject, identifier)) {
+    }
+
+    if (key->IsString() && npObject->_class->hasMethod && npObject->_class->hasMethod(npObject, identifier)) {
         PrivateIdentifier* id = static_cast<PrivateIdentifier*>(identifier);
         v8::Persistent<v8::FunctionTemplate> functionTemplate = staticTemplateMap.get(id);
         // Cache templates using identifier as the key.
@@ -275,6 +278,44 @@ v8::Handle<v8::Value> npObjectSetIndexedProperty(v8::Local<v8::Object> self, uin
     return npObjectSetProperty(self, identifier, value);
 }
 
+v8::Handle<v8::Array> npObjectPropertyEnumerator(const v8::AccessorInfo& info, bool namedProperty)
+{
+    NPObject* npObject = V8DOMWrapper::convertToNativeObject<NPObject>(V8ClassIndex::NPOBJECT, info.Holder());
+
+    // Verify that our wrapper wasn't using a NPObject which
+    // has already been deleted.
+    if (!npObject || !_NPN_IsAlive(npObject))
+        throwError("NPObject deleted", V8Proxy::ReferenceError);
+
+    if (NP_CLASS_STRUCT_VERSION_HAS_ENUM(npObject->_class) && npObject->_class->enumerate) {
+        uint32_t count;
+        NPIdentifier* identifiers;
+        if (npObject->_class->enumerate(npObject, &identifiers, &count)) {
+            v8::Handle<v8::Array> properties = v8::Array::New(count);
+            for (uint32_t i = 0; i < count; ++i) {
+                IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
+                if (namedProperty)
+                    properties->Set(v8::Integer::New(i), v8::String::New(identifier->string()));
+                else
+                    properties->Set(v8::Integer::New(i), v8::Integer::New(identifier->number()));
+            }
+
+            return properties;
+        }
+    }
+
+    return v8::Handle<v8::Array>();
+}
+
+v8::Handle<v8::Array> npObjectNamedPropertyEnumerator(const v8::AccessorInfo& info)
+{
+    return npObjectPropertyEnumerator(info, true);
+}
+
+v8::Handle<v8::Array> npObjectIndexedPropertyEnumerator(const v8::AccessorInfo& info)
+{
+    return npObjectPropertyEnumerator(info, false);
+}
 
 static void weakNPObjectCallback(v8::Persistent<v8::Value>, void* parameter);
 
@@ -317,8 +358,8 @@ v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root
     if (npObjectDesc.IsEmpty()) {
         npObjectDesc = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
         npObjectDesc->InstanceTemplate()->SetInternalFieldCount(V8Custom::kNPObjectInternalFieldCount);
-        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter);
-        npObjectDesc->InstanceTemplate()->SetIndexedPropertyHandler(npObjectIndexedPropertyGetter, npObjectIndexedPropertySetter);
+        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter, 0, 0, npObjectNamedPropertyEnumerator);
+        npObjectDesc->InstanceTemplate()->SetIndexedPropertyHandler(npObjectIndexedPropertyGetter, npObjectIndexedPropertySetter, 0, 0, npObjectIndexedPropertyEnumerator);
         npObjectDesc->InstanceTemplate()->SetCallAsFunctionHandler(npObjectInvokeDefaultHandler);
     }
 
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index 64424f3..c016d90 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -36,6 +36,7 @@
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "ScriptController.h"
@@ -52,12 +53,14 @@
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
+#include <stdio.h>
 #include <utility>
 #include <v8.h>
 #include <v8-debug.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
 
 #if PLATFORM(CHROMIUM)
@@ -79,16 +82,34 @@ v8::Persistent<v8::Context> V8Proxy::m_utilityContext;
 // Static list of registered extensions
 V8Extensions V8Proxy::m_extensions;
 
-const char* V8Proxy::kContextDebugDataType = "type";
-const char* V8Proxy::kContextDebugDataValue = "value";
-
-void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, v8::Handle<v8::ObjectTemplate> proto, const BatchedAttribute* attributes, size_t attributeCount)
+void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, 
+                              v8::Handle<v8::ObjectTemplate> proto, 
+                              const BatchedAttribute* attributes, 
+                              size_t attributeCount)
 {
     for (size_t i = 0; i < attributeCount; ++i)
         configureAttribute(instance, proto, attributes[i]);
 }
 
-void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor, v8::Handle<v8::ObjectTemplate> proto, const BatchedConstant* constants, size_t constantCount)
+void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate> proto, 
+                             v8::Handle<v8::Signature> signature, 
+                             v8::PropertyAttribute attributes,
+                             const BatchedCallback* callbacks,
+                             size_t callbackCount)
+{
+    for (size_t i = 0; i < callbackCount; ++i) {
+        proto->Set(v8::String::New(callbacks[i].name),
+                   v8::FunctionTemplate::New(callbacks[i].callback, 
+                                             v8::Handle<v8::Value>(),
+                                             signature),
+                   attributes);
+    }
+}
+
+void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor,
+                             v8::Handle<v8::ObjectTemplate> proto,
+                             const BatchedConstant* constants,
+                             size_t constantCount)
 {
     for (size_t i = 0; i < constantCount; ++i) {
         const BatchedConstant* constant = &constants[i];
@@ -218,7 +239,6 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 
 V8Proxy::V8Proxy(Frame* frame)
     : m_frame(frame)
-    , m_listenerGuard(V8ListenerGuard::create())
     , m_inlineCode(false)
     , m_timerCallback(false)
     , m_recursion(0)
@@ -306,13 +326,26 @@ void V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode
             world = iter->second;
         } else {
             world = new V8IsolatedWorld(this, extensionGroup);
+            if (world->context().IsEmpty()) {
+                delete world;
+                return;
+            }
+
             m_isolatedWorlds.set(worldID, world);
 
             // Setup context id for JS debugger.
-            setInjectedScriptContextDebugId(world->context());
+            if (!setInjectedScriptContextDebugId(world->context())) {
+                m_isolatedWorlds.take(worldID);
+                delete world;
+                return;
+            }
         }
     } else {
         world = new V8IsolatedWorld(this, extensionGroup);
+        if (world->context().IsEmpty()) {
+            delete world;
+            return;
+        }
     }
 
     v8::Local<v8::Context> context = v8::Local<v8::Context>::New(world->context());
@@ -338,10 +371,16 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     ASSERT(V8DOMWrapper::convertDOMWrapperToNative<DOMWindow>(windowWrapper) == m_frame->domWindow());
 
     v8::Persistent<v8::Context> context = createNewContext(v8::Handle<v8::Object>(), extensionGroup);
+    if (context.IsEmpty())
+        return;
+
     v8::Context::Scope contextScope(context);
 
     // Setup context id for JS debugger.
-    setInjectedScriptContextDebugId(context);
+    if (!setInjectedScriptContextDebugId(context)) {
+        context.Dispose();
+        return;
+    }
 
     v8::Handle<v8::Object> global = context->Global();
 
@@ -367,25 +406,35 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     context.Dispose();
 }
 
-void V8Proxy::setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext)
+bool V8Proxy::setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext)
 {
     // Setup context id for JS debugger.
     v8::Context::Scope contextScope(targetContext);
-    v8::Handle<v8::Object> contextData = v8::Object::New();
+    if (m_context.IsEmpty())
+        return false;
+    int debugId = contextDebugId(m_context);
 
-    v8::Handle<v8::Value> windowContextData = m_context->GetData();
-    if (windowContextData->IsObject()) {
-        v8::Handle<v8::String> propertyName = v8::String::New(kContextDebugDataValue);
-        contextData->Set(propertyName, v8::Object::Cast(*windowContextData)->Get(propertyName));
-    }
-    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("injected"));
-    targetContext->SetData(contextData);
+    char buffer[32];
+    if (debugId == -1)
+        snprintf(buffer, sizeof(buffer), "injected");
+    else
+        snprintf(buffer, sizeof(buffer), "injected,%d", debugId);
+    targetContext->SetData(v8::String::New(buffer));
+
+    return true;
 }
 
 v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* node)
 {
     ASSERT(v8::Context::InContext());
 
+    V8GCController::checkMemoryUsage();
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->willEvaluateScript(source.url().isNull() ? String() : source.url().string(), source.startLine());
+#endif
+
     v8::Local<v8::Value> result;
     {
         // Isolate exceptions that occur when compiling and executing
@@ -419,7 +468,18 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
 #if PLATFORM(CHROMIUM)
     // TODO(andreip): ChromeBridge->BrowserBridge?
     ChromiumBridge::traceEventEnd("v8.run", node, "");
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
+=======
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
+        timelineAgent->didEvaluateScript();
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
+=======
+
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
     return result;
 }
 
@@ -438,6 +498,7 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
     if (script.IsEmpty())
         return notHandledByInterceptor();
 
+    V8GCController::checkMemoryUsage();
     // Compute the source string and prevent against infinite recursion.
     if (m_recursion >= kMaxRecursionDepth) {
         v8::Local<v8::String> code = v8ExternalString("throw RangeError('Recursion too deep')");
@@ -492,9 +553,13 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
 v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> args[])
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::JavaScriptExecuteTimeCounter);
 #endif
+=======
+    V8GCController::checkMemoryUsage();
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
@@ -646,6 +711,7 @@ V8Proxy* V8Proxy::retrieve(ScriptExecutionContext* context)
 
 void V8Proxy::disconnectFrame()
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     disconnectEventListeners();
 }
 
@@ -700,6 +766,8 @@ bool V8Proxy::isEnabled()
     }
 
     return false; // Other protocols fall through to here
+=======
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::updateDocumentWrapper(v8::Handle<v8::Value> wrapper)
@@ -789,12 +857,6 @@ void V8Proxy::releaseStorageMutex()
         page->group().localStorage()->unlock();
 }
 
-void V8Proxy::disconnectEventListeners()
-{
-    m_listenerGuard->disconnectListeners();
-    m_listenerGuard = V8ListenerGuard::create();
-}
-    
 void V8Proxy::resetIsolatedWorlds()
 {
     for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
@@ -818,7 +880,6 @@ void V8Proxy::clearForClose()
 
 void V8Proxy::clearForNavigation()
 {
-    disconnectEventListeners();
     resetIsolatedWorlds();
 
     if (!m_context.IsEmpty()) {
@@ -942,14 +1003,20 @@ bool V8Proxy::canAccessPrivate(DOMWindow* targetWindow)
 
     String message;
 
-    DOMWindow* originWindow = retrieveWindow(currentContext());
-    if (originWindow == targetWindow)
+    v8::Local<v8::Context> activeContext = v8::Context::GetCalling();
+    if (activeContext.IsEmpty()) {
+        // There is a single activation record on the stack, so that must
+        // be the activeContext.
+        activeContext = v8::Context::GetCurrent();
+    }
+    DOMWindow* activeWindow = retrieveWindow(activeContext);
+    if (activeWindow == targetWindow)
         return true;
 
-    if (!originWindow)
+    if (!activeWindow)
         return false;
 
-    const SecurityOrigin* activeSecurityOrigin = originWindow->securityOrigin();
+    const SecurityOrigin* activeSecurityOrigin = activeWindow->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->securityOrigin();
 
     // We have seen crashes were the security origin of the target has not been
@@ -962,7 +1029,7 @@ bool V8Proxy::canAccessPrivate(DOMWindow* targetWindow)
 
     // Allow access to a "about:blank" page if the dynamic context is a
     // detached context of the same frame as the blank page.
-    if (targetSecurityOrigin->isEmpty() && originWindow->frame() == targetWindow->frame())
+    if (targetSecurityOrigin->isEmpty() && activeWindow->frame() == targetWindow->frame())
         return true;
 
     return false;
@@ -1171,10 +1238,17 @@ void V8Proxy::initContextIfNeeded()
     setSecurityToken();
 
     m_frame->loader()->client()->didCreateScriptContextForFrame();
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     m_frame->loader()->dispatchWindowObjectAvailable();
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::JavaScriptInitTimeCounter, __FUNCTION__);
 #endif
+=======
+
+    // FIXME: This is wrong. We should actually do this for the proper world once
+    // we do isolated worlds the WebCore way.
+    m_frame->loader()->dispatchDidClearWindowObjectInWorld(0);
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::setDOMException(int exceptionCode)
@@ -1257,8 +1331,13 @@ v8::Local<v8::Context> V8Proxy::context()
             return v8::Local<v8::Context>();
         return v8::Local<v8::Context>::New(context->get());
     }
+    return mainWorldContext();
+}
+
+v8::Local<v8::Context> V8Proxy::mainWorldContext()
+{
     initContextIfNeeded();
-    return v8::Local<v8::Context>::New(m_context);;
+    return v8::Local<v8::Context>::New(m_context);
 }
 
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
@@ -1267,8 +1346,7 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
     if (!proxy)
         return v8::Local<v8::Context>();
 
-    proxy->initContextIfNeeded();
-    return v8::Local<v8::Context>::New(proxy->m_context);
+    return proxy->mainWorldContext();
 }
 
 v8::Local<v8::Context> V8Proxy::currentContext()
@@ -1337,7 +1415,7 @@ void V8Proxy::createUtilityContext()
     v8::Script::Compile(v8::String::New(frameSourceNameSource))->Run();
 }
 
-int V8Proxy::sourceLineNumber()
+bool V8Proxy::sourceLineNumber(int& result)
 {
 #if PLATFORM(ANDROID)
     // TODO(andreip): consider V8's DEBUG flag here, rather than PLATFORM(ANDROID)
@@ -1347,20 +1425,29 @@ int V8Proxy::sourceLineNumber()
     v8::HandleScope scope;
     v8::Handle<v8::Context> v8UtilityContext = V8Proxy::utilityContext();
     if (v8UtilityContext.IsEmpty())
-        return 0;
+        return false;
     v8::Context::Scope contextScope(v8UtilityContext);
     v8::Handle<v8::Function> frameSourceLine;
     frameSourceLine = v8::Local<v8::Function>::Cast(v8UtilityContext->Global()->Get(v8::String::New("frameSourceLine")));
     if (frameSourceLine.IsEmpty())
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
         return 0;
     v8::Handle<v8::Value> result = v8::Debug::Call(frameSourceLine);
     if (result.IsEmpty())
         return 0;
     return result->Int32Value();
 #endif
+=======
+        return false;
+    v8::Handle<v8::Value> value = v8::Debug::Call(frameSourceLine);
+    if (value.IsEmpty())
+        return false;
+    result = value->Int32Value();
+    return true;
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
-String V8Proxy::sourceName()
+bool V8Proxy::sourceName(String& result)
 {
 #if PLATFORM(ANDROID)
     return String();
@@ -1368,14 +1455,23 @@ String V8Proxy::sourceName()
     v8::HandleScope scope;
     v8::Handle<v8::Context> v8UtilityContext = utilityContext();
     if (v8UtilityContext.IsEmpty())
-        return String();
+        return false;
     v8::Context::Scope contextScope(v8UtilityContext);
     v8::Handle<v8::Function> frameSourceName;
     frameSourceName = v8::Local<v8::Function>::Cast(v8UtilityContext->Global()->Get(v8::String::New("frameSourceName")));
     if (frameSourceName.IsEmpty())
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
         return String();
     return toWebCoreString(v8::Debug::Call(frameSourceName));
 #endif
+=======
+        return false;
+    v8::Handle<v8::Value> value = v8::Debug::Call(frameSourceName);
+    if (value.IsEmpty())
+        return false;
+    result = toWebCoreString(value);
+    return true;
+>>>>>>> webkit.org at r51976:WebCore/bindings/v8/V8Proxy.cpp
 }
 
 void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
@@ -1419,20 +1515,24 @@ bool V8Proxy::setContextDebugId(int debugId)
         return false;
 
     v8::Context::Scope contextScope(m_context);
-    v8::Handle<v8::Object> contextData = v8::Object::New();
-    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("page"));
-    contextData->Set(v8::String::New(kContextDebugDataValue), v8::Integer::New(debugId));
-    m_context->SetData(contextData);
+
+    char buffer[32];
+    snprintf(buffer, sizeof(buffer), "page,%d", debugId);
+    m_context->SetData(v8::String::New(buffer));
+
     return true;
 }
 
 int V8Proxy::contextDebugId(v8::Handle<v8::Context> context)
 {
     v8::HandleScope scope;
-    if (!context->GetData()->IsObject())
+    if (!context->GetData()->IsString())
         return -1;
-    v8::Handle<v8::Value> data = context->GetData()->ToObject()->Get( v8::String::New(kContextDebugDataValue));
-    return data->IsInt32() ? data->Int32Value() : -1;
+    v8::String::AsciiValue ascii(context->GetData());
+    char* comma = strnstr(*ascii, ",", ascii.length());
+    if (!comma)
+        return -1;
+    return atoi(comma + 1);
 }
 
 v8::Handle<v8::Value> V8Proxy::getHiddenObjectPrototype(v8::Handle<v8::Context> context)
@@ -1455,11 +1555,11 @@ void V8Proxy::installHiddenObjectPrototype(v8::Handle<v8::Context> context)
     context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype);
 }
 
-v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context)
+v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context, const WorldContextHandle& worldContext)
 {
     if (context->isDocument()) {
         if (V8Proxy* proxy = V8Proxy::retrieve(context))
-            return proxy->context();
+            return worldContext.adjustedContext(proxy);
     } else if (context->isWorkerContext()) {
         if (WorkerContextExecutionProxy* proxy = static_cast<WorkerContext*>(context)->script()->proxy())
             return proxy->context();
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index 86d3b39..900ee18 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -59,6 +59,7 @@ namespace WebCore {
     class String;
     class V8EventListener;
     class V8IsolatedWorld;
+    class WorldContextHandle;
 
     // FIXME: use standard logging facilities in WebCore.
     void logInfo(Frame*, const String& message, const String& url);
@@ -102,6 +103,17 @@ namespace WebCore {
 
     void batchConfigureConstants(v8::Handle<v8::FunctionTemplate>, v8::Handle<v8::ObjectTemplate>, const BatchedConstant*, size_t constantCount);
 
+    struct BatchedCallback {
+        const char* const name;
+        v8::InvocationCallback callback;
+    };
+
+    void batchConfigureCallbacks(v8::Handle<v8::ObjectTemplate>, 
+                                 v8::Handle<v8::Signature>,
+                                 v8::PropertyAttribute,
+                                 const BatchedCallback*, 
+                                 size_t callbackCount);
+
     const int kMaxRecursionDepth = 20;
 
     // Information about an extension that is registered for use with V8. If
@@ -163,11 +175,36 @@ namespace WebCore {
         // and clears all timeouts on the DOM window.
         void disconnectFrame();
 
-        bool isEnabled();
-
 #if ENABLE(SVG)
         static void setSVGContext(void*, SVGElement*);
         static SVGElement* svgContext(void*);
+
+        // These helper functions are required in case we are given a PassRefPtr
+        // to a (possibly) newly created object and must prevent its reference
+        // count from dropping to zero as would happen in code like
+        //
+        //   V8Proxy::setSVGContext(imp->getNewlyCreatedObject().get(), context);
+        //   foo(imp->getNewlyCreatedObject().get());
+        //
+        // In the above two lines each time getNewlyCreatedObject() is called it
+        // creates a new object because we don't ref() it. (So our attemts to
+        // associate a context with it fail.) Such code should be rewritten to
+        //
+        //   foo(V8Proxy::withSVGContext(imp->getNewlyCreatedObject(), context).get());
+        //
+        // where PassRefPtr::~PassRefPtr() is invoked only after foo() is
+        // called.
+        template <typename T>
+        static PassRefPtr<T> withSVGContext(PassRefPtr<T> object, SVGElement* context)
+        {
+            setSVGContext(object.get(), context);
+            return object;
+        }
+        static void* withSVGContext(void* object, SVGElement* context)
+        {
+            setSVGContext(object, context);
+            return object;
+        }
 #endif
 
         void setEventHandlerLineNumber(int lineNumber) { m_handlerLineNumber = lineNumber; }
@@ -302,15 +339,16 @@ namespace WebCore {
 
         // Function for retrieving the line number and source name for the top
         // JavaScript stack frame.
-        static int sourceLineNumber();
-        static String sourceName();
+        //
+        // It will return true if the line number was successfully retrieved and written
+        // into the |result| parameter, otherwise the function will return false. It may
+        // fail due to a stck overflow in the underlying JavaScript implentation, handling
+        // of such exception is up to the caller.
+        static bool sourceLineNumber(int& result);
+        static bool sourceName(String& result);
 
         v8::Local<v8::Context> context();
-
-        PassRefPtr<V8ListenerGuard> listenerGuard()
-        {
-            return m_listenerGuard;
-        }
+        v8::Local<v8::Context> mainWorldContext();
 
         bool setContextDebugId(int id);
         static int contextDebugId(v8::Handle<v8::Context>);
@@ -337,9 +375,6 @@ namespace WebCore {
         void updateDocumentWrapper(v8::Handle<v8::Value> wrapper);
 
     private:
-        static const char* kContextDebugDataType;
-        static const char* kContextDebugDataValue;
-
         void setSecurityToken();
         void clearDocumentWrapper();
 
@@ -357,11 +392,10 @@ namespace WebCore {
         // the storage mutex.
         void releaseStorageMutex();
 
-        void disconnectEventListeners();
-        
         void resetIsolatedWorlds();
 
-        void setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext);
+        // Returns false when we're out of memory in V8.
+        bool setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext);
 
         static bool canAccessPrivate(DOMWindow*);
 
@@ -397,8 +431,6 @@ namespace WebCore {
 
         v8::Persistent<v8::Context> m_context;
 
-        RefPtr<V8ListenerGuard> m_listenerGuard;
-
         // For each possible type of wrapper, we keep a boilerplate object.
         // The boilerplate is used to create additional wrappers of the same
         // type.  We keep a single persistent handle to an array of the
@@ -456,7 +488,7 @@ namespace WebCore {
     }
 
 
-    v8::Local<v8::Context> toV8Context(ScriptExecutionContext*);
+    v8::Local<v8::Context> toV8Context(ScriptExecutionContext*, const WorldContextHandle& worldContext);
 
     // Used by an interceptor callback that it hasn't found anything to
     // intercept.
diff --git a/WebCore/bindings/v8/V8Utilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
index ecac358..c547cc7 100644
--- a/WebCore/bindings/v8/V8Utilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -76,6 +76,24 @@ void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
         }
     }
 }
+    
+void transferHiddenDependency(v8::Handle<v8::Object> object,
+                              EventListener* oldValue, 
+                              v8::Local<v8::Value> newValue, 
+                              int cacheIndex)
+{
+    if (oldValue) {
+        V8AbstractEventListener* oldListener = V8AbstractEventListener::cast(oldValue);
+        if (oldListener) {
+            v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();
+            if (!oldListenerObject.IsEmpty())
+                removeHiddenDependency(object, oldListenerObject, cacheIndex);
+        }
+    }
+    if (!newValue->IsNull() && !newValue->IsUndefined())
+        createHiddenDependency(object, newValue, cacheIndex);
+}
+    
 
 bool processingUserGesture()
 {
@@ -147,7 +165,12 @@ void reportException(ScriptState* scriptState, v8::TryCatch& exceptionCatcher)
         sourceURL = toWebCoreString(message->GetScriptResourceName());
     }
 
-    getScriptExecutionContext(scriptState)->reportException(errorMessage, lineNumber, sourceURL);
+    // Do not report the exception if the current execution context is Document because we do not want to lead to duplicate error messages in the console.
+    // FIXME (31171): need better design to solve the duplicate error message reporting problem.
+    ScriptExecutionContext* context = getScriptExecutionContext(scriptState);
+    // During the frame teardown, there may not be a valid context.
+    if (context && !context->isDocument())
+      context->reportException(errorMessage, lineNumber, sourceURL);
     exceptionCatcher.Reset();
 }
 
diff --git a/WebCore/bindings/v8/V8Utilities.h b/WebCore/bindings/v8/V8Utilities.h
index 36dce24..944823a 100644
--- a/WebCore/bindings/v8/V8Utilities.h
+++ b/WebCore/bindings/v8/V8Utilities.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
 
+    class EventListener;
     class Frame;
     class KURL;
     class ScriptExecutionContext;
@@ -44,7 +45,10 @@ namespace WebCore {
     // Use an array to hold dependents. It works like a ref-counted scheme. A value can be added more than once to the DOM object.
     void createHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
     void removeHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
-
+    
+    // Combo create/remove, for generated event-handler-setter bindings:
+    void transferHiddenDependency(v8::Handle<v8::Object>, EventListener* oldValue, v8::Local<v8::Value> newValue, int cacheIndex);
+    
     bool processingUserGesture();
     bool shouldAllowNavigation(Frame*);
     KURL completeURL(const String& relativeURL);
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 8dc4b8d..e5356de 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -48,15 +48,14 @@ static WorkerContextExecutionProxy* workerProxy(ScriptExecutionContext* context)
     return workerContext->script()->proxy();
 }
 
-V8WorkerContextEventListener::V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(guard, listener, isInline)
+V8WorkerContextEventListener::V8WorkerContextEventListener(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext)
+    : V8EventListener(listener, isInline, worldContext)
 {
 }
 
 void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
-    // Is the EventListener disconnected?
-    if (disconnected())
+    if (!context)
         return;
 
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
@@ -84,8 +83,7 @@ void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext* context,
 
 bool V8WorkerContextEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
-    // Is the EventListener disconnected?
-    if (disconnected())
+    if (!context)
         return false;
 
     // The callback function can clear the event listener and destroy 'this' object. Keep a local reference to it.
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index 3f9f862..4487497 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -44,16 +44,16 @@ namespace WebCore {
 
     class V8WorkerContextEventListener : public V8EventListener {
     public:
-        static PassRefPtr<V8WorkerContextEventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8WorkerContextEventListener> create(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8WorkerContextEventListener(guard, listener, isInline));
+            return adoptRef(new V8WorkerContextEventListener(listener, isInline, worldContext));
         }
 
         virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
 
     private:
-        V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
+        V8WorkerContextEventListener(v8::Local<v8::Object> listener, bool isInline, const WorldContextHandle& worldContext);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
         v8::Local<v8::Object> getReceiverObject(ScriptExecutionContext*, Event*);
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 0fd0f8f..8c66d7b 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -72,7 +72,6 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_recursion(0)
-    , m_listenerGuard(V8ListenerGuard::create())
 {
     initV8IfNeeded();
 }
@@ -84,8 +83,6 @@ WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
 
 void WorkerContextExecutionProxy::dispose()
 {
-    m_listenerGuard->disconnectListeners();
-
     // Detach all events from their JS wrappers.
     for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
         Event* event = m_events[eventIndex];
@@ -158,7 +155,12 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     v8::Handle<v8::String> implicitProtoString = v8::String::New("__proto__");
 
     // Create a new JS object and use it as the prototype for the shadow global object.
-    v8::Handle<v8::Function> workerContextConstructor = V8DOMWrapper::getConstructorForContext(V8ClassIndex::DEDICATEDWORKERCONTEXT, context);
+    V8ClassIndex::V8WrapperType contextType = V8ClassIndex::DEDICATEDWORKERCONTEXT;
+#if ENABLE(SHARED_WORKERS)
+    if (!m_workerContext->isDedicatedWorkerContext())
+        contextType = V8ClassIndex::SHAREDWORKERCONTEXT;
+#endif
+    v8::Handle<v8::Function> workerContextConstructor = V8DOMWrapper::getConstructorForContext(contextType, context);
     v8::Local<v8::Object> jsWorkerContext = SafeAllocation::newInstance(workerContextConstructor);
     // Bail out if allocation failed.
     if (jsWorkerContext.IsEmpty()) {
@@ -167,7 +169,7 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     }
 
     // Wrap the object.
-    V8DOMWrapper::setDOMWrapper(jsWorkerContext, V8ClassIndex::ToInt(V8ClassIndex::DEDICATEDWORKERCONTEXT), m_workerContext);
+    V8DOMWrapper::setDOMWrapper(jsWorkerContext, V8ClassIndex::ToInt(contextType), m_workerContext);
 
     V8DOMWrapper::setJSWrapperForDOMObject(m_workerContext, v8::Persistent<v8::Object>::New(jsWorkerContext));
     m_workerContext->ref();
@@ -182,7 +184,11 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassInde
     if (!impl)
         return v8::Null();
 
-    if (type == V8ClassIndex::DEDICATEDWORKERCONTEXT)
+    if (type == V8ClassIndex::DEDICATEDWORKERCONTEXT
+#if ENABLE(SHARED_WORKERS)
+        || type == V8ClassIndex::SHAREDWORKERCONTEXT
+#endif
+        )
         return convertWorkerContextToV8Object(static_cast<WorkerContext*>(impl));
 
     bool isActiveDomObject = false;
@@ -294,10 +300,22 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertEventTargetToV8Object(
     if (workerContext)
         return convertWorkerContextToV8Object(workerContext);
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorkerContext* sharedWorkerContext = target->toSharedWorkerContext();
+    if (sharedWorkerContext)
+        return convertWorkerContextToV8Object(sharedWorkerContext);
+#endif
+
     Worker* worker = target->toWorker();
     if (worker)
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 
+#if ENABLE(SHARED_WORKERS)
+    SharedWorker* sharedWorker = target->toSharedWorker();
+    if (sharedWorker)
+        return convertToV8Object(V8ClassIndex::SHAREDWORKER, sharedWorker);
+#endif
+
     XMLHttpRequest* xhr = target->toXMLHttpRequest();
     if (xhr)
         return convertToV8Object(V8ClassIndex::XMLHTTPREQUEST, xhr);
@@ -411,7 +429,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
 
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
 {
-    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(m_listenerGuard, object, isInline);
+    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(object, isInline);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index e723bc6..3b8ab9e 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -112,7 +112,6 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
-        RefPtr<V8ListenerGuard> m_listenerGuard;
 
         Vector<Event*> m_events;
     };
diff --git a/WebCore/bindings/v8/WorldContextHandle.cpp b/WebCore/bindings/v8/WorldContextHandle.cpp
new file mode 100644
index 0000000..eb83586
--- /dev/null
+++ b/WebCore/bindings/v8/WorldContextHandle.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorldContextHandle.h"
+
+#include "V8IsolatedWorld.h"
+
+namespace WebCore {
+
+WorldContextHandle::WorldContextHandle(WorldToUse worldToUse)
+    : m_worldToUse(worldToUse)
+{
+    if (worldToUse == UseMainWorld)
+        return;
+
+    if (V8IsolatedWorld* world = V8IsolatedWorld::getEntered())
+        m_context = world->sharedContext();
+}
+
+v8::Local<v8::Context> WorldContextHandle::adjustedContext(V8Proxy* proxy) const
+{
+    if (m_worldToUse == UseMainWorld)
+        return proxy->mainWorldContext();
+    if (!m_context || m_context->get().IsEmpty())
+        return proxy->context();
+    return v8::Local<v8::Context>::New(m_context->get());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/WorldContextHandle.h b/WebCore/bindings/v8/WorldContextHandle.h
new file mode 100644
index 0000000..ad0983e
--- /dev/null
+++ b/WebCore/bindings/v8/WorldContextHandle.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorldContextHandle_h
+#define WorldContextHandle_h
+
+#include "SharedPersistent.h"
+
+#include <v8.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class V8Proxy;
+
+enum WorldToUse { UseMainWorld, UseCurrentWorld };
+
+class WorldContextHandle {
+public:
+    WorldContextHandle(WorldToUse);
+    v8::Local<v8::Context> adjustedContext(V8Proxy*) const;
+
+private:
+    WorldToUse m_worldToUse;
+    RefPtr<SharedPersistent<v8::Context> > m_context;
+};
+
+} // namespace WebCore
+
+#endif // WorldContextHandle_h
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
deleted file mode 100644
index 311b838..0000000
--- a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-
-#include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CustomBinding.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-    // Template function used by the CanvasArray*Constructor callbacks.
-    template<class ArrayClass>
-    v8::Handle<v8::Value> constructCanvasArray(const v8::Arguments& args,
-                                               int classIndex)
-    {
-        if (!args.IsConstructCall())
-            return throwError("DOM object constructor cannot be called as a function.");
-
-        int argLen = args.Length();
-        // Supported constructors:
-        // Canvas<T>Array(n) where n is an integer:
-        //   -- create an empty array of n elements
-        // Canvas<T>Array(arr) where arr is an array:
-        //   -- create a Canvas<T>Array containing the contents of "arr"
-        // Canvas<T>Array(buf, offset, length)
-        //   -- create a Canvas<T>Array pointing to the CanvasArrayBuffer
-        //      "buf", starting at the specified offset, for the given
-        //      length
-
-        if (argLen == 0)
-            return throwError("No arguments specified to constructor");
-
-        // See whether the first argument is a CanvasArrayBuffer.
-        if (V8CanvasArrayBuffer::HasInstance(args[0])) {
-            if (argLen > 3)
-                return throwError("Wrong number of arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
-
-            CanvasArrayBuffer* buf =
-                V8DOMWrapper::convertToNativeObject<CanvasArrayBuffer>(V8ClassIndex::CANVASARRAYBUFFER,
-                                                                       args[0]->ToObject());
-            if (buf == NULL)
-                return throwError("Could not convert argument 0 to a CanvasArrayBuffer");
-            bool ok;
-            int offset = 0;
-            if (argLen > 1) {
-                offset = toInt32(args[1], ok);
-                if (!ok)
-                    return throwError("Could not convert argument 1 to an integer");
-            }
-            int length = buf->byteLength() - offset;
-            if (argLen > 2) {
-                length = toInt32(args[2], ok);
-                if (!ok)
-                    return throwError("Could not convert argument 2 to an integer");
-            }
-            if (length < 0)
-                return throwError("Length / offset out of range");
-
-            RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
-            if (array == NULL)
-                return throwError("Invalid arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
-            // Transform the holder into a wrapper object for the array.
-            V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
-            return toV8(array.release(), args.Holder());
-        }
-
-        int len = 0;
-        v8::Handle<v8::Array> srcArray;
-        if (argLen != 1)
-            return throwError("Wrong number of arguments to new Canvas<T>Array(int / array)");
-
-        if (args[0]->IsInt32()) {
-            len = toInt32(args[0]);
-        } else if (args[0]->IsArray()) {
-            srcArray = v8::Local<v8::Array>::Cast(args[0]);
-            if (srcArray.IsEmpty())
-                return throwError("Could not convert argument 0 to an array");
-            len = srcArray->Length();
-        } else
-            return throwError("Could not convert argument 0 to either an int32 or an array");
-
-        RefPtr<ArrayClass> array = ArrayClass::create(len);
-        if (!srcArray.IsEmpty()) {
-            // Need to copy the incoming array into the newly created CanvasArray.
-            for (int i = 0; i < len; i++) {
-                v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
-                if (!val->IsNumber()) {
-                    char buf[256];
-                    sprintf(buf, "Could not convert array element %d to a number", i);
-                    return throwError(buf);
-                }
-                array->set(i, val->NumberValue());
-            }
-        }
-
-        // Transform the holder into a wrapper object for the array.
-        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
-        return toV8(array.release(), args.Holder());
-    }
-
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
deleted file mode 100644
index c109bb8..0000000
--- a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
+++ /dev/null
@@ -1,597 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasRenderingContext3D.h"
-
-#include "ExceptionCode.h"
-
-#include "NotImplemented.h"
-
-#include <wtf/FastMalloc.h>
-
-#include "V8Binding.h"
-#include "V8CanvasArray.h"
-#include "V8CanvasByteArray.h"
-#include "V8CanvasFloatArray.h"
-#include "V8CanvasIntArray.h"
-#include "V8CanvasShortArray.h"
-#include "V8CanvasUnsignedByteArray.h"
-#include "V8CanvasUnsignedIntArray.h"
-#include "V8CanvasUnsignedShortArray.h"
-#include "V8HTMLImageElement.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-// Allocates new storage via tryFastMalloc.
-// Returns NULL if array failed to convert for any reason.
-static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
-{
-    // Convert the data element-by-element.
-    float* data;
-    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
-        return 0;
-    for (uint32_t i = 0; i < len; i++) {
-        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
-        if (!val->IsNumber()) {
-            fastFree(data);
-            return 0;
-        }
-        data[i] = toFloat(val);
-    }
-    return data;
-}
-
-// Allocates new storage via tryFastMalloc.
-// Returns NULL if array failed to convert for any reason.
-static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
-{
-    // Convert the data element-by-element.
-    int* data;
-    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
-        return 0;
-    for (uint32_t i = 0; i < len; i++) {
-        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
-        bool ok;
-        int ival = toInt32(val, ok);
-        if (!ok) {
-            fastFree(data);
-            return 0;
-        }
-        data[i] = ival;
-    }
-    return data;
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferData)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.bufferData()");
-
-    // Forms:
-    // * bufferData(GLenum target, CanvasArray data, GLenum usage);
-    //   - Sets the buffer's data from the given CanvasArray
-    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
-    //   - Sets the size of the buffer to the given size in bytes
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int usage = toInt32(args[2], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (args[1]->IsInt32()) {
-        int size = toInt32(args[1]);
-        context->bufferData(target, size, usage);
-    } else if (V8CanvasArray::HasInstance(args[1])) {
-        CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[1]->ToObject());
-        context->bufferData(target, array, usage);
-    } else {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferSubData)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.bufferSubData()");
-
-    // Forms:
-    // * bufferSubData(GLenum target, GLintptr offset, CanvasArray data);
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int offset = toInt32(args[1], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (!V8CanvasArray::HasInstance(args[2])) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[2]->ToObject());
-    context->bufferSubData(target, offset, array);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexImage2D)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.texImage2D()");
-
-    // Currently supported forms:
-    // * void texImage2D(in GLenum target, in GLint level,
-    //                   in GLint internalformat,
-    //                   in GLsizei width, in GLsizei height, in GLint border,
-    //                   in GLenum format, in GLenum type, in CanvasArray pixels);
-    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
-    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
-    if (args.Length() != 3 &&
-        args.Length() != 4 &&
-        args.Length() != 5 &&
-        args.Length() != 9) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int target = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    int level = toInt32(args[1], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    ExceptionCode ec = 0;
-    if (args.Length() == 3 ||
-        args.Length() == 4 ||
-        args.Length() == 5) {
-        v8::Handle<v8::Value> arg = args[2];
-        if (V8HTMLImageElement::HasInstance(arg)) {
-            HTMLImageElement* image_element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
-            bool flipY = false;
-            bool premultiplyAlpha = false;
-            if (args.Length() >= 4)
-                flipY = args[3]->BooleanValue();
-            if (args.Length() >= 5)
-                premultiplyAlpha = args[4]->BooleanValue();
-            context->texImage2D(target, level, image_element, flipY, premultiplyAlpha, ec);
-        } else {
-            // FIXME: consider different / better exception type.
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        // Fall through
-    } else if (args.Length() == 9) {
-        int internalformat = toInt32(args[2], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int width = toInt32(args[3], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int height = toInt32(args[4], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int border = toInt32(args[5], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int format = toInt32(args[6], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        int type = toInt32(args[7], ok);
-        if (!ok) {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-        v8::Handle<v8::Value> arg = args[8];
-        if (V8CanvasArray::HasInstance(arg)) {
-            CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, arg->ToObject());
-            // FIXME: must do validation similar to JOGL's to ensure that
-            // the incoming array is of the appropriate length and type
-            context->texImage2D(target,
-                                level,
-                                internalformat,
-                                width,
-                                height,
-                                border,
-                                format,
-                                type,
-                                array,
-                                ec);
-            // Fall through
-        } else {
-            V8Proxy::setDOMException(SYNTAX_ERR);
-            return notHandledByInterceptor();
-        }
-    } else {
-        ASSERT_NOT_REACHED();
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (ec) {
-        V8Proxy::setDOMException(ec);
-        return v8::Handle<v8::Value>();
-    }
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexSubImage2D)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.texSubImage2D()");
-
-    // FIXME: implement
-    notImplemented();
-
-    return v8::Undefined();
-}
-
-enum FunctionToCall {
-    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
-    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
-};
-
-static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
-                                                           FunctionToCall functionToCall) {
-    // Forms:
-    // * glUniform1fv(GLint location, Array data);
-    // * glUniform1fv(GLint location, CanvasFloatArray data);
-    // * glUniform2fv(GLint location, Array data);
-    // * glUniform2fv(GLint location, CanvasFloatArray data);
-    // * glUniform3fv(GLint location, Array data);
-    // * glUniform3fv(GLint location, CanvasFloatArray data);
-    // * glUniform4fv(GLint location, Array data);
-    // * glUniform4fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib1fv(GLint location, Array data);
-    // * glVertexAttrib1fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib2fv(GLint location, Array data);
-    // * glVertexAttrib2fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib3fv(GLint location, Array data);
-    // * glVertexAttrib3fv(GLint location, CanvasFloatArray data);
-    // * glVertexAttrib4fv(GLint location, Array data);
-    // * glVertexAttrib4fv(GLint location, CanvasFloatArray data);
-
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (V8CanvasFloatArray::HasInstance(args[1])) {
-        CanvasFloatArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[1]->ToObject());
-        ASSERT(array != NULL);
-        switch (functionToCall) {
-            case kUniform1v: context->uniform1fv(location, array); break;
-            case kUniform2v: context->uniform2fv(location, array); break;
-            case kUniform3v: context->uniform3fv(location, array); break;
-            case kUniform4v: context->uniform4fv(location, array); break;
-            case kVertexAttrib1v: context->vertexAttrib1fv(location, array); break;
-            case kVertexAttrib2v: context->vertexAttrib2fv(location, array); break;
-            case kVertexAttrib3v: context->vertexAttrib3fv(location, array); break;
-            case kVertexAttrib4v: context->vertexAttrib4fv(location, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    float* data = jsArrayToFloatArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (functionToCall) {
-        case kUniform1v: context->uniform1fv(location, data, len); break;
-        case kUniform2v: context->uniform2fv(location, data, len); break;
-        case kUniform3v: context->uniform3fv(location, data, len); break;
-        case kUniform4v: context->uniform4fv(location, data, len); break;
-        case kVertexAttrib1v: context->vertexAttrib1fv(location, data, len); break;
-        case kVertexAttrib2v: context->vertexAttrib2fv(location, data, len); break;
-        case kVertexAttrib3v: context->vertexAttrib3fv(location, data, len); break;
-        case kVertexAttrib4v: context->vertexAttrib4fv(location, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
-                                            FunctionToCall functionToCall) {
-    // Forms:
-    // * glUniform1iv(GLint location, Array data);
-    // * glUniform1iv(GLint location, CanvasIntArray data);
-    // * glUniform2iv(GLint location, Array data);
-    // * glUniform2iv(GLint location, CanvasIntArray data);
-    // * glUniform3iv(GLint location, Array data);
-    // * glUniform3iv(GLint location, CanvasIntArray data);
-    // * glUniform4iv(GLint location, Array data);
-    // * glUniform4iv(GLint location, CanvasIntArray data);
-
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    if (V8CanvasIntArray::HasInstance(args[1])) {
-        CanvasIntArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, args[1]->ToObject());
-        ASSERT(array != NULL);
-        switch (functionToCall) {
-            case kUniform1v: context->uniform1iv(location, array); break;
-            case kUniform2v: context->uniform2iv(location, array); break;
-            case kUniform3v: context->uniform3iv(location, array); break;
-            case kUniform4v: context->uniform4iv(location, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[1]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    int* data = jsArrayToIntArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (functionToCall) {
-        case kUniform1v: context->uniform1iv(location, data, len); break;
-        case kUniform2v: context->uniform2iv(location, data, len); break;
-        case kUniform3v: context->uniform3iv(location, data, len); break;
-        case kUniform4v: context->uniform4iv(location, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform1fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform1iv()");
-    return uniformHelperi(args, kUniform1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform2fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform2iv()");
-    return uniformHelperi(args, kUniform2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform3fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform3iv()");
-    return uniformHelperi(args, kUniform3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform4fv()");
-    return vertexAttribAndUniformHelperf(args, kUniform4v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4iv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniform4iv()");
-    return uniformHelperi(args, kUniform4v);
-}
-
-static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
-                                                 int matrixSize)
-{
-    // Forms:
-    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix2fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix3fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix4fv(GLint location, GLboolean transpose, CanvasFloatArray data);
-    //
-    // FIXME: need to change to accept CanvasFloatArray as well.
-    if (args.Length() != 3) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-
-    CanvasRenderingContext3D* context =
-        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
-    bool ok;
-    int location = toInt32(args[0], ok);
-    if (!ok) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    bool transpose = args[1]->BooleanValue();
-    if (V8CanvasFloatArray::HasInstance(args[2])) {
-        CanvasFloatArray* array = 
-            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[2]->ToObject());
-        ASSERT(array != NULL);
-        switch (matrixSize) {
-            case 2: context->uniformMatrix2fv(location, transpose, array); break;
-            case 3: context->uniformMatrix3fv(location, transpose, array); break;
-            case 4: context->uniformMatrix4fv(location, transpose, array); break;
-            default: ASSERT_NOT_REACHED(); break;
-        }
-        return v8::Undefined();
-    }
-
-    v8::Handle<v8::Array> array =
-      v8::Local<v8::Array>::Cast(args[2]);
-    if (array.IsEmpty()) {
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    uint32_t len = array->Length();
-    float* data = jsArrayToFloatArray(array, len);
-    if (!data) {
-        // FIXME: consider different / better exception type.
-        V8Proxy::setDOMException(SYNTAX_ERR);
-        return notHandledByInterceptor();
-    }
-    switch (matrixSize) {
-        case 2: context->uniformMatrix2fv(location, transpose, data, len); break;
-        case 3: context->uniformMatrix3fv(location, transpose, data, len); break;
-        case 4: context->uniformMatrix4fv(location, transpose, data, len); break;
-        default: ASSERT_NOT_REACHED(); break;
-    }
-    fastFree(data);
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix2fv()");
-    return uniformMatrixHelper(args, 2);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix3fv()");
-    return uniformMatrixHelper(args, 3);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix4fv()");
-    return uniformMatrixHelper(args, 4);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib1fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib1fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib2fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib2fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib3fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib3fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
-}
-
-CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib4fv)
-{
-    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib4fv()");
-    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index 5fe2710..b44e074 100644
--- a/WebCore/bindings/v8/custom/V8CanvasPixelArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -29,37 +29,28 @@
  */
 
 #include "config.h"
-#include "CanvasPixelArray.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
+#include <v8.h>
 
 namespace WebCore {
 
-// Get the specified value from the pixel buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasPixelArray)
+CALLBACK_FUNC_DECL(ConsoleProfile)
 {
-    INC_STATS("DOM.CanvasPixelArray.IndexedPropertyGetter");
-    CanvasPixelArray* pixelBuffer = V8DOMWrapper::convertToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
-
-    if ((index < 0) || (index >= pixelBuffer->length()))
-        return v8::Undefined();
-    unsigned char result;
-    if (!pixelBuffer->get(index, result))
-        return v8::Undefined();
-    return v8::Number::New(result);
+    INC_STATS("console.profile()");
+    v8::HandleScope scope;
+    v8::Context::Scope context_scope(v8::Context::GetCurrent());
+    v8::V8::ResumeProfiler();
+    return v8::Undefined();
 }
 
-// Set the specified value in the pixel buffer. Accesses outside the valid pixel buffer range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasPixelArray)
+CALLBACK_FUNC_DECL(ConsoleProfileEnd)
 {
-    INC_STATS("DOM.CanvasPixelArray.IndexedPropertySetter");
-    CanvasPixelArray* pixelBuffer = V8DOMWrapper::convertToNativeObject<CanvasPixelArray>(V8ClassIndex::CANVASPIXELARRAY, info.Holder());
-
-    if ((index >= 0) && (index < pixelBuffer->length()))
-        pixelBuffer->set(index, value->NumberValue());
-    return value;
+    INC_STATS("console.profileEnd()");
+    v8::V8::PauseProfiler();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.h b/WebCore/bindings/v8/custom/V8CustomBinding.h
index 06182c9..e7670b7 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.h
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.h
@@ -120,8 +120,7 @@ namespace WebCore {
         static const int kMessageChannelInternalFieldCount = kDefaultWrapperInternalFieldCount + 2;
 
         static const int kMessagePortRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
-        static const int kMessagePortEntangledPortIndex = kDefaultWrapperInternalFieldCount + 1;
-        static const int kMessagePortInternalFieldCount = kDefaultWrapperInternalFieldCount + 2;
+        static const int kMessagePortInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 
 #if ENABLE(WORKERS)
         static const int kAbstractWorkerRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
@@ -169,10 +168,13 @@ namespace WebCore {
         static const int kDOMWindowLocationIndex = kDefaultWrapperInternalFieldCount + 11;
         static const int kDOMWindowDOMSelectionIndex = kDefaultWrapperInternalFieldCount + 12;
         static const int kDOMWindowEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 13;
-        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 14;
+        static const int kDOMWindowEnteredIsolatedWorldIndex = kDefaultWrapperInternalFieldCount + 14;
+        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 15;
 
         static const int kStyleSheetOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kStyleSheetInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+        static const int kNamedNodeMapOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kNamedNodeMapInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         static const int kDOMApplicationCacheCacheIndex = kDefaultWrapperInternalFieldCount + 0;
@@ -363,35 +365,43 @@ namespace WebCore {
         DECLARE_CALLBACK(CanvasRenderingContext2DPutImageData);
 
 #if ENABLE(3D_CANVAS)
-        DECLARE_CALLBACK(CanvasRenderingContext3DBufferData);
-        DECLARE_CALLBACK(CanvasRenderingContext3DBufferSubData);
-        DECLARE_CALLBACK(CanvasRenderingContext3DSizeof);
-        DECLARE_CALLBACK(CanvasRenderingContext3DTexImage2D);
-        DECLARE_CALLBACK(CanvasRenderingContext3DTexSubImage2D);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4iv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix4fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib1fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib2fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib3fv);
-        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib4fv);
-
-        DECLARE_CALLBACK(CanvasArrayBufferConstructor);
-        DECLARE_CALLBACK(CanvasByteArrayConstructor);
-        DECLARE_CALLBACK(CanvasFloatArrayConstructor);
-        DECLARE_CALLBACK(CanvasIntArrayConstructor);
-        DECLARE_CALLBACK(CanvasShortArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedByteArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedIntArrayConstructor);
-        DECLARE_CALLBACK(CanvasUnsignedShortArrayConstructor);
+        DECLARE_CALLBACK(WebGLRenderingContextBufferData);
+        DECLARE_CALLBACK(WebGLRenderingContextBufferSubData);
+        DECLARE_CALLBACK(WebGLRenderingContextGetBufferParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetFramebufferAttachmentParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetProgramParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetRenderbufferParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetShaderParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetTexParameter);
+        DECLARE_CALLBACK(WebGLRenderingContextGetUniform);
+        DECLARE_CALLBACK(WebGLRenderingContextGetVertexAttrib);
+        DECLARE_CALLBACK(WebGLRenderingContextTexImage2D);
+        DECLARE_CALLBACK(WebGLRenderingContextTexSubImage2D);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform1fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform1iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform2iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform3iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform4fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniform4iv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextUniformMatrix4fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib1fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib2fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib3fv);
+        DECLARE_CALLBACK(WebGLRenderingContextVertexAttrib4fv);
+
+        DECLARE_CALLBACK(WebGLArrayBufferConstructor);
+        DECLARE_CALLBACK(WebGLByteArrayConstructor);
+        DECLARE_CALLBACK(WebGLFloatArrayConstructor);
+        DECLARE_CALLBACK(WebGLIntArrayConstructor);
+        DECLARE_CALLBACK(WebGLShortArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedByteArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedIntArrayConstructor);
+        DECLARE_CALLBACK(WebGLUnsignedShortArrayConstructor);
 #endif
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(ClipboardTypes);
@@ -407,6 +417,9 @@ namespace WebCore {
         DECLARE_CALLBACK(ElementSetAttributeNS);
         DECLARE_CALLBACK(ElementSetAttributeNodeNS);
 
+        DECLARE_CALLBACK(HistoryPushState);
+        DECLARE_CALLBACK(HistoryReplaceState);
+
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationProtocol);
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationHost);
         DECLARE_PROPERTY_ACCESSOR_SETTER(LocationHostname);
@@ -423,7 +436,6 @@ namespace WebCore {
         DECLARE_CALLBACK(LocationReload);
         DECLARE_CALLBACK(LocationToString);
         DECLARE_CALLBACK(LocationValueOf);
-
         DECLARE_CALLBACK(NodeAddEventListener);
         DECLARE_CALLBACK(NodeRemoveEventListener);
         DECLARE_CALLBACK(NodeInsertBefore);
@@ -469,29 +481,25 @@ namespace WebCore {
         DECLARE_CALLBACK(TreeWalkerNextSibling);
         DECLARE_CALLBACK(TreeWalkerPreviousSibling);
 
-        DECLARE_CALLBACK(InspectorBackendHighlightDOMNode);
-        DECLARE_CALLBACK(InspectorBackendAddResourceSourceToFrame);
-        DECLARE_CALLBACK(InspectorBackendAddSourceToFrame);
-        DECLARE_CALLBACK(InspectorBackendSearch);
-        DECLARE_CALLBACK(InspectorBackendSetting);
-        DECLARE_CALLBACK(InspectorBackendDatabaseForId);
-        DECLARE_CALLBACK(InspectorBackendInspectedWindow);
-        DECLARE_CALLBACK(InspectorBackendSetSetting);
-        DECLARE_CALLBACK(InspectorBackendCurrentCallFrame);
-        DECLARE_CALLBACK(InspectorBackendDebuggerEnabled);
-        DECLARE_CALLBACK(InspectorBackendPauseOnExceptions);
-        DECLARE_CALLBACK(InspectorBackendProfilerEnabled);
-        DECLARE_CALLBACK(InspectorBackendNodeForId);
-        DECLARE_CALLBACK(InspectorBackendWrapObject);
-        DECLARE_CALLBACK(InspectorBackendUnwrapObject);
-        DECLARE_CALLBACK(InspectorBackendPushNodePathToFrontend);
+        DECLARE_CALLBACK(InjectedScriptHostInspectedWindow);
+        DECLARE_CALLBACK(InjectedScriptHostNodeForId);
+        DECLARE_CALLBACK(InjectedScriptHostWrapObject);
+        DECLARE_CALLBACK(InjectedScriptHostUnwrapObject);
+        DECLARE_CALLBACK(InjectedScriptHostPushNodePathToFrontend);
+        DECLARE_CALLBACK(InjectedScriptHostWrapCallback);
 #if ENABLE(DATABASE)
-        DECLARE_CALLBACK(InspectorBackendSelectDatabase);
+        DECLARE_CALLBACK(InjectedScriptHostSelectDatabase);
+        DECLARE_CALLBACK(InjectedScriptHostDatabaseForId);
 #endif
 #if ENABLE(DOM_STORAGE)
-        DECLARE_CALLBACK(InspectorBackendSelectDOMStorage);
+        DECLARE_CALLBACK(InjectedScriptHostSelectDOMStorage);
 #endif
-        DECLARE_CALLBACK(InspectorBackendWrapCallback);
+
+        DECLARE_CALLBACK(InspectorFrontendHostSearch);
+        DECLARE_CALLBACK(InspectorFrontendHostShowContextMenu);
+
+        DECLARE_CALLBACK(ConsoleProfile);
+        DECLARE_CALLBACK(ConsoleProfileEnd);
 
         DECLARE_CALLBACK(NodeIteratorNextNode);
         DECLARE_CALLBACK(NodeIteratorPreviousNode);
@@ -529,31 +537,40 @@ namespace WebCore {
         DECLARE_NAMED_PROPERTY_GETTER(HTMLCollection);
 
 #if ENABLE(3D_CANVAS)
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasByteArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasByteArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasFloatArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasFloatArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasIntArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasIntArray);
-#endif
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasPixelArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasPixelArray);
-
-#if ENABLE(3D_CANVAS)
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasShortArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasShortArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray);
-
-        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray);
-        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray);
+        DECLARE_CALLBACK(WebGLByteArrayGet);
+        DECLARE_CALLBACK(WebGLByteArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLByteArray);
+
+        DECLARE_CALLBACK(WebGLFloatArrayGet);
+        DECLARE_CALLBACK(WebGLFloatArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLFloatArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLFloatArray);
+
+        DECLARE_CALLBACK(WebGLIntArrayGet);
+        DECLARE_CALLBACK(WebGLIntArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLIntArray);
+
+        DECLARE_CALLBACK(WebGLShortArrayGet);
+        DECLARE_CALLBACK(WebGLShortArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLShortArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedByteArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedByteArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedByteArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedIntArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedIntArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedIntArray);
+
+        DECLARE_CALLBACK(WebGLUnsignedShortArrayGet);
+        DECLARE_CALLBACK(WebGLUnsignedShortArraySet);
+        DECLARE_INDEXED_PROPERTY_GETTER(WebGLUnsignedShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(WebGLUnsignedShortArray);
 #endif
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(MessageEventPorts);
@@ -600,6 +617,7 @@ namespace WebCore {
 #if ENABLE(SVG)
         DECLARE_PROPERTY_ACCESSOR_GETTER(SVGLengthValue);
         DECLARE_CALLBACK(SVGLengthConvertToSpecifiedUnits);
+        DECLARE_CALLBACK(SVGMatrixMultiply);
         DECLARE_CALLBACK(SVGMatrixInverse);
         DECLARE_CALLBACK(SVGMatrixRotateFromVector);
         DECLARE_CALLBACK(SVGElementInstanceAddEventListener);
@@ -648,6 +666,7 @@ namespace WebCore {
 #endif // ENABLE(NOTIFICATIONS)
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowApplicationCache);
         DECLARE_PROPERTY_ACCESSOR(DOMApplicationCacheEventHandler);
         DECLARE_CALLBACK(DOMApplicationCacheAddEventListener);
         DECLARE_CALLBACK(DOMApplicationCacheRemoveEventListener);
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 17c86a3..24d752f 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
-    : V8AbstractEventListener(guard, isAttribute)
+V8EventListener::V8EventListener(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext)
+    : V8AbstractEventListener(isAttribute, worldContext)
 {
     setListenerObject(listener);
 }
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index dc9d33b..f9d5385 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,13 +44,13 @@ namespace WebCore {
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+        static PassRefPtr<V8EventListener> create(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8EventListener(guard, listener, isAttribute));
+            return adoptRef(new V8EventListener(listener, isAttribute, worldContext));
         }
 
     protected:
-        V8EventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
+        V8EventListener(v8::Local<v8::Object> listener, bool isAttribute, const WorldContextHandle& worldContext);
 
         v8::Local<v8::Function> getListenerFunction(ScriptExecutionContext*);
 
diff --git a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
index 3341924..e45cba0 100644
--- a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.cpp
@@ -38,13 +38,14 @@
 
 namespace WebCore {
 
-PassRefPtr<V8CustomXPathNSResolver> V8CustomXPathNSResolver::create(v8::Handle<v8::Object> resolver)
+PassRefPtr<V8CustomXPathNSResolver> V8CustomXPathNSResolver::create(V8Proxy* proxy, v8::Handle<v8::Object> resolver)
 {
-    return adoptRef(new V8CustomXPathNSResolver(resolver));
+    return adoptRef(new V8CustomXPathNSResolver(proxy, resolver));
 }
 
-V8CustomXPathNSResolver::V8CustomXPathNSResolver(v8::Handle<v8::Object> resolver)
-    : m_resolver(resolver)
+V8CustomXPathNSResolver::V8CustomXPathNSResolver(V8Proxy* proxy, v8::Handle<v8::Object> resolver)
+        : m_proxy(proxy)
+        , m_resolver(resolver)
 {
 }
 
@@ -54,6 +55,14 @@ V8CustomXPathNSResolver::~V8CustomXPathNSResolver()
 
 String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
+    V8Proxy* proxy = m_proxy;
+
+    if (!proxy) {
+        proxy = V8Proxy::retrieve();
+        if (!proxy)
+            return String();
+    }
+
     v8::Handle<v8::Function> lookupNamespaceURIFunc;
     v8::Handle<v8::String> lookupNamespaceURIName = v8::String::New("lookupNamespaceURI");
 
@@ -65,7 +74,7 @@ String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     }
 
     if (lookupNamespaceURIFunc.IsEmpty() && !m_resolver->IsFunction()) {
-        Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
+        Frame* frame = proxy->frame();
         logInfo(frame, "XPathNSResolver does not have a lookupNamespaceURI method.", String());
         return String();
     }
@@ -78,7 +87,6 @@ String V8CustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     v8::Handle<v8::Value> argv[argc] = { v8String(prefix) };
     v8::Handle<v8::Function> function = lookupNamespaceURIFunc.IsEmpty() ? v8::Handle<v8::Function>::Cast(m_resolver) : lookupNamespaceURIFunc;
 
-    V8Proxy* proxy = V8Proxy::retrieve();
     v8::Handle<v8::Value> retval = proxy->callFunction(function, m_resolver, argc, argv);
 
     // Eat exceptions from namespace resolver and return an empty string. This will most likely cause NAMESPACE_ERR.
diff --git a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
index f1dc65c..15ac27d 100644
--- a/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
+++ b/WebCore/bindings/v8/custom/V8CustomXPathNSResolver.h
@@ -42,17 +42,22 @@
 namespace WebCore {
 
 class String;
+class V8Proxy;
 
+// V8CustomXPathNSResolver does not create a persistent handle to the
+// given resolver object.  So the lifetime of V8CustomXPathNSResolver
+// must not exceed the lifetime of the passed handle.
 class V8CustomXPathNSResolver : public XPathNSResolver {
 public:
-    static PassRefPtr<V8CustomXPathNSResolver> create(v8::Handle<v8::Object> resolver);
+    static PassRefPtr<V8CustomXPathNSResolver> create(V8Proxy* proxy, v8::Handle<v8::Object> resolver);
 
     virtual ~V8CustomXPathNSResolver();
     virtual String lookupNamespaceURI(const String& prefix);
 
 private:
-    V8CustomXPathNSResolver(v8::Handle<v8::Object> resolver);
+    V8CustomXPathNSResolver(V8Proxy* proxy, v8::Handle<v8::Object> resolver);
 
+    V8Proxy* m_proxy;
     v8::Handle<v8::Object> m_resolver;  // Handle to resolver object.
 };
 
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 25d5ccd..46c33b9 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -46,7 +46,6 @@
 #include "FrameView.h"
 #include "HTMLCollection.h"
 #include "MediaPlayer.h"
-#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RuntimeEnabledFeatures.h"
@@ -176,6 +175,9 @@ ACCESSOR_GETTER(DOMWindowEvent)
         return v8::Undefined();
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return v8::Undefined();
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
     if (jsEvent.IsEmpty())
@@ -194,6 +196,9 @@ ACCESSOR_SETTER(DOMWindowEvent)
         return;
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return;
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
@@ -306,7 +311,14 @@ ACCESSOR_RUNTIME_ENABLER(DOMWindowSessionStorage)
 #if ENABLE(NOTIFICATIONS)
 ACCESSOR_RUNTIME_ENABLER(DOMWindowWebkitNotifications)
 {
-    return NotificationCenter::isAvailable();
+    return RuntimeEnabledFeatures::notificationsEnabled();
+}
+#endif
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowApplicationCache)
+{
+    return RuntimeEnabledFeatures::applicationCacheEnabled();
 }
 #endif
 
@@ -538,6 +550,10 @@ static Frame* createWindow(Frame* callingFrame,
     ASSERT(callingFrame);
     ASSERT(enteredFrame);
 
+    // Sandboxed iframes cannot open new auxiliary browsing contexts.
+    if (callingFrame && callingFrame->loader()->isSandboxed(SandboxNavigation))
+        return 0;
+
     ResourceRequest request;
 
     // For whatever reason, Firefox uses the entered frame to determine
@@ -696,14 +712,15 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
     if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
-    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
-    if (!callingFrame)
-        return v8::Undefined();
-
     Frame* enteredFrame = V8Proxy::retrieveFrameForEnteredContext();
     if (!enteredFrame)
         return v8::Undefined();
 
+    Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
+    // We may not have a calling context if we are invoked by a plugin via NPAPI.
+    if (!callingFrame)
+        callingFrame = enteredFrame;
+
     Page* page = frame->page();
     if (!page)
         return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 8b77a3a..ee68293 100644
--- a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -64,7 +64,7 @@ CALLBACK_FUNC_DECL(DocumentEvaluate)
     if (V8Node::HasInstance(args[1]))
         contextNode = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[1]));
 
-    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
+    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2], V8Proxy::retrieve(V8Proxy::retrieveFrameForCallingContext()));
     if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
         return throwError(TYPE_MISMATCH_ERR);
 
@@ -104,7 +104,7 @@ CALLBACK_FUNC_DECL(DocumentGetCSSCanvasContext)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
 #if ENABLE(3D_CANVAS)
     else if (result->is3d())
-        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERINGCONTEXT, result);
 #endif // ENABLE(3D_CANVAS)
     ASSERT_NOT_REACHED();
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 4116673..e51437e 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -53,7 +53,7 @@ CALLBACK_FUNC_DECL(HTMLCanvasElementGetContext)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
 #if ENABLE(3D_CANVAS)
     else if (result->is3d())
-        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERINGCONTEXT, result);
 #endif
     ASSERT_NOT_REACHED();
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index afc9ed1..9cf2f3d 100644
--- a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -120,8 +120,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentWrite)
     INC_STATS("DOM.HTMLDocument.write()");
     HTMLDocument* htmlDocument = V8DOMWrapper::convertDOMWrapperToNode<HTMLDocument>(args.Holder());
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    ASSERT(frame);
-    htmlDocument->write(writeHelperGetString(args), frame->document());
+    htmlDocument->write(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
 
@@ -130,8 +129,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentWriteln)
     INC_STATS("DOM.HTMLDocument.writeln()");
     HTMLDocument* htmlDocument = V8DOMWrapper::convertDOMWrapperToNode<HTMLDocument>(args.Holder());
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    ASSERT(frame);
-    htmlDocument->writeln(writeHelperGetString(args), frame->document());
+    htmlDocument->writeln(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
 
@@ -170,7 +168,7 @@ CALLBACK_FUNC_DECL(HTMLDocumentOpen)
     }
 
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
-    htmlDocument->open(frame->document());
+    htmlDocument->open(frame ? frame->document() : NULL);
     // Return the document.
     return args.Holder();
 }
diff --git a/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
new file mode 100644
index 0000000..c884d15
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "History.h"
+
+#include "ExceptionCode.h"
+#include "SerializedScriptValue.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+CALLBACK_FUNC_DECL(HistoryPushState)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(toWebCoreString(args[0]));
+
+    v8::TryCatch tryCatch;
+    String title = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
+    if (tryCatch.HasCaught())
+        return v8::Undefined();
+    String url;
+    if (args.Length() > 2) {
+        url = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+        if (tryCatch.HasCaught())
+            return v8::Undefined();
+    }
+
+    ExceptionCode ec = 0;
+    History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, args.Holder());
+    history->stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    return throwError(ec);
+}
+
+CALLBACK_FUNC_DECL(HistoryReplaceState)
+{
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(toWebCoreString(args[0]));
+
+    v8::TryCatch tryCatch;
+    String title = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
+    if (tryCatch.HasCaught())
+        return v8::Undefined();
+    String url;
+    if (args.Length() > 2) {
+        url = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+        if (tryCatch.HasCaught())
+            return v8::Undefined();
+    }
+
+    ExceptionCode ec = 0;
+    History* history = V8DOMWrapper::convertToNativeObject<History>(V8ClassIndex::HISTORY, args.Holder());
+    history->stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    return throwError(ec);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
new file mode 100644
index 0000000..fac6733
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#include "Database.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "InspectorController.h"
+#include "Node.h"
+#include "Page.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(InjectedScriptHostInspectedWindow)
+{
+    INC_STATS("InjectedScriptHost.inspectedWindow()");
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    InspectorController* ic = host->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<DOMWindow>(V8ClassIndex::DOMWINDOW, ic->inspectedPage()->mainFrame()->domWindow());
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostWrapCallback)
+{
+    INC_STATS("InjectedScriptHost.wrapCallback()");
+    return args[0];
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostNodeForId)
+{
+    INC_STATS("InjectedScriptHost.nodeForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    
+    Node* node = host->nodeForId(args[0]->ToInt32()->Value());
+    if (!node)
+        return v8::Undefined();
+
+    InspectorController* ic = host->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostWrapObject)
+{
+    INC_STATS("InjectedScriptHost.wrapObject()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    return host->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostUnwrapObject)
+{
+    INC_STATS("InjectedScriptHost.unwrapObject()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    return host->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostPushNodePathToFrontend)
+{
+    INC_STATS("InjectedScriptHost.pushNodePathToFrontend()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    bool selectInUI = args[1]->ToBoolean()->Value();
+    if (node)
+        return v8::Number::New(host->pushNodePathToFrontend(node, selectInUI));
+
+    return v8::Undefined();
+}
+
+#if ENABLE(DATABASE)
+CALLBACK_FUNC_DECL(InjectedScriptHostDatabaseForId)
+{
+    INC_STATS("InjectedScriptHost.databaseForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Database* database = host->databaseForId(args[0]->ToInt32()->Value());
+    if (!database)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
+}
+
+CALLBACK_FUNC_DECL(InjectedScriptHostSelectDatabase)
+{
+    INC_STATS("InjectedScriptHost.selectDatabase()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (database)
+        host->selectDatabase(database);
+
+    return v8::Undefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+CALLBACK_FUNC_DECL(InjectedScriptHostSelectDOMStorage)
+{
+    INC_STATS("InjectedScriptHost.selectDOMStorage()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InjectedScriptHost* host = V8DOMWrapper::convertToNativeObject<InjectedScriptHost>(V8ClassIndex::INJECTEDSCRIPTHOST, args.Holder());
+    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (storage)
+        host->selectDOMStorage(storage);
+
+    return v8::Undefined();
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
deleted file mode 100644
index ec9b034..0000000
--- a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
+++ /dev/null
@@ -1,306 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "InspectorBackend.h"
-
-#include "Database.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "ExceptionCode.h"
-#include "InspectorController.h"
-#include "InspectorResource.h"
-#include "NotImplemented.h"
-#include "Node.h"
-#include "Range.h"
-#include "Page.h"
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-
-#include "V8Binding.h"
-#include "V8CustomBinding.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-CALLBACK_FUNC_DECL(InspectorBackendHighlightDOMNode)
-{
-    INC_STATS("InspectorBackend.highlightDOMNode()");
-
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    inspectorBackend->highlight(args[0]->ToInt32()->Value());
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSearch)
-{
-    INC_STATS("InspectorBackend.search()");
-
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    if (!node)
-        return v8::Undefined();
-
-    String target = toWebCoreStringWithNullCheck(args[1]);
-    if (target.isEmpty())
-        return v8::Undefined();
-
-    v8::Local<v8::Array> result = v8::Array::New();
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    int index = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        result->Set(v8::Number::New(index++), V8DOMWrapper::convertToV8Object(V8ClassIndex::RANGE, resultRange.release()));
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return result;
-}
-
-#if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendDatabaseForId)
-{
-    INC_STATS("InspectorBackend.databaseForId()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Database* database = inspectorBackend->databaseForId(args[0]->ToInt32()->Value());
-    if (!database)
-        return v8::Undefined();
-    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
-}
-#endif
-
-CALLBACK_FUNC_DECL(InspectorBackendInspectedWindow)
-{
-    INC_STATS("InspectorBackend.inspectedWindow()");
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-    return V8DOMWrapper::convertToV8Object<DOMWindow>(V8ClassIndex::DOMWINDOW, ic->inspectedPage()->mainFrame()->domWindow());
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSetting)
-{
-    INC_STATS("InspectorBackend.setting()");
-
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    String key = toWebCoreStringWithNullCheck(args[0]);
-    if (key.isEmpty())
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-    const InspectorController::Setting& setting = ic->setting(key);
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return v8::Undefined();
-        case InspectorController::Setting::StringType:
-            return v8String(setting.string());
-        case InspectorController::Setting::DoubleType:
-            return v8::Number::New(setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return v8::Number::New(setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return v8Boolean(setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            const Vector<String>& strings = setting.stringVector();
-            v8::Local<v8::Array> stringsArray = v8::Array::New(strings.size());
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringsArray->Set(v8::Number::New(i), v8String(strings[i]));
-            return stringsArray;
-        }
-    }
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendSetSetting)
-{
-    INC_STATS("InspectorBackend.setSetting()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    String key = toWebCoreStringWithNullCheck(args[0]);
-    if (key.isEmpty())
-        return v8::Undefined();
-
-    InspectorController::Setting setting;
-
-    v8::Local<v8::Value> value = args[1];
-    if (value->IsUndefined() || value->IsNull()) {
-        // Do nothing. The setting is already NoType.
-        ASSERT(setting.type() == InspectorController::Setting::NoType);
-    } else if (value->IsString())
-        setting.set(toWebCoreStringWithNullCheck(value));
-    else if (value->IsNumber())
-        setting.set(value->NumberValue());
-    else if (value->IsBoolean())
-        setting.set(value->BooleanValue());
-    else if (value->IsArray()) {
-        v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(value);
-        Vector<String> strings;
-        for (unsigned i = 0; i < v8Array->Length(); ++i) {
-            String item = toWebCoreString(v8Array->Get(v8::Integer::New(i)));
-            if (item.isEmpty())
-                return v8::Undefined();
-            strings.append(item);
-        }
-        setting.set(strings);
-    } else
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (ic)
-        inspectorBackend->inspectorController()->setSetting(key, setting);
-
-    return v8::Undefined();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendWrapCallback)
-{
-    INC_STATS("InspectorBackend.wrapCallback()");
-    return args[0];
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendNodeForId)
-{
-    INC_STATS("InspectorBackend.nodeForId()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    
-    Node* node = inspectorBackend->nodeForId(args[0]->ToInt32()->Value());
-    if (!node)
-        return v8::Undefined();
-
-    InspectorController* ic = inspectorBackend->inspectorController();
-    if (!ic)
-        return v8::Undefined();
-
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendWrapObject)
-{
-    INC_STATS("InspectorBackend.wrapObject()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    return inspectorBackend->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendUnwrapObject)
-{
-    INC_STATS("InspectorBackend.unwrapObject()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    return inspectorBackend->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
-}
-
-CALLBACK_FUNC_DECL(InspectorBackendPushNodePathToFrontend)
-{
-    INC_STATS("InspectorBackend.pushNodePathToFrontend()");
-    if (args.Length() < 2)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    bool selectInUI = args[1]->ToBoolean()->Value();
-    if (node)
-        return v8::Number::New(inspectorBackend->pushNodePathToFrontend(node, selectInUI));
-
-    return v8::Undefined();
-}
-
-#if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendSelectDatabase)
-{
-    INC_STATS("InspectorBackend.selectDatabase()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
-    if (database)
-        inspectorBackend->selectDatabase(database);
-
-    return v8::Undefined();
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-CALLBACK_FUNC_DECL(InspectorBackendSelectDOMStorage)
-{
-    INC_STATS("InspectorBackend.selectDOMStorage()");
-    if (args.Length() < 1)
-        return v8::Undefined();
-
-    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
-    if (storage)
-        inspectorBackend->selectDOMStorage(storage);
-
-    return v8::Undefined();
-}
-#endif
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
new file mode 100644
index 0000000..15b45e9
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendHost.h"
+
+#include "ExceptionCode.h"
+#include "InspectorController.h"
+#include "Node.h"
+#include "Range.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(InspectorFrontendHostSearch)
+{
+    INC_STATS("InspectorFrontendHost.search()");
+
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    if (!node)
+        return v8::Undefined();
+
+    String target = toWebCoreStringWithNullCheck(args[1]);
+    if (target.isEmpty())
+        return v8::Undefined();
+
+    v8::Local<v8::Array> result = v8::Array::New();
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    int index = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result->Set(v8::Number::New(index++), V8DOMWrapper::convertToV8Object(V8ClassIndex::RANGE, resultRange.release()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return result;
+}
+
+CALLBACK_FUNC_DECL(InspectorFrontendHostShowContextMenu)
+{
+    return v8::Undefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index bd5fb4a..a1f20cc 100644
--- a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -82,15 +82,15 @@ CALLBACK_FUNC_DECL(NotificationCenterCreateHTMLNotification)
 {
     INC_STATS(L"DOM.NotificationCenter.CreateHTMLNotification()");
     NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
-    ScriptExecutionContext* context = notificationCenter->context();
+
     ExceptionCode ec = 0;
     String url = toWebCoreString(args[0]);
-    RefPtr<Notification> notification = Notification::create(url, context, ec, notificationCenter->presenter());
+    RefPtr<Notification> notification = notificationCenter->createHTMLNotification(url, ec);
 
     if (ec)
         return throwError(ec);
 
-    if (context->isWorkerContext())
+    if (notificationCenter->context()->isWorkerContext())
         return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
 
     return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
@@ -100,16 +100,14 @@ CALLBACK_FUNC_DECL(NotificationCenterCreateNotification)
 {
     INC_STATS(L"DOM.NotificationCenter.CreateNotification()");
     NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
-    NotificationContents contents(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]));
 
-    ScriptExecutionContext* context = notificationCenter->context();
     ExceptionCode ec = 0;
-    RefPtr<Notification> notification = Notification::create(contents, context, ec, notificationCenter->presenter());
+    RefPtr<Notification> notification = notificationCenter->createNotification(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]), ec);
 
     if (ec)
         return throwError(ec);
 
-    if (context->isWorkerContext())
+    if (notificationCenter->context()->isWorkerContext())
         return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
 
     return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
diff --git a/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp b/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
index 3766397..690eac1 100644
--- a/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SVGMatrixCustom.cpp
@@ -38,11 +38,27 @@
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
+#include "V8SVGMatrix.h"
 #include "V8SVGPODTypeWrapper.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
+CALLBACK_FUNC_DECL(SVGMatrixMultiply)
+{
+    INC_STATS("DOM.SVGMatrix.multiply()");
+    if (args.Length() < 1)
+        return throwError("Not enough arguments");
+
+    if (!V8SVGMatrix::HasInstance(args[0]))
+        return throwError("secondMatrix argument was not a SVGMatrix");
+
+    TransformationMatrix m1 = *V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<TransformationMatrix> >(V8ClassIndex::SVGMATRIX, args.Holder());
+    TransformationMatrix m2 = *V8DOMWrapper::convertToNativeObject<V8SVGPODTypeWrapper<TransformationMatrix> >(V8ClassIndex::SVGMATRIX, v8::Handle<v8::Object>::Cast(args[0]));
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::SVGMATRIX, V8SVGStaticPODTypeWrapper<TransformationMatrix>::create(m1.multLeft(m2)));
+}
+
 CALLBACK_FUNC_DECL(SVGMatrixInverse)
 {
     INC_STATS("DOM.SVGMatrix.inverse()");
diff --git a/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp b/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
index ecd0153..32a48eb 100644
--- a/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
@@ -29,6 +29,7 @@
  */
 
 #include "config.h"
+#include "HTMLStyleElement.h"
 #include "StyleSheetList.h"
 
 #include "V8Binding.h"
@@ -50,7 +51,7 @@ NAMED_PROPERTY_GETTER(StyleSheetList)
     if (!item)
         return notHandledByInterceptor();
 
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::HTMLSTYLEELEMENT, item);
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::STYLESHEET, item->sheet());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp
index 4a85e82..16a1f51 100644
--- a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLArrayBufferCustom.cpp
@@ -32,37 +32,50 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
+#include "V8WebGLArrayBuffer.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasArrayBufferConstructor)
+CALLBACK_FUNC_DECL(WebGLArrayBufferConstructor)
 {
-    INC_STATS("DOM.CanvasArrayBuffer.Contructor");
+    INC_STATS("DOM.WebGLArrayBuffer.Constructor");
 
     if (!args.IsConstructCall())
         return throwError("DOM object constructor cannot be called as a function.");
 
-    int argLen = args.Length();
+    // If we return a previously constructed WebGLArrayBuffer,
+    // e.g. from the call to WebGLArray.buffer, this code is called
+    // with a zero-length argument list. The V8DOMWrapper will then
+    // set the internal pointer in the newly-created object.
+    // Unfortunately it doesn't look like it's possible to distinguish
+    // between this case and that where the user calls "new
+    // WebGLArrayBuffer()" from JavaScript. To guard against problems,
+    // we always create at least a zero-length WebGLArrayBuffer, even
+    // if it is immediately overwritten by the V8DOMWrapper.
+
     // Supported constructors:
-    // CanvasArrayBuffer(n) where n is an integer:
+    // WebGLArrayBuffer(n) where n is an integer:
     //   -- create an empty buffer of n bytes
 
-    if (argLen != 1)
+    int argLen = args.Length();
+    if (argLen > 1)
         return throwError("Wrong number of arguments specified to constructor (requires 1)");
 
     int len = 0;
-    if (!args[0]->IsInt32())
-        return throwError("Argument to CanvasArrayBuffer constructor was not an integer");
-    len = toInt32(args[0]);
-    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(len);
+    if (argLen > 0) {
+        if (!args[0]->IsInt32())
+            return throwError("Argument to WebGLArrayBuffer constructor was not an integer");
+        len = toInt32(args[0]);
+    }
+
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(len);
     // Transform the holder into a wrapper object for the array.
-    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::CANVASARRAYBUFFER), buffer.get());
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::WEBGLARRAYBUFFER), buffer.get());
     return toV8(buffer.release(), args.Holder());
 }
 
diff --git a/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h b/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h
new file mode 100644
index 0000000..1a4b6a4
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebGLArrayCustom.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Template function used by the WebGLArray*Constructor callbacks.
+template<class ArrayClass>
+v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args,
+                                          int classIndex)
+{
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    int argLen = args.Length();
+    if (argLen == 0) {
+        // This happens when we return a previously constructed
+        // WebGLArray, e.g. from the call to WebGL<T>Array.slice().
+        // The V8DOMWrapper will set the internal pointer in the
+        // created object. Unfortunately it doesn't look like it's
+        // possible to distinguish between this case and that where
+        // the user calls "new WebGL<T>Array()" from JavaScript.
+        return args.Holder();
+    }
+
+    // Supported constructors:
+    // WebGL<T>Array(n) where n is an integer:
+    //   -- create an empty array of n elements
+    // WebGL<T>Array(arr) where arr is an array:
+    //   -- create a WebGL<T>Array containing the contents of "arr"
+    // WebGL<T>Array(buf, offset, length)
+    //   -- create a WebGL<T>Array pointing to the WebGLArrayBuffer
+    //      "buf", starting at the specified offset, for the given
+    //      length
+
+    // See whether the first argument is a WebGLArrayBuffer.
+    if (V8WebGLArrayBuffer::HasInstance(args[0])) {
+        if (argLen > 3)
+            return throwError("Wrong number of arguments to new WebGL<T>Array(WebGLArrayBuffer, int, int)");
+
+        WebGLArrayBuffer* buf =
+                V8DOMWrapper::convertToNativeObject<WebGLArrayBuffer>(V8ClassIndex::WEBGLARRAYBUFFER,
+                                                                      args[0]->ToObject());
+        if (buf == NULL)
+            return throwError("Could not convert argument 0 to a WebGLArrayBuffer");
+        bool ok;
+        int offset = 0;
+        if (argLen > 1) {
+            offset = toInt32(args[1], ok);
+            if (!ok)
+                return throwError("Could not convert argument 1 to an integer");
+        }
+        int length = buf->byteLength() - offset;
+        if (argLen > 2) {
+            length = toInt32(args[2], ok);
+            if (!ok)
+                return throwError("Could not convert argument 2 to an integer");
+        }
+        if (length < 0)
+            return throwError("Length / offset out of range");
+
+        RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
+        if (array == NULL)
+            return throwError("Invalid arguments to new WebGL<T>Array(WebGLArrayBuffer, int, int)");
+        // Transform the holder into a wrapper object for the array.
+        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+        V8DOMWrapper::setIndexedPropertiesToExternalArray(args.Holder(),
+                                                          classIndex,
+                                                          array.get()->baseAddress(),
+                                                          array.get()->length());
+        return toV8(array.release(), args.Holder());
+    }
+
+    int len = 0;
+    v8::Handle<v8::Object> srcArray;
+    if (argLen != 1)
+        return throwError("Wrong number of arguments to new WebGL<T>Array(int / array)");
+
+    if (args[0]->IsInt32()) {
+        len = toInt32(args[0]);
+    } else if (args[0]->IsObject()) {
+        srcArray = args[0]->ToObject();
+        if (srcArray.IsEmpty())
+            return throwError("Could not convert argument 0 to an object");
+        len = toInt32(srcArray->Get(v8::String::New("length")));
+    } else
+        return throwError("Could not convert argument 0 to either an int32 or an object");
+
+    RefPtr<ArrayClass> array = ArrayClass::create(len);
+    if (!srcArray.IsEmpty()) {
+        // Need to copy the incoming array into the newly created WebGLArray.
+        for (int i = 0; i < len; i++) {
+            v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
+            array->set(i, val->NumberValue());
+        }
+    }
+
+    // Transform the holder into a wrapper object for the array.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+    V8DOMWrapper::setIndexedPropertiesToExternalArray(args.Holder(),
+                                                      classIndex,
+                                                      array.get()->baseAddress(),
+                                                      array.get()->length());
+    return toV8(array.release(), args.Holder());
+}
+
+template <class T, typename ElementType>
+v8::Handle<v8::Value> getWebGLArrayElement(const v8::Arguments& args,
+                                           V8ClassIndex::V8WrapperType wrapperType)
+{
+    if (args.Length() != 1) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool ok;
+    uint32_t index = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    T* array = V8DOMWrapper::convertToNativeObject<T>(wrapperType, args.Holder());
+    if (index >= array->length())
+        return v8::Undefined();
+    ElementType result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+template <class T>
+v8::Handle<v8::Value> setWebGLArrayFromArray(T* webGLArray, const v8::Arguments& args)
+{
+    if (args[0]->IsObject()) {
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        v8::Local<v8::Object> array = args[0]->ToObject();
+        uint32_t offset = 0;
+        if (args.Length() == 2)
+            offset = toInt32(args[1]);
+        uint32_t length = toInt32(array->Get(v8::String::New("length")));
+        for (uint32_t i = 0; i < length; i++) {
+            webGLArray->set(offset + i, array->Get(v8::Integer::New(i))->NumberValue());
+        }
+    }
+
+    return v8::Undefined();
+}
+
+template <class CPlusPlusArrayType, class JavaScriptWrapperArrayType>
+v8::Handle<v8::Value> setWebGLArray(const v8::Arguments& args,
+                                    V8ClassIndex::V8WrapperType wrapperType)
+{
+    if (args.Length() < 1 || args.Length() > 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CPlusPlusArrayType* array = V8DOMWrapper::convertToNativeObject<CPlusPlusArrayType>(wrapperType, args.Holder());
+
+    if (args.Length() == 2 && args[0]->IsInt32()) {
+        // void set(in unsigned long index, in long value);
+        uint32_t index = toInt32(args[0]);
+        array->set(index, args[1]->NumberValue());
+        return v8::Undefined();
+    }
+
+    if (JavaScriptWrapperArrayType::HasInstance(args[0])) {
+        // void set(in WebGL<T>Array array, [Optional] in unsigned long offset);
+        CPlusPlusArrayType* src = V8DOMWrapper::convertToNativeObject<CPlusPlusArrayType>(wrapperType, args[0]->ToObject());
+        uint32_t offset = 0;
+        if (args.Length() == 2)
+            offset = toInt32(args[1]);
+        ExceptionCode ec = 0;
+        array->set(src, offset, ec);
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    return setWebGLArrayFromArray(array, args);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLByteArrayCustom.cpp
index 503e5e8..5719c8a 100644
--- a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLByteArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLByteArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLByteArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasByteArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLByteArrayConstructor)
 {
-    INC_STATS("DOM.CanvasByteArray.Contructor");
+    INC_STATS("DOM.WebGLByteArray.Contructor");
 
-    return constructCanvasArray<CanvasByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASBYTEARRAY));
+    return constructWebGLArray<WebGLByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLBYTEARRAY));
 }
 
 // Get the specified value from the byte buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid byte buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasByteArray)
+INDEXED_PROPERTY_GETTER(WebGLByteArray)
 {
-    INC_STATS("DOM.CanvasByteArray.IndexedPropertyGetter");
-    CanvasByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLByteArray.IndexedPropertyGetter");
+    WebGLByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<WebGLByteArray>(V8ClassIndex::WEBGLBYTEARRAY, info.Holder());
 
     if ((index < 0) || (index >= byteBuffer->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasByteArray)
 }
 
 // Set the specified value in the byte buffer. Accesses outside the valid byte buffer range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasByteArray)
+INDEXED_PROPERTY_SETTER(WebGLByteArray)
 {
-    INC_STATS("DOM.CanvasByteArray.IndexedPropertySetter");
-    CanvasByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLByteArray.IndexedPropertySetter");
+    WebGLByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLByteArray>(V8ClassIndex::WEBGLBYTEARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasByteArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLByteArrayGet)
+{
+    INC_STATS("DOM.WebGLByteArray.get()");
+    return getWebGLArrayElement<WebGLByteArray, signed char>(args, V8ClassIndex::WEBGLBYTEARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLByteArraySet)
+{
+    INC_STATS("DOM.WebGLByteArray.set()");
+    return setWebGLArray<WebGLByteArray, V8WebGLByteArray>(args, V8ClassIndex::WEBGLBYTEARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLFloatArrayCustom.cpp
index b3c1d62..6e56760 100644
--- a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLFloatArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasFloatArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLFloatArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLFloatArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasFloatArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLFloatArrayConstructor)
 {
-    INC_STATS("DOM.CanvasFloatArray.Contructor");
+    INC_STATS("DOM.WebGLFloatArray.Contructor");
 
-    return constructCanvasArray<CanvasFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASFLOATARRAY));
+    return constructWebGLArray<WebGLFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLFLOATARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasFloatArray)
+INDEXED_PROPERTY_GETTER(WebGLFloatArray)
 {
-    INC_STATS("DOM.CanvasFloatArray.IndexedPropertyGetter");
-    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+    INC_STATS("DOM.WebGLFloatArray.IndexedPropertyGetter");
+    WebGLFloatArray* array = V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,16 +66,28 @@ INDEXED_PROPERTY_GETTER(CanvasFloatArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasFloatArray)
+INDEXED_PROPERTY_SETTER(WebGLFloatArray)
 {
-    INC_STATS("DOM.CanvasFloatArray.IndexedPropertySetter");
-    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+    INC_STATS("DOM.WebGLFloatArray.IndexedPropertySetter");
+    WebGLFloatArray* array = V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length()))
         array->set(index, value->NumberValue());
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLFloatArrayGet)
+{
+    INC_STATS("DOM.WebGLFloatArray.get()");
+    return getWebGLArrayElement<WebGLFloatArray, float>(args, V8ClassIndex::WEBGLFLOATARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLFloatArraySet)
+{
+    INC_STATS("DOM.WebGLFloatArray.set()");
+    return setWebGLArray<WebGLFloatArray, V8WebGLFloatArray>(args, V8ClassIndex::WEBGLFLOATARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLIntArrayCustom.cpp
index 6f35db8..1bd30b2 100644
--- a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLIntArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasIntArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLIntArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLIntArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasIntArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLIntArrayConstructor)
 {
-    INC_STATS("DOM.CanvasIntArray.Contructor");
+    INC_STATS("DOM.WebGLIntArray.Contructor");
 
-    return constructCanvasArray<CanvasIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASINTARRAY));
+    return constructWebGLArray<WebGLIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLINTARRAY));
 }
 
 // Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasIntArray)
+INDEXED_PROPERTY_GETTER(WebGLIntArray)
 {
-    INC_STATS("DOM.CanvasIntArray.IndexedPropertyGetter");
-    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLIntArray.IndexedPropertyGetter");
+    WebGLIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasIntArray)
 }
 
 // Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasIntArray)
+INDEXED_PROPERTY_SETTER(WebGLIntArray)
 {
-    INC_STATS("DOM.CanvasIntArray.IndexedPropertySetter");
-    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLIntArray.IndexedPropertySetter");
+    WebGLIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasIntArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLIntArrayGet)
+{
+    INC_STATS("DOM.WebGLIntArray.get()");
+    return getWebGLArrayElement<WebGLIntArray, int>(args, V8ClassIndex::WEBGLINTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLIntArraySet)
+{
+    INC_STATS("DOM.WebGLIntArray.set()");
+    return setWebGLArray<WebGLIntArray, V8WebGLIntArray>(args, V8ClassIndex::WEBGLINTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
new file mode 100644
index 0000000..fd73a5b
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -0,0 +1,928 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions areV8ClassIndex::WEBGL
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLRenderingContext.h"
+
+#include "ExceptionCode.h"
+
+#include "NotImplemented.h"
+
+#include <wtf/FastMalloc.h>
+
+#include "V8Binding.h"
+#include "V8WebGLArray.h"
+#include "V8WebGLByteArray.h"
+#include "V8WebGLFloatArray.h"
+#include "V8WebGLIntArray.h"
+#include "V8WebGLProgram.h"
+#include "V8WebGLShader.h"
+#include "V8WebGLShortArray.h"
+#include "V8WebGLUniformLocation.h"
+#include "V8WebGLUnsignedByteArray.h"
+#include "V8WebGLUnsignedIntArray.h"
+#include "V8WebGLUnsignedShortArray.h"
+#include "V8HTMLCanvasElement.h"
+#include "V8HTMLImageElement.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    float* data;
+    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        if (!val->IsNumber()) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = toFloat(val);
+    }
+    return data;
+}
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    int* data;
+    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        bool ok;
+        int ival = toInt32(val, ok);
+        if (!ok) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = ival;
+    }
+    return data;
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextBufferData)
+{
+    INC_STATS("DOM.WebGLRenderingContext.bufferData()");
+
+    // Forms:
+    // * bufferData(GLenum target, WebGLArray data, GLenum usage);
+    //   - Sets the buffer's data from the given WebGLArray
+    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
+    //   - Sets the size of the buffer to the given size in bytes
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int usage = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (args[1]->IsInt32()) {
+        int size = toInt32(args[1]);
+        ExceptionCode exceptionCode;
+        context->bufferData(target, size, usage, exceptionCode);
+    } else if (V8WebGLArray::HasInstance(args[1])) {
+        WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, args[1]->ToObject());
+        ExceptionCode exceptionCode;
+        context->bufferData(target, array, usage, exceptionCode);
+    } else {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextBufferSubData)
+{
+    INC_STATS("DOM.WebGLRenderingContext.bufferSubData()");
+
+    // Forms:
+    // * bufferSubData(GLenum target, GLintptr offset, WebGLArray data);
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int offset = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (!V8WebGLArray::HasInstance(args[2])) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, args[2]->ToObject());
+    ExceptionCode exceptionCode;
+    context->bufferSubData(target, offset, array, exceptionCode);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> toV8(const WebGLGetInfo& info)
+{
+    switch (info.getType()) {
+    case WebGLGetInfo::kTypeBool:
+        return v8::Boolean::New(info.getBool());
+    case WebGLGetInfo::kTypeFloat:
+        return v8::Number::New(info.getFloat());
+    case WebGLGetInfo::kTypeLong:
+        return v8::Integer::New(info.getLong());
+    case WebGLGetInfo::kTypeNull:
+        return v8::Null();
+    case WebGLGetInfo::kTypeString:
+        return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
+    case WebGLGetInfo::kTypeUnsignedLong:
+        return v8::Integer::NewFromUnsigned(info.getUnsignedLong());
+    case WebGLGetInfo::kTypeWebGLBuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLBUFFER, info.getWebGLBuffer());
+    case WebGLGetInfo::kTypeWebGLFloatArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLFLOATARRAY, info.getWebGLFloatArray());
+    case WebGLGetInfo::kTypeWebGLFramebuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLFRAMEBUFFER, info.getWebGLFramebuffer());
+    case WebGLGetInfo::kTypeWebGLIntArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLINTARRAY, info.getWebGLIntArray());
+    // FIXME: implement WebGLObjectArray
+    // case WebGLGetInfo::kTypeWebGLObjectArray:
+    case WebGLGetInfo::kTypeWebGLProgram:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLPROGRAM, info.getWebGLProgram());
+    case WebGLGetInfo::kTypeWebGLRenderbuffer:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLRENDERBUFFER, info.getWebGLRenderbuffer());
+    case WebGLGetInfo::kTypeWebGLTexture:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLTEXTURE, info.getWebGLTexture());
+    case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.getWebGLUnsignedByteArray());
+    default:
+        notImplemented();
+        return v8::Undefined();
+    }
+}
+
+enum ObjectType {
+    kBuffer, kRenderbuffer, kTexture, kVertexAttrib
+};
+
+static v8::Handle<v8::Value> getObjectParameter(const v8::Arguments& args, ObjectType objectType)
+{
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info;
+    switch (objectType) {
+    case kBuffer:
+        info = context->getBufferParameter(target, pname, ec);
+        break;
+    case kRenderbuffer:
+        info = context->getRenderbufferParameter(target, pname, ec);
+        break;
+    case kTexture:
+        info = context->getTexParameter(target, pname, ec);
+        break;
+    case kVertexAttrib:
+        // target => index
+        info = context->getVertexAttrib(target, pname, ec);
+        break;
+    default:
+        notImplemented();
+        break;
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+static WebGLUniformLocation* toWebGLUniformLocation(v8::Handle<v8::Value> value, bool& ok)
+{
+    ok = false;
+    WebGLUniformLocation* location = 0;
+    if (V8WebGLUniformLocation::HasInstance(value)) {
+        location = V8DOMWrapper::convertToNativeObject<WebGLUniformLocation>(
+            V8ClassIndex::WEBGLUNIFORMLOCATION, value->ToObject());
+        ok = true;
+    }
+    return location;
+}
+
+enum WhichProgramCall {
+    kProgramParameter, kUniform
+};
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetBufferParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getBufferParameter()");
+    return getObjectParameter(args, kBuffer);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetFramebufferAttachmentParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getFramebufferAttachmentParameter()");
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned attachment = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    unsigned pname = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getFramebufferAttachmentParameter(target, attachment, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getParameter()");
+
+    if (args.Length() != 1) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    unsigned pname = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getParameter(pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetProgramParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getProgramParameter()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLProgram>(V8ClassIndex::WEBGLPROGRAM, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+    bool ok;
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getProgramParameter(program, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetRenderbufferParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getRenderbufferParameter()");
+    return getObjectParameter(args, kRenderbuffer);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetShaderParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getShaderParameter()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLShader* shader = V8WebGLShader::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLShader>(V8ClassIndex::WEBGLSHADER, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+    bool ok;
+    unsigned pname = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getShaderParameter(shader, pname, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetTexParameter)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getTexParameter()");
+    return getObjectParameter(args, kTexture);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetUniform)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getUniform()");
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? v8DOMWrapperTo<WebGLProgram>(V8ClassIndex::WEBGLPROGRAM, v8::Handle<v8::Object>::Cast(args[0])) : 0;
+
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[1], ok);
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    WebGLGetInfo info = context->getUniform(program, location, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    return toV8(info);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextGetVertexAttrib)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getVertexAttrib()");
+    return getObjectParameter(args, kVertexAttrib);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextTexImage2D)
+{
+    INC_STATS("DOM.WebGLRenderingContext.texImage2D()");
+
+    // Currently supported forms:
+    // * void texImage2D(in GLenum target, in GLint level,
+    //                   in GLint internalformat,
+    //                   in GLsizei width, in GLsizei height, in GLint border,
+    //                   in GLenum format, in GLenum type, in WebGLArray pixels);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    if (args.Length() != 3 &&
+        args.Length() != 4 &&
+        args.Length() != 5 &&
+        args.Length() != 9) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int level = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    if (args.Length() == 3 ||
+        args.Length() == 4 ||
+        args.Length() == 5) {
+        v8::Handle<v8::Value> arg = args[2];
+        bool flipY = false;
+        bool premultiplyAlpha = false;
+        if (args.Length() >= 4)
+            flipY = args[3]->BooleanValue();
+        if (args.Length() >= 5)
+            premultiplyAlpha = args[4]->BooleanValue();
+        if (V8HTMLImageElement::HasInstance(arg)) {
+            HTMLImageElement* element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else if (V8HTMLCanvasElement::HasInstance(arg)) {
+            HTMLCanvasElement* element = V8DOMWrapper::convertDOMWrapperToNode<HTMLCanvasElement>(v8::Handle<v8::Object>::Cast(arg));
+            context->texImage2D(target, level, element, flipY, premultiplyAlpha, ec);
+        } else {
+            // FIXME: support HTMLVideoElement and ImageData.
+            // FIXME: consider different / better exception type.
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        // Fall through
+    } else if (args.Length() == 9) {
+        int internalformat = toInt32(args[2], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int width = toInt32(args[3], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int height = toInt32(args[4], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int border = toInt32(args[5], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int format = toInt32(args[6], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int type = toInt32(args[7], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        v8::Handle<v8::Value> arg = args[8];
+        if (V8WebGLArray::HasInstance(arg)) {
+            WebGLArray* array = V8DOMWrapper::convertToNativeObject<WebGLArray>(V8ClassIndex::WEBGLARRAY, arg->ToObject());
+            // FIXME: must do validation similar to JOGL's to ensure that
+            // the incoming array is of the appropriate length and type
+            context->texImage2D(target,
+                                level,
+                                internalformat,
+                                width,
+                                height,
+                                border,
+                                format,
+                                type,
+                                array,
+                                ec);
+            // Fall through
+        } else {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+    } else {
+        ASSERT_NOT_REACHED();
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextTexSubImage2D)
+{
+    INC_STATS("DOM.WebGLRenderingContext.texSubImage2D()");
+
+    // FIXME: implement
+    notImplemented();
+
+    return v8::Undefined();
+}
+
+enum FunctionToCall {
+    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
+    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
+};
+
+bool isFunctionToCallForAttribute(FunctionToCall functionToCall)
+{
+    switch (functionToCall) {
+    case kVertexAttrib1v:
+    case kVertexAttrib2v:
+    case kVertexAttrib3v:
+    case kVertexAttrib4v:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
+                                                           FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1fv(WebGLUniformLocation location, Array data);
+    // * glUniform1fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform2fv(WebGLUniformLocation location, Array data);
+    // * glUniform2fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform3fv(WebGLUniformLocation location, Array data);
+    // * glUniform3fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glUniform4fv(WebGLUniformLocation location, Array data);
+    // * glUniform4fv(WebGLUniformLocation location, WebGLFloatArray data);
+    // * glVertexAttrib1fv(GLint index, Array data);
+    // * glVertexAttrib1fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib2fv(GLint index, Array data);
+    // * glVertexAttrib2fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib3fv(GLint index, Array data);
+    // * glVertexAttrib3fv(GLint index, WebGLFloatArray data);
+    // * glVertexAttrib4fv(GLint index, Array data);
+    // * glVertexAttrib4fv(GLint index, WebGLFloatArray data);
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    bool ok = false;
+    int index = -1;
+    WebGLUniformLocation* location = 0;
+
+    if (isFunctionToCallForAttribute(functionToCall))
+        index = toInt32(args[0], ok);
+    else
+        location = toWebGLUniformLocation(args[0], ok);
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8WebGLFloatArray::HasInstance(args[1])) {
+        WebGLFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1fv(location, array, ec); break;
+            case kUniform2v: context->uniform2fv(location, array, ec); break;
+            case kUniform3v: context->uniform3fv(location, array, ec); break;
+            case kUniform4v: context->uniform4fv(location, array, ec); break;
+            case kVertexAttrib1v: context->vertexAttrib1fv(index, array); break;
+            case kVertexAttrib2v: context->vertexAttrib2fv(index, array); break;
+            case kVertexAttrib3v: context->vertexAttrib3fv(index, array); break;
+            case kVertexAttrib4v: context->vertexAttrib4fv(index, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1fv(location, data, len, ec); break;
+        case kUniform2v: context->uniform2fv(location, data, len, ec); break;
+        case kUniform3v: context->uniform3fv(location, data, len, ec); break;
+        case kUniform4v: context->uniform4fv(location, data, len, ec); break;
+        case kVertexAttrib1v: context->vertexAttrib1fv(index, data, len); break;
+        case kVertexAttrib2v: context->vertexAttrib2fv(index, data, len); break;
+        case kVertexAttrib3v: context->vertexAttrib3fv(index, data, len); break;
+        case kVertexAttrib4v: context->vertexAttrib4fv(index, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
+                                            FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1iv(GLUniformLocation location, Array data);
+    // * glUniform1iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform2iv(GLUniformLocation location, Array data);
+    // * glUniform2iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform3iv(GLUniformLocation location, Array data);
+    // * glUniform3iv(GLUniformLocation location, WebGLIntArray data);
+    // * glUniform4iv(GLUniformLocation location, Array data);
+    // * glUniform4iv(GLUniformLocation location, WebGLIntArray data);
+
+    if (args.Length() != 2) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[0], ok);
+
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8WebGLIntArray::HasInstance(args[1])) {
+        WebGLIntArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLIntArray>(V8ClassIndex::WEBGLINTARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1iv(location, array, ec); break;
+            case kUniform2v: context->uniform2iv(location, array, ec); break;
+            case kUniform3v: context->uniform3iv(location, array, ec); break;
+            case kUniform4v: context->uniform4iv(location, array, ec); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    int* data = jsArrayToIntArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1iv(location, data, len, ec); break;
+        case kUniform2v: context->uniform2iv(location, data, len, ec); break;
+        case kUniform3v: context->uniform3iv(location, data, len, ec); break;
+        case kUniform4v: context->uniform4iv(location, data, len, ec); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform1fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform1fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform1iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform1iv()");
+    return uniformHelperi(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform2fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform2iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform2iv()");
+    return uniformHelperi(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform3fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform3iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform3iv()");
+    return uniformHelperi(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform4fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform4v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniform4iv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniform4iv()");
+    return uniformHelperi(args, kUniform4v);
+}
+
+static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
+                                                 int matrixSize)
+{
+    // Forms:
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, WebGLFloatArray data);
+    //
+    // FIXME: need to change to accept WebGLFloatArray as well.
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    WebGLRenderingContext* context =
+        V8DOMWrapper::convertDOMWrapperToNative<WebGLRenderingContext>(args.Holder());
+
+    bool ok = false;
+    WebGLUniformLocation* location = toWebGLUniformLocation(args[0], ok);
+    
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool transpose = args[1]->BooleanValue();
+    if (V8WebGLFloatArray::HasInstance(args[2])) {
+        WebGLFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<WebGLFloatArray>(V8ClassIndex::WEBGLFLOATARRAY, args[2]->ToObject());
+        ASSERT(array != NULL);
+        ExceptionCode ec = 0;
+        switch (matrixSize) {
+            case 2: context->uniformMatrix2fv(location, transpose, array, ec); break;
+            case 3: context->uniformMatrix3fv(location, transpose, array, ec); break;
+            case 4: context->uniformMatrix4fv(location, transpose, array, ec); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        if (ec)
+            V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[2]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    ExceptionCode ec = 0;
+    switch (matrixSize) {
+        case 2: context->uniformMatrix2fv(location, transpose, data, len, ec); break;
+        case 3: context->uniformMatrix3fv(location, transpose, data, len, ec); break;
+        case 4: context->uniformMatrix4fv(location, transpose, data, len, ec); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    if (ec)
+        V8Proxy::setDOMException(ec); 
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix2fv()");
+    return uniformMatrixHelper(args, 2);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix3fv()");
+    return uniformMatrixHelper(args, 3);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextUniformMatrix4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.uniformMatrix4fv()");
+    return uniformMatrixHelper(args, 4);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib1fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib1fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib2fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib2fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib3fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib3fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
+}
+
+CALLBACK_FUNC_DECL(WebGLRenderingContextVertexAttrib4fv)
+{
+    INC_STATS("DOM.WebGLRenderingContext.vertexAttrib4fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLShortArrayCustom.cpp
index 8b83022..f8a26c3 100644
--- a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLShortArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasShortArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLShortArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLShortArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasShortArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLShortArrayConstructor)
 {
-    INC_STATS("DOM.CanvasShortArray.Contructor");
+    INC_STATS("DOM.WebGLShortArray.Contructor");
 
-    return constructCanvasArray<CanvasShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASSHORTARRAY));
+    return constructWebGLArray<WebGLShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLSHORTARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasShortArray)
+INDEXED_PROPERTY_GETTER(WebGLShortArray)
 {
-    INC_STATS("DOM.CanvasShortArray.IndexedPropertyGetter");
-    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLShortArray.IndexedPropertyGetter");
+    WebGLShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLShortArray>(V8ClassIndex::WEBGLSHORTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasShortArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasShortArray)
+INDEXED_PROPERTY_SETTER(WebGLShortArray)
 {
-    INC_STATS("DOM.CanvasShortArray.IndexedPropertySetter");
-    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLShortArray.IndexedPropertySetter");
+    WebGLShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLShortArray>(V8ClassIndex::WEBGLSHORTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasShortArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLShortArrayGet)
+{
+    INC_STATS("DOM.WebGLShortArray.get()");
+    return getWebGLArrayElement<WebGLShortArray, short>(args, V8ClassIndex::WEBGLSHORTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLShortArraySet)
+{
+    INC_STATS("DOM.WebGLShortArray.set()");
+    return setWebGLArray<WebGLShortArray, V8WebGLShortArray>(args, V8ClassIndex::WEBGLSHORTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp
index 62ab880..391f213 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedByteArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedByteArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedByteArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedByteArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedByteArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY));
+    return constructWebGLArray<WebGLUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedByteArray)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertyGetter");
-    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedByteArray.IndexedPropertyGetter");
+    WebGLUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedByteArray>(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedByteArray)
 {
-    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertySetter");
-    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedByteArray.IndexedPropertySetter");
+    WebGLUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedByteArray>(V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedByteArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedByteArray, unsigned char>(args, V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedByteArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedByteArray.set()");
+    return setWebGLArray<WebGLUnsignedByteArray, V8WebGLUnsignedByteArray>(args, V8ClassIndex::WEBGLUNSIGNEDBYTEARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp
index 94ec7d0..92b9fe0 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedIntArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedIntArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedIntArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedIntArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedIntArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedIntArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDINTARRAY));
+    return constructWebGLArray<WebGLUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDINTARRAY));
 }
 
 // Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedIntArray)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertyGetter");
-    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedIntArray.IndexedPropertyGetter");
+    WebGLUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedIntArray>(V8ClassIndex::WEBGLUNSIGNEDINTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
 }
 
 // Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedIntArray)
 {
-    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertySetter");
-    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedIntArray.IndexedPropertySetter");
+    WebGLUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedIntArray>(V8ClassIndex::WEBGLUNSIGNEDINTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedIntArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedIntArray, unsigned int>(args, V8ClassIndex::WEBGLUNSIGNEDINTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedIntArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedIntArray.set()");
+    return setWebGLArray<WebGLUnsignedIntArray, V8WebGLUnsignedIntArray>(args, V8ClassIndex::WEBGLUNSIGNEDINTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp
index eeef82c..ce261e9 100644
--- a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLUnsignedShortArrayCustom.cpp
@@ -32,29 +32,30 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedShortArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedShortArray.h"
 
 #include "V8Binding.h"
-#include "V8CanvasArrayBuffer.h"
-#include "V8CanvasArrayCustom.h"
+#include "V8WebGLArrayBuffer.h"
+#include "V8WebGLArrayCustom.h"
+#include "V8WebGLUnsignedShortArray.h"
 #include "V8CustomBinding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-CALLBACK_FUNC_DECL(CanvasUnsignedShortArrayConstructor)
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArrayConstructor)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.Contructor");
+    INC_STATS("DOM.WebGLUnsignedShortArray.Contructor");
 
-    return constructCanvasArray<CanvasUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY));
+    return constructWebGLArray<WebGLUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY));
 }
 
 // Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
-INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
+INDEXED_PROPERTY_GETTER(WebGLUnsignedShortArray)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertyGetter");
-    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedShortArray.IndexedPropertyGetter");
+    WebGLUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedShortArray>(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY, info.Holder());
 
     if ((index < 0) || (index >= array->length()))
         return v8::Undefined();
@@ -65,10 +66,10 @@ INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
 }
 
 // Set the specified value in the array. Accesses outside the valid array range are silently ignored.
-INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
+INDEXED_PROPERTY_SETTER(WebGLUnsignedShortArray)
 {
-    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertySetter");
-    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+    INC_STATS("DOM.WebGLUnsignedShortArray.IndexedPropertySetter");
+    WebGLUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<WebGLUnsignedShortArray>(V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY, info.Holder());
 
     if ((index >= 0) && (index < array->length())) {
         if (!value->IsNumber())
@@ -78,6 +79,18 @@ INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
     return value;
 }
 
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArrayGet)
+{
+    INC_STATS("DOM.WebGLUnsignedShortArray.get()");
+    return getWebGLArrayElement<WebGLUnsignedShortArray, unsigned short>(args, V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY);
+}
+
+CALLBACK_FUNC_DECL(WebGLUnsignedShortArraySet)
+{
+    INC_STATS("DOM.WebGLUnsignedShortArray.set()");
+    return setWebGLArray<WebGLUnsignedShortArray, V8WebGLUnsignedShortArray>(args, V8ClassIndex::WEBGLUNSIGNEDSHORTARRAY);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 36c7001..9b68ac0 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -34,7 +34,7 @@
 
 #include "DOMTimer.h"
 #include "ExceptionCode.h"
-#include "NotificationCenter.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScheduledAction.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -49,7 +49,7 @@ namespace WebCore {
 #if ENABLE(NOTIFICATIONS)
 ACCESSOR_RUNTIME_ENABLER(WorkerContextWebkitNotifications)
 {
-    return NotificationCenter::isAvailable();
+    return RuntimeEnabledFeatures::notificationsEnabled();
 }
 #endif
 
@@ -100,8 +100,13 @@ CALLBACK_FUNC_DECL(WorkerContextImportScripts)
     if (!args.Length())
         return v8::Undefined();
 
-    String callerURL = V8Proxy::sourceName();
-    int callerLine = V8Proxy::sourceLineNumber() + 1;
+    String callerURL;
+    if (!V8Proxy::sourceName(callerURL))
+        return v8::Undefined();
+    int callerLine;
+    if (!V8Proxy::sourceLineNumber(callerLine))
+        return v8::Undefined();
+    callerLine += 1;
 
     Vector<String> urls;
     for (int i = 0; i < args.Length(); i++) {
diff --git a/WebCore/bridge/NP_jsobject.cpp b/WebCore/bridge/NP_jsobject.cpp
index 6a89652..59900c5 100644
--- a/WebCore/bridge/NP_jsobject.cpp
+++ b/WebCore/bridge/NP_jsobject.cpp
@@ -124,7 +124,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, function, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -174,7 +174,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
+        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -204,7 +204,7 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
+        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -444,7 +444,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
+        JSValue resultV = JSC::construct(exec, constructor, constructType, constructData, argList);
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index cc28a75..6683af6 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -35,6 +35,7 @@
 #include "WebCoreFrameView.h"
 #include "jni_runtime.h"
 #include "jni_utility.h"
+#include "jni_utility_private.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
@@ -303,7 +304,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -322,7 +323,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
+    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
diff --git a/WebCore/bridge/jni/jni_objc.mm b/WebCore/bridge/jni/jni_objc.mm
index 0306bfd..fb2d694 100644
--- a/WebCore/bridge/jni/jni_objc.mm
+++ b/WebCore/bridge/jni/jni_objc.mm
@@ -29,6 +29,7 @@
 
 #import <Foundation/Foundation.h>
 #import "jni_utility.h"
+#import "jni_utility_private.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index 0546014..c6185e9 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -58,6 +58,14 @@ public:
             instance->markAggregate(markStack);
     }
 
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    {
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags));
+    }
+
+protected:
+    static const unsigned StructureFlags = RuntimeObjectImp::StructureFlags | OverridesMarkChildren;
+
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
@@ -111,10 +119,17 @@ PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObje
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    foreach(QtInstance* instance, cachedInstances.values(o)) {
-        if (instance->rootObject() == rootObject)
-            return instance;
-    }
+    foreach(QtInstance* instance, cachedInstances.values(o))
+        if (instance->rootObject() == rootObject) {
+            // The garbage collector removes instances, but it may happen that the wrapped
+            // QObject dies before the gc kicks in. To handle that case we have to do an additional
+            // check if to see if the instance's wrapped object is still alive. If it isn't, then
+            // we have to create a new wrapper.
+            if (!instance->getObject())
+                cachedInstances.remove(instance->hashKey());
+            else
+                return instance;
+        }
 
     RefPtr<QtInstance> ret = QtInstance::create(o, rootObject, ownership);
     cachedInstances.insert(o, ret.get());
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 00aaa5b..0afc6c7 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -59,6 +59,7 @@ public:
     JSValue booleanValue() const;
 
     QObject* getObject() const { return m_object; }
+    QObject* hashKey() const { return m_hashkey; }
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
 
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 6887325..94749b4 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -457,8 +457,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                WTF::GregorianDateTime gdt;
-                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -471,8 +471,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 }
             } else if (type == Number) {
                 double b = value.toNumber(exec);
-                WTF::GregorianDateTime gdt;
-                msToGregorianDateTime(b, true, gdt);
+                GregorianDateTime gdt;
+                msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 6;
@@ -824,7 +824,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        WTF::GregorianDateTime dt;
+        GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -832,7 +832,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return new (exec) DateInstance(exec, trunc(ms));
     }
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index f2ce954..dc55f61 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -151,10 +151,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
+        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags));
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags | OverridesMarkChildren;
+
     QtRuntimeMethodData *d_func() const {return d_ptr;}
     QtRuntimeMethod(QtRuntimeMethodData *dd, ExecState *exec, const Identifier &n, PassRefPtr<QtInstance> inst);
     QtRuntimeMethodData *d_ptr;
diff --git a/WebCore/config.h b/WebCore/config.h
index 19b60c8..31b4c17 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -75,12 +75,18 @@
 
 #endif /* PLATFORM(WIN_OS) */
 
+<<<<<<< HEAD:WebCore/config.h
 // ANDROID def should be after all PLATFORM to avoid override.
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #if PLATFORM(ANDROID)
 #define WEBCORE_NAVIGATOR_VENDOR "Google Inc."
 // This must be defined before we include FastMalloc.h, below.
 #define USE_SYSTEM_MALLOC 1
+<<<<<<< HEAD:WebCore/config.h
 #define ANDROID_MOBILE      // change can be merged back to WebKit.org for MOBILE
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define LOG_DISABLED 1
 #include <wtf/Assertions.h>
 // Central place to set which optional features Android uses.
@@ -93,6 +99,7 @@
 #endif
 #define ENABLE_VIDEO 1
 #define ENABLE_WORKERS 1
+<<<<<<< HEAD:WebCore/config.h
 #if ENABLE_SVG
 #if !defined(ENABLE_SVG_ANIMATION)
 #define ENABLE_SVG_ANIMATION 0 // to enable:
@@ -106,19 +113,28 @@
 #define ENABLE_SVG_FOREIGN_OBJECT 1
 #define ENABLE_SVG_USE 1
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define ENABLE_XBL 0
 #define ENABLE_XPATH 0
 #define ENABLE_XSLT 0
+<<<<<<< HEAD:WebCore/config.h
 
 #undef ENABLE_ARCHIVE  // Enabled by default in Platform.h
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #define ENABLE_ARCHIVE 0
 #define ENABLE_OFFLINE_WEB_APPLICATIONS 1
+<<<<<<< HEAD:WebCore/config.h
 #define ENABLE_TOUCH_EVENTS 1
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #undef ENABLE_GEOLOCATION  // Disabled by default in Platform.h
 #define ENABLE_GEOLOCATION 1
 #undef ENABLE_INSPECTOR  // Enabled by default in Platform.h
 #define ENABLE_INSPECTOR 0
 #define ENABLE_EVENT_SOURCE 0
+<<<<<<< HEAD:WebCore/config.h
 
 #define FLATTEN_FRAMESET
 #define FLATTEN_IFRAME
@@ -195,6 +211,8 @@
 // a page is cached. Invoke loadEvent when a page is restored.
 #define ANDROID_PAGE_CACHE_UNLOAD
 
+=======
+>>>>>>> webkit.org at r51976:WebCore/config.h
 #endif /* PLATFORM(ANDROID) */
 
 #ifdef __cplusplus
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 65a6ecf..ce43cd6 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -33,10 +33,8 @@
 #include "CSSReflectValue.h"
 #include "CSSTimingFunctionValue.h"
 #include "CSSValueList.h"
-#include "CachedImage.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "Pair.h"
 #include "Rect.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
@@ -177,6 +175,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxReflect,
     CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
+    CSSPropertyWebkitColorCorrection,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
     CSSPropertyWebkitColumnBreakInside,
@@ -915,9 +914,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->letterSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitLineClamp:
-            if (style->lineClamp() == -1)
+            if (style->lineClamp().isNone())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-            return CSSPrimitiveValue::create(style->lineClamp(), CSSPrimitiveValue::CSS_PERCENTAGE);
+            return CSSPrimitiveValue::create(style->lineClamp().value(), style->lineClamp().isPercentage() ? CSSPrimitiveValue::CSS_PERCENTAGE : CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyLineHeight: {
             Length length = style->lineHeight();
             if (length.isNegative())
@@ -1391,6 +1390,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+        case CSSPropertyWebkitColorCorrection:
+            return CSSPrimitiveValue::create(style->colorSpace());
 
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
@@ -1522,7 +1523,7 @@ unsigned CSSComputedStyleDeclaration::length() const
 String CSSComputedStyleDeclaration::item(unsigned i) const
 {
     if (i >= length())
-        return String();
+        return "";
 
     return getPropertyName(static_cast<CSSPropertyID>(computedProperties[i]));
 }
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index c1a517c..fe10cf3 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -25,7 +25,6 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "PlatformString.h"
-#include "RenderStyle.h"
 #include <wtf/MathExtras.h>
 #include <wtf/UnusedParam.h>
 
diff --git a/WebCore/css/CSSFontSelector.cpp b/WebCore/css/CSSFontSelector.cpp
index 35bc876..ce3253c 100644
--- a/WebCore/css/CSSFontSelector.cpp
+++ b/WebCore/css/CSSFontSelector.cpp
@@ -45,7 +45,6 @@
 #include "FontCache.h"
 #include "FontFamilyValue.h"
 #include "Frame.h"
-#include "NodeList.h"
 #include "RenderObject.h"
 #include "Settings.h"
 #include "SimpleFontData.h"
diff --git a/WebCore/css/CSSGradientValue.cpp b/WebCore/css/CSSGradientValue.cpp
index 3f45e47..5946d7a 100644
--- a/WebCore/css/CSSGradientValue.cpp
+++ b/WebCore/css/CSSGradientValue.cpp
@@ -29,9 +29,7 @@
 #include "CSSStyleSelector.h"
 #include "GeneratedImage.h"
 #include "Gradient.h"
-#include "GraphicsContext.h"
 #include "Image.h"
-#include "ImageBuffer.h"
 #include "IntSize.h"
 #include "IntSizeHash.h"
 #include "PlatformString.h"
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index 0530e91..22e3aaf 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 48
 
 %nonassoc LOWEST_PREC
 
@@ -184,18 +184,15 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <rule> charset
 %type <rule> ruleset
-%type <rule> valid_rule_or_import
 %type <rule> media
 %type <rule> import
+%type <rule> namespace
 %type <rule> page
 %type <rule> font_face
 %type <rule> keyframes
 %type <rule> invalid_rule
 %type <rule> save_block
 %type <rule> invalid_at
-%type <rule> invalid_at_list
-%type <rule> invalid_import
-%type <rule> invalid_media
 %type <rule> rule
 %type <rule> valid_rule
 %type <ruleList> block_rule_list 
@@ -268,7 +265,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
@@ -278,13 +275,8 @@ stylesheet:
   | webkit_keyframe_rule maybe_space
   ;
 
-valid_rule_or_import:
-    valid_rule
-  | import
-  ;
-
 webkit_rule:
-    WEBKIT_RULE_SYM '{' maybe_space valid_rule_or_import maybe_space '}' {
+    WEBKIT_RULE_SYM '{' maybe_space valid_rule maybe_space '}' {
         static_cast<CSSParser*>(parser)->m_rule = $4;
     }
 ;
@@ -373,31 +365,6 @@ charset:
   }
 ;
 
-import_list:
- /* empty */
- | import_list import maybe_sgml {
-     CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
- }
- | invalid_at_list {
- }
- ;
-
-variables_list:
-/* empty */
-| variables_list variables_rule maybe_sgml {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-     if ($2 && p->m_styleSheet)
-         p->m_styleSheet->append($2);
-}
-;
-
-namespace_list:
-/* empty */
-| namespace_list namespace maybe_sgml
-;
-
 rule_list:
    /* empty */
  | rule_list rule maybe_sgml {
@@ -413,13 +380,15 @@ valid_rule:
   | page
   | font_face
   | keyframes
+  | namespace
+  | import
+  | variables_rule
   ;
 
 rule:
     valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
   ;
 
 block_rule_list: 
@@ -445,8 +414,10 @@ block_rule:
     block_valid_rule
   | invalid_rule
   | invalid_at
-  | invalid_import
-  | invalid_media
+  | namespace
+  | import
+  | variables_rule
+  | media
   ;
 
 
@@ -570,17 +541,23 @@ variable_name:
 
 namespace:
 NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space ';' {
-    CSSParser* p = static_cast<CSSParser*>(parser);
-    if (p->m_styleSheet)
-        p->m_styleSheet->addNamespace(p, $3, $4);
+    static_cast<CSSParser*>(parser)->addNamespace($3, $4);
+    $$ = 0;
+}
+| NAMESPACE_SYM maybe_space maybe_ns_prefix string_or_uri maybe_space invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error invalid_block {
+    $$ = 0;
+}
+| NAMESPACE_SYM error ';' {
+    $$ = 0;
 }
-| NAMESPACE_SYM error invalid_block
-| NAMESPACE_SYM error ';'
 ;
 
 maybe_ns_prefix:
 /* empty */ { $$.characters = 0; }
-| IDENT WHITESPACE { $$ = $1; }
+| IDENT maybe_space { $$ = $1; }
 ;
 
 string_or_uri:
@@ -1481,23 +1458,6 @@ invalid_at:
     }
     ;
 
-invalid_at_list:
-    invalid_at maybe_sgml
-  | invalid_at_list invalid_at maybe_sgml
-  ;
-
-invalid_import:
-    import {
-        $$ = 0;
-    }
-    ;
-
-invalid_media:
-    media {
-        $$ = 0;
-    }
-    ;
-
 invalid_rule:
     error invalid_block {
         $$ = 0;
diff --git a/WebCore/css/CSSImageValue.cpp b/WebCore/css/CSSImageValue.cpp
index 3432a4e..96a8dec 100644
--- a/WebCore/css/CSSImageValue.cpp
+++ b/WebCore/css/CSSImageValue.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CachedImage.h"
 #include "DocLoader.h"
-#include "RenderStyle.h"
 #include "StyleCachedImage.h"
 
 namespace WebCore {
diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index 2fe7abf..8534adf 100644
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -25,7 +25,6 @@
 #include "CachedCSSStyleSheet.h"
 #include "DocLoader.h"
 #include "Document.h"
-#include "MediaList.h"
 #include "Settings.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/WebCore/css/CSSInheritedValue.cpp b/WebCore/css/CSSInheritedValue.cpp
index 08d3db3..20b73e2 100644
--- a/WebCore/css/CSSInheritedValue.cpp
+++ b/WebCore/css/CSSInheritedValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSInitialValue.cpp b/WebCore/css/CSSInitialValue.cpp
index 9c2bb23..cbe776b 100644
--- a/WebCore/css/CSSInitialValue.cpp
+++ b/WebCore/css/CSSInitialValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSMediaRule.cpp b/WebCore/css/CSSMediaRule.cpp
index 610e988..d1c220b 100644
--- a/WebCore/css/CSSMediaRule.cpp
+++ b/WebCore/css/CSSMediaRule.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index 2dd2f5d..b86be05 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -23,7 +23,6 @@
 
 #include "CSSImageValue.h"
 #include "CSSParser.h"
-#include "CSSProperty.h"
 #include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
@@ -259,20 +258,28 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
 
 String CSSMutableStyleDeclaration::get4Values(const int* properties) const
 {
-    String res;
-    for (int i = 0; i < 4; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+    // Assume the properties are in the usual order top, right, bottom, left.
+    RefPtr<CSSValue> topValue = getPropertyCSSValue(properties[0]);
+    RefPtr<CSSValue> rightValue = getPropertyCSSValue(properties[1]);
+    RefPtr<CSSValue> bottomValue = getPropertyCSSValue(properties[2]);
+    RefPtr<CSSValue> leftValue = getPropertyCSSValue(properties[3]);
 
-            // apparently all 4 properties must be specified.
-            if (!value)
-                return String();
+    // All 4 properties must be specified.
+    if (!topValue || !rightValue || !bottomValue || !leftValue)
+        return String();
+
+    bool showLeft = rightValue->cssText() != leftValue->cssText();
+    bool showBottom = (topValue->cssText() != bottomValue->cssText()) || showLeft;
+    bool showRight = (topValue->cssText() != rightValue->cssText()) || showBottom;
+
+    String res = topValue->cssText();
+    if (showRight)
+        res += " " + rightValue->cssText();
+    if (showBottom)
+        res += " " + bottomValue->cssText();
+    if (showLeft)
+        res += " " + leftValue->cssText();
 
-            if (!res.isNull())
-                res += " ";
-            res += value->cssText();
-        }
-    }
     return res;
 }
 
@@ -628,7 +635,7 @@ unsigned CSSMutableStyleDeclaration::length() const
 String CSSMutableStyleDeclaration::item(unsigned i) const
 {
     if (i >= m_properties.size())
-       return String();
+       return "";
     return getPropertyName(static_cast<CSSPropertyID>(m_properties[i].id()));
 }
 
diff --git a/WebCore/css/CSSNamespace.h b/WebCore/css/CSSNamespace.h
index 9194be8..0a1119d 100644
--- a/WebCore/css/CSSNamespace.h
+++ b/WebCore/css/CSSNamespace.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
@@ -28,7 +26,7 @@
 
 namespace WebCore {
 
-    struct CSSNamespace {
+    struct CSSNamespace : Noncopyable {
         AtomicString m_prefix;
         AtomicString m_uri;
         CSSNamespace* m_parent;
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 0da1b85..19d82ee 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -146,6 +146,9 @@ CSSParser::CSSParser(bool strictParsing)
     , m_defaultNamespace(starAtom)
     , m_data(0)
     , yy_start(1)
+    , m_allowImportRules(true)
+    , m_allowVariablesRules(true)
+    , m_allowNamespaceDeclarations(true)
     , m_floatingMediaQuery(0)
     , m_floatingMediaQueryExp(0)
     , m_floatingMediaQueryExpList(0)
@@ -242,6 +245,7 @@ PassRefPtr<CSSRule> CSSParser::parseRule(CSSStyleSheet* sheet, const String& str
     android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
 #endif
     m_styleSheet = sheet;
+    m_allowNamespaceDeclarations = false;
     setupParser("@-webkit-rule{", string, "} ");
     cssyyparse(this);
 #ifdef ANDROID_INSTRUMENT
@@ -1297,6 +1301,9 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBoxSizing:
         valid_primitive = id == CSSValueBorderBox || id == CSSValueContentBox;
         break;
+    case CSSPropertyWebkitColorCorrection:
+        valid_primitive = id == CSSValueSrgb || id == CSSValueDefault;
+        break;
     case CSSPropertyWebkitMarquee: {
         const int properties[5] = { CSSPropertyWebkitMarqueeDirection, CSSPropertyWebkitMarqueeIncrement,
                                     CSSPropertyWebkitMarqueeRepetition,
@@ -1541,7 +1548,9 @@ bool CSSParser::parseValue(int propId, bool important)
     // Apple specific properties.  These will never be standardized and are purely to
     // support custom WebKit-based Apple applications.
     case CSSPropertyWebkitLineClamp:
-        valid_primitive = (!id && validUnit(value, FPercent, false));
+        // When specifying number of lines, don't allow 0 as a valid value
+        // When specifying either type of unit, require non-negative integers
+        valid_primitive = (!id && (value->unit == CSSPrimitiveValue::CSS_PERCENTAGE || value->fValue) && validUnit(value, FInteger | FPercent | FNonNeg, false));
         break;
     case CSSPropertyWebkitTextSizeAdjust:
         if (id == CSSValueAuto || id == CSSValueNone)
@@ -3388,6 +3397,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3415,7 +3430,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);
@@ -4673,11 +4688,13 @@ static inline int yyerror(const char*) { return 1; }
 int CSSParser::lex(void* yylvalWithoutType)
 {
     YYSTYPE* yylval = static_cast<YYSTYPE*>(yylvalWithoutType);
-    int token = lex();
     int length;
+    
+    lex();
+
     UChar* t = text(&length);
 
-    switch (token) {
+    switch (token()) {
     case WHITESPACE:
     case SGML_CD:
     case INCLUDES:
@@ -4743,7 +4760,7 @@ int CSSParser::lex(void* yylvalWithoutType)
         break;
     }
 
-    return token;
+    return token();
 }
 
 static inline bool isCSSWhitespace(UChar c)
@@ -4751,6 +4768,28 @@ static inline bool isCSSWhitespace(UChar c)
     return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
 }
 
+void CSSParser::recheckAtKeyword(const UChar* str, int len)
+{
+    String ruleName(str, len);
+    if (equalIgnoringCase(ruleName, "@import"))
+        yyTok = IMPORT_SYM;
+    else if (equalIgnoringCase(ruleName, "@page"))
+        yyTok = PAGE_SYM;
+    else if (equalIgnoringCase(ruleName, "@media"))
+        yyTok = MEDIA_SYM;
+    else if (equalIgnoringCase(ruleName, "@font-face"))
+        yyTok = FONT_FACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@charset"))
+        yyTok = CHARSET_SYM;
+    else if (equalIgnoringCase(ruleName, "@namespace"))
+        yyTok = NAMESPACE_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-keyframes"))
+        yyTok = WEBKIT_KEYFRAMES_SYM;
+    else if (equalIgnoringCase(ruleName, "@-webkit-mediaquery"))
+        yyTok = WEBKIT_MEDIAQUERY_SYM;
+    // FIXME: Add CSS Variables if we ever decide to turn it back on.
+}
+
 UChar* CSSParser::text(int *length)
 {
     UChar* start = yytext;
@@ -4804,6 +4843,8 @@ UChar* CSSParser::text(int *length)
     UChar* out = start;
     UChar* escape = 0;
 
+    bool sawEscape = false;
+
     for (int i = 0; i < l; i++) {
         UChar* current = start + i;
         if (escape == current - 1) {
@@ -4848,6 +4889,7 @@ UChar* CSSParser::text(int *length)
         }
         if (!escape && *current == '\\') {
             escape = current;
+            sawEscape = true;
             continue;
         }
         *out++ = *current;
@@ -4868,6 +4910,12 @@ UChar* CSSParser::text(int *length)
     }
     
     *length = out - start;
+    
+    // If we have an unrecognized @-keyword, and if we handled any escapes at all, then
+    // we should attempt to adjust yyTok to the correct type.
+    if (yyTok == ATKEYWORD && sawEscape)
+        recheckAtKeyword(start, *length);
+
     return start;
 }
 
@@ -4998,7 +5046,7 @@ CSSRule* CSSParser::createCharsetRule(const CSSParserString& charset)
 
 CSSRule* CSSParser::createImportRule(const CSSParserString& url, MediaList* media)
 {
-    if (!media || !m_styleSheet)
+    if (!media || !m_styleSheet || !m_allowImportRules)
         return 0;
     RefPtr<CSSImportRule> rule = CSSImportRule::create(m_styleSheet, url, media);
     CSSImportRule* result = rule.get();
@@ -5010,6 +5058,7 @@ CSSRule* CSSParser::createMediaRule(MediaList* media, CSSRuleList* rules)
 {
     if (!media || !rules || !m_styleSheet)
         return 0;
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSMediaRule> rule = CSSMediaRule::create(m_styleSheet, media, rules);
     CSSMediaRule* result = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -5027,6 +5076,7 @@ CSSRuleList* CSSParser::createRuleList()
 
 WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<WebKitCSSKeyframesRule> rule = WebKitCSSKeyframesRule::create(m_styleSheet);
     WebKitCSSKeyframesRule* rulePtr = rule.get();
     m_parsedStyleObjects.append(rule.release());
@@ -5035,6 +5085,7 @@ WebKitCSSKeyframesRule* CSSParser::createKeyframesRule()
 
 CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     CSSStyleRule* result = 0;
     if (selectors) {
         RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet);
@@ -5051,6 +5102,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 
 CSSRule* CSSParser::createFontFaceRule()
 {
+    m_allowImportRules = m_allowNamespaceDeclarations = m_allowVariablesRules = false;
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
     for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
@@ -5068,6 +5120,15 @@ CSSRule* CSSParser::createFontFaceRule()
     return result;
 }
 
+void CSSParser::addNamespace(const AtomicString& prefix, const AtomicString& uri)
+{
+    if (!m_styleSheet || !m_allowNamespaceDeclarations)
+        return;
+    m_allowImportRules = false;
+    m_allowVariablesRules = false;
+    m_styleSheet->addNamespace(this, prefix, uri);
+}
+
 #if !ENABLE(CSS_VARIABLES)
 
 CSSRule* CSSParser::createVariablesRule(MediaList*, bool)
@@ -5089,6 +5150,9 @@ bool CSSParser::addVariableDeclarationBlock(const CSSParserString&)
 
 CSSRule* CSSParser::createVariablesRule(MediaList* mediaList, bool variablesKeyword)
 {
+    if (!m_allowVariablesRules)
+        return 0;
+    m_allowImportRules = false;
     RefPtr<CSSVariablesRule> rule = CSSVariablesRule::create(m_styleSheet, mediaList, variablesKeyword);
     rule->setDeclaration(CSSVariablesDeclaration::create(rule.get(), m_variableNames, m_variableValues));
     clearVariables();    
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 6d1bb32..d032886 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -187,13 +187,15 @@ namespace WebCore {
         MediaQuery* createFloatingMediaQuery(Vector<MediaQueryExp*>*);
         MediaQuery* sinkFloatingMediaQuery(MediaQuery*);
 
+        void addNamespace(const AtomicString& prefix, const AtomicString& uri);
+
         bool addVariable(const CSSParserString&, CSSParserValueList*);
         bool addVariableDeclarationBlock(const CSSParserString&);
         bool checkForVariables(CSSParserValueList*);
         void addUnresolvedProperty(int propId, bool important);
         
         Vector<CSSSelector*>* reusableSelectorVector() { return &m_reusableSelectorVector; }
-        
+
         bool m_strict;
         bool m_important;
         int m_id;
@@ -225,6 +227,8 @@ namespace WebCore {
         int lex();
         
     private:
+        void recheckAtKeyword(const UChar* str, int len);
+    
         void clearProperties();
 
         void setupParser(const char* prefix, const String&, const char* suffix);
@@ -247,6 +251,10 @@ namespace WebCore {
         int yyTok;
         int yy_start;
 
+        bool m_allowImportRules;
+        bool m_allowVariablesRules;
+        bool m_allowNamespaceDeclarations;
+
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
         HashSet<CSSSelector*> m_floatingSelectors;
@@ -287,7 +295,7 @@ namespace WebCore {
     int cssPropertyID(const String&);
     int cssValueKeywordID(const CSSParserString&);
 
-    class ShorthandScope {
+    class ShorthandScope : public FastAllocBase {
     public:
         ShorthandScope(CSSParser* parser, int propId) : m_parser(parser)
         {
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 6f89df9..3c6097b 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,6 +28,7 @@
 #ifndef CSSPrimitiveValueMappings_h
 #define CSSPrimitiveValueMappings_h
 
+#include "ColorSpace.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
 #include "FontSmoothingMode.h"
@@ -229,6 +230,9 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaReturnToRealtimeButtonPart:
             m_value.ident = CSSValueMediaReturnToRealtimeButton;
             break;
+        case MediaToggleClosedCaptionsButtonPart:
+            m_value.ident = CSSValueMediaToggleClosedCaptionsButton;
+            break;
         case MediaSliderPart:
             m_value.ident = CSSValueMediaSlider;
             break;
@@ -1881,6 +1885,32 @@ template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
+    : m_type(CSS_IDENT)
+{
+    switch (space) {
+        case DeviceColorSpace:
+            m_value.ident = CSSValueDefault;
+            break;
+        case sRGBColorSpace:
+            m_value.ident = CSSValueSrgb;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator ColorSpace() const
+{
+    switch (m_value.ident) {
+        case CSSValueDefault:
+            return DeviceColorSpace;
+        case CSSValueSrgb:
+            return sRGBColorSpace;
+        default:
+            ASSERT_NOT_REACHED();
+            return DeviceColorSpace;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
diff --git a/WebCore/css/CSSProperty.cpp b/WebCore/css/CSSProperty.cpp
index 9b21a3f..d7f2175 100644
--- a/WebCore/css/CSSProperty.cpp
+++ b/WebCore/css/CSSProperty.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSProperty.h b/WebCore/css/CSSProperty.h
index b5635d0..4505f33 100644
--- a/WebCore/css/CSSProperty.h
+++ b/WebCore/css/CSSProperty.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index dff3a2b..fe610de 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -185,6 +185,7 @@ zoom
 -webkit-box-reflect
 -webkit-box-shadow
 -webkit-box-sizing
+-webkit-color-correction
 -webkit-column-break-after
 -webkit-column-break-before
 -webkit-column-break-inside
diff --git a/WebCore/css/CSSRule.cpp b/WebCore/css/CSSRule.cpp
index 8fe4caf..43d8eac 100644
--- a/WebCore/css/CSSRule.cpp
+++ b/WebCore/css/CSSRule.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "CSSRule.h"
 
-#include "CSSStyleSheet.h"
 #include "NotImplemented.h"
 
 namespace WebCore {
diff --git a/WebCore/css/CSSRuleList.cpp b/WebCore/css/CSSRuleList.cpp
index 4528d40..7367ab2 100644
--- a/WebCore/css/CSSRuleList.cpp
+++ b/WebCore/css/CSSRuleList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSRuleList.h b/WebCore/css/CSSRuleList.h
index 26186b3..a355c4a 100644
--- a/WebCore/css/CSSRuleList.h
+++ b/WebCore/css/CSSRuleList.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2002, 2006 Apple Computer, Inc.
diff --git a/WebCore/css/CSSSelector.cpp b/WebCore/css/CSSSelector.cpp
index 313528f..ab2d22b 100644
--- a/WebCore/css/CSSSelector.cpp
+++ b/WebCore/css/CSSSelector.cpp
@@ -116,6 +116,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsReturnToRealtimeButton, ("-webkit-media-controls-return-to-realtime-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsToggleClosedCaptionsButton, ("-webkit-media-controls-toggle-closed-captions-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
@@ -271,6 +272,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsReturnToRealtimeButton) {
         m_pseudoType = PseudoMediaControlsReturnToRealtimeButton;
         element = true;
+    } else if (m_value == mediaControlsToggleClosedCaptionsButton) {
+        m_pseudoType = PseudoMediaControlsToggleClosedCaptions;
+        element = true;
     } else if (m_value == mediaControlsStatusDisplay) {
         m_pseudoType = PseudoMediaControlsStatusDisplay;
         element = true;
diff --git a/WebCore/css/CSSSelector.h b/WebCore/css/CSSSelector.h
index 0c3b677..95a72e4 100644
--- a/WebCore/css/CSSSelector.h
+++ b/WebCore/css/CSSSelector.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 1999-2003 Lars Knoll (knoll@kde.org)
  *               1999 Waldo Bastian (bastian@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
@@ -176,6 +174,7 @@ namespace WebCore {
             PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
+            PseudoMediaControlsToggleClosedCaptions,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
@@ -230,7 +229,7 @@ namespace WebCore {
 
         void extractPseudoType() const;
 
-        struct RareData {
+        struct RareData : Noncopyable {
             RareData(CSSSelector* tagHistory)
                 : m_tagHistory(tagHistory)
                 , m_simpleSelector(0)
diff --git a/WebCore/css/CSSStyleDeclaration.idl b/WebCore/css/CSSStyleDeclaration.idl
index 3e37418..42682ef 100644
--- a/WebCore/css/CSSStyleDeclaration.idl
+++ b/WebCore/css/CSSStyleDeclaration.idl
@@ -44,7 +44,7 @@ module css {
             raises(DOMException);
 
         readonly attribute unsigned long    length;
-        [ConvertNullStringTo=Null] DOMString          item(in unsigned long index);
+        DOMString          item(in unsigned long index);
         readonly attribute CSSRule          parentRule;
 
         // Extensions
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 3276964..b3f5d72 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -28,14 +28,11 @@
 
 #include "CSSBorderImageValue.h"
 #include "CSSCursorImageValue.h"
-#include "CSSFontFace.h"
 #include "CSSFontFaceRule.h"
-#include "CSSFontFaceSource.h"
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
 #include "CSSPrimitiveValueMappings.h"
-#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSRuleList.h"
@@ -61,6 +58,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
@@ -350,7 +348,7 @@ if (id == propID) { \
     return; \
 }
 
-class CSSRuleSet {
+class CSSRuleSet : public Noncopyable {
 public:
     CSSRuleSet();
     ~CSSRuleSet();
@@ -662,7 +660,7 @@ void CSSStyleSelector::matchRules(CSSRuleSet* rules, int& firstRuleIndex, int& l
         matchRulesForList(rules->getIDRules(m_element->getIDAttribute().impl()), firstRuleIndex, lastRuleIndex);
     if (m_element->hasClass()) {
         ASSERT(m_styledElement);
-        const ClassNames& classNames = m_styledElement->classNames();
+        const SpaceSplitString& classNames = m_styledElement->classNames();
         size_t size = classNames.size();
         for (size_t i = 0; i < size; ++i)
             matchRulesForList(rules->getClassRules(classNames[i].impl()), firstRuleIndex, lastRuleIndex);
@@ -2556,6 +2554,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsReturnToRealtimeButton:
                 dynamicPseudo = MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON;
                 return true;
+            case CSSSelector::PseudoMediaControlsToggleClosedCaptions:
+                dynamicPseudo = MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON;
+                return true;
             case CSSSelector::PseudoMediaControlsStatusDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_STATUS_DISPLAY;
                 return true;
@@ -5000,13 +5001,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMarginBottomCollapse:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-
-    // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
         HANDLE_INHERIT_AND_INITIAL(lineClamp, LineClamp)
         if (!primitiveValue)
             return;
-        m_style->setLineClamp(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE));
+        int type = primitiveValue->primitiveType();
+        if (type == CSSPrimitiveValue::CSS_NUMBER)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_NUMBER), LineClampLineCount));
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
     case CSSPropertyWebkitHighlight: {
@@ -5267,6 +5270,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setPointerEvents(*primitiveValue);
         return;
     }
+    case CSSPropertyWebkitColorCorrection:
+        if (isInherit) 
+            m_style->setColorSpace(m_parentStyle->colorSpace());
+        else if (isInitial)
+            m_style->setColorSpace(DeviceColorSpace);
+        else {
+            if (!primitiveValue)
+                return;
+            m_style->setColorSpace(*primitiveValue);
+        }
+        return;
     case CSSPropertyInvalid:
         return;
     case CSSPropertyFontStretch:
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 6e0663f..fab5006 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -23,7 +23,6 @@
 #define CSSStyleSelector_h
 
 #include "CSSFontSelector.h"
-#include "KeyframeList.h"
 #include "LinkHash.h"
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
@@ -56,6 +55,7 @@ class Element;
 class Frame;
 class FrameView;
 class KURL;
+class KeyframeList;
 class MediaQueryEvaluator;
 class Node;
 class Settings;
@@ -65,7 +65,7 @@ class StyleSheetList;
 class StyledElement;
 class WebKitCSSKeyframesRule;
 
-class MediaQueryResult {
+class MediaQueryResult : public Noncopyable {
 public:
     MediaQueryResult(const MediaQueryExp& expr, bool result)
         : m_expression(expr)
@@ -286,7 +286,7 @@ public:
         HashMap<CSSMutableStyleDeclaration*, RefPtr<CSSMutableStyleDeclaration> > m_resolvedVariablesDeclarations;
     };
 
-    class CSSRuleData {
+    class CSSRuleData : public Noncopyable {
     public:
         CSSRuleData(unsigned pos, CSSStyleRule* r, CSSSelector* sel, CSSRuleData* prev = 0)
             : m_position(pos)
@@ -314,7 +314,7 @@ public:
         CSSRuleData* m_next;
     };
 
-    class CSSRuleDataList {
+    class CSSRuleDataList : public Noncopyable {
     public:
         CSSRuleDataList(unsigned pos, CSSStyleRule* rule, CSSSelector* sel)
             : m_first(new CSSRuleData(pos, rule, sel))
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index 1579999..f6cd6f2 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -28,6 +28,7 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Node.h"
+#include "SecurityOrigin.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
@@ -118,6 +119,8 @@ int CSSStyleSheet::addRule(const String& selector, const String& style, Exceptio
 
 PassRefPtr<CSSRuleList> CSSStyleSheet::cssRules(bool omitCharsetRules)
 {
+    if (doc() && !doc()->securityOrigin()->canRequest(baseURL()))
+        return 0;
     return CSSRuleList::create(this, omitCharsetRules);
 }
 
@@ -135,7 +138,7 @@ void CSSStyleSheet::deleteRule(unsigned index, ExceptionCode& ec)
 
 void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const AtomicString& uri)
 {
-    if (uri.isEmpty())
+    if (uri.isNull())
         return;
 
     m_namespaces = new CSSNamespace(prefix, uri, m_namespaces);
@@ -148,11 +151,11 @@ void CSSStyleSheet::addNamespace(CSSParser* p, const AtomicString& prefix, const
 
 const AtomicString& CSSStyleSheet::determineNamespace(const AtomicString& prefix)
 {
-    if (prefix.isEmpty())
+    if (prefix.isNull())
         return nullAtom; // No namespace. If an element/attribute has a namespace, we won't match it.
-    else if (prefix == starAtom)
+    if (prefix == starAtom)
         return starAtom; // We'll match any namespace.
-    else if (m_namespaces) {
+    if (m_namespaces) {
         CSSNamespace* ns = m_namespaces->namespaceForPrefix(prefix);
         if (ns)
             return ns->uri();
@@ -227,10 +230,12 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
         CSSStyleSheet* styleSheet = styleSheetQueue.first();
         styleSheetQueue.removeFirst();
 
-        RefPtr<CSSRuleList> ruleList = styleSheet->cssRules();
-
-        for (unsigned i = 0; i < ruleList->length(); ++i) {
-            CSSRule* rule = ruleList->item(i);
+        for (unsigned i = 0; i < styleSheet->length(); ++i) {
+            StyleBase* styleBase = styleSheet->item(i);
+            if (!styleBase->isRule())
+                continue;
+            
+            CSSRule* rule = static_cast<CSSRule*>(styleBase);
             if (rule->isImportRule()) {
                 if (CSSStyleSheet* ruleStyleSheet = static_cast<CSSImportRule*>(rule)->styleSheet())
                     styleSheetQueue.append(ruleStyleSheet);
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index 1b7b1d8..1c35b23 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -511,6 +511,7 @@ media-seek-back-button
 media-seek-forward-button
 media-rewind-button
 media-return-to-realtime-button
+media-toggle-closed-captions-button
 media-slider
 media-sliderthumb
 media-volume-slider-container
@@ -638,3 +639,7 @@ subpixel-antialiased
 optimizeSpeed
 optimizeLegibility
 geometricPrecision
+
+# -webkit-color-correction
+#default
+sRGB
diff --git a/WebCore/css/CSSValueList.cpp b/WebCore/css/CSSValueList.cpp
index 9633f7c..8f1f88d 100644
--- a/WebCore/css/CSSValueList.cpp
+++ b/WebCore/css/CSSValueList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/WebCore/css/FontValue.cpp b/WebCore/css/FontValue.cpp
index 231ac64..991fc6e 100644
--- a/WebCore/css/FontValue.cpp
+++ b/WebCore/css/FontValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/MediaFeatureNames.cpp b/WebCore/css/MediaFeatureNames.cpp
index fcee5de..a7799c1 100644
--- a/WebCore/css/MediaFeatureNames.cpp
+++ b/WebCore/css/MediaFeatureNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/css/MediaFeatureNames.h b/WebCore/css/MediaFeatureNames.h
index 5196586..2799004 100644
--- a/WebCore/css/MediaFeatureNames.h
+++ b/WebCore/css/MediaFeatureNames.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the CSS implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/css/MediaQuery.h b/WebCore/css/MediaQuery.h
index ff22d9a..7cbd3bf 100644
--- a/WebCore/css/MediaQuery.h
+++ b/WebCore/css/MediaQuery.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 class MediaQueryExp;
 
-class MediaQuery {
+class MediaQuery : public Noncopyable {
 public:
     enum Restrictor {
         Only, Not, None
diff --git a/WebCore/css/MediaQueryEvaluator.h b/WebCore/css/MediaQueryEvaluator.h
index 404504b..00ac394 100644
--- a/WebCore/css/MediaQueryEvaluator.h
+++ b/WebCore/css/MediaQueryEvaluator.h
@@ -49,7 +49,7 @@ class MediaQueryExp;
  * the device characteristics are not known. This can be used to prune the loading
  * of stylesheets to only those which are probable to match.
  */
-class MediaQueryEvaluator {
+class MediaQueryEvaluator : public Noncopyable {
 public:
     /** Creates evaluator which evaluates only simple media queries
      *  Evaluator returns true for "all", and returns value of \mediaFeatureResult
diff --git a/WebCore/css/MediaQueryExp.h b/WebCore/css/MediaQueryExp.h
index 5ff4af3..fd55cf6 100644
--- a/WebCore/css/MediaQueryExp.h
+++ b/WebCore/css/MediaQueryExp.h
@@ -36,7 +36,7 @@
 namespace WebCore {
 class CSSParserValueList;
 
-class MediaQueryExp {
+class MediaQueryExp : public FastAllocBase {
 public:
     MediaQueryExp(const AtomicString& mediaFeature, CSSParserValueList* values);
     ~MediaQueryExp();
diff --git a/WebCore/css/Pair.h b/WebCore/css/Pair.h
index a2b127e..c76bd82 100644
--- a/WebCore/css/Pair.h
+++ b/WebCore/css/Pair.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index 7e4483f..6d131df 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -10,8 +10,6 @@
              (C) 2004 Allan Sandfeld Jensen(kde@carewolf.com)
              (C) 2004 Germain Garand(germain@ebooksfrance.org)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/css/SVGCSSValueKeywords.in b/WebCore/css/SVGCSSValueKeywords.in
index 152a68f..91fb57e 100644
--- a/WebCore/css/SVGCSSValueKeywords.in
+++ b/WebCore/css/SVGCSSValueKeywords.in
@@ -183,7 +183,7 @@ new
 # CSS_PROP_STOP_OPACITY
 # CSS_PROP_COLOR_INTERPOLATION
 #auto
-sRGB
+#sRGB
 linearRGB
 
 # CSS_PROP_COLOR_INTERPOLATION_FILTERS
diff --git a/WebCore/css/ShadowValue.cpp b/WebCore/css/ShadowValue.cpp
index 27be86c..060a322 100644
--- a/WebCore/css/ShadowValue.cpp
+++ b/WebCore/css/ShadowValue.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2009 Apple Computer, Inc.
  *
diff --git a/WebCore/css/StyleSheet.cpp b/WebCore/css/StyleSheet.cpp
index 16e6278..b4fb3b2 100644
--- a/WebCore/css/StyleSheet.cpp
+++ b/WebCore/css/StyleSheet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/css/StyleSheetList.cpp b/WebCore/css/StyleSheetList.cpp
index b9df810..2c90258 100644
--- a/WebCore/css/StyleSheetList.cpp
+++ b/WebCore/css/StyleSheetList.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  *
diff --git a/WebCore/css/WebKitCSSKeyframesRule.cpp b/WebCore/css/WebKitCSSKeyframesRule.cpp
index 440d7a2..23f9f34 100644
--- a/WebCore/css/WebKitCSSKeyframesRule.cpp
+++ b/WebCore/css/WebKitCSSKeyframesRule.cpp
@@ -108,8 +108,16 @@ WebKitCSSKeyframeRule* WebKitCSSKeyframesRule::findRule(const String& s)
 
 int WebKitCSSKeyframesRule::findRuleIndex(const String& key) const
 {
+    String percentageString;
+    if (equalIgnoringCase(key, "from"))
+        percentageString = "0%";
+    else if (equalIgnoringCase(key, "to"))
+        percentageString = "100%";
+    else
+        percentageString = key;
+
     for (unsigned i = 0; i < length(); ++i) {
-        if (item(i)->keyText() == key)
+        if (item(i)->keyText() == percentageString)
             return i;
     }
 
diff --git a/WebCore/css/WebKitCSSKeyframesRule.h b/WebCore/css/WebKitCSSKeyframesRule.h
index 8c76b61..f58406f 100644
--- a/WebCore/css/WebKitCSSKeyframesRule.h
+++ b/WebCore/css/WebKitCSSKeyframesRule.h
@@ -64,7 +64,7 @@ public:
     // themselves, or know that it will get called later.
     void setNameInternal(const String& name)
     {   
-        m_name = name;
+        m_name = AtomicString(name);
     }
 
     CSSRuleList* cssRules() { return m_lstCSSRules.get(); }
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 095fab3..1132d24 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -607,6 +607,22 @@ a:-webkit-any-link:active {
     color: -webkit-activelink
 }
 
+/* HTML5 ruby elements */
+
+ruby, rt {
+    text-indent: 0; /* blocks used for ruby rendering should not trigger this */ 
+}
+
+ruby > rt {
+    display: block;
+    font-size: 60%; /* make slightly larger than 50% for better readability */
+    text-align: center;
+}
+
+ruby > rp {
+    display: none;
+}
+
 /* other elements */
 
 noframes {
diff --git a/WebCore/css/maketokenizer b/WebCore/css/maketokenizer
index d14b37a..90d5fcb 100644
--- a/WebCore/css/maketokenizer
+++ b/WebCore/css/maketokenizer
@@ -1,7 +1,5 @@
 print <<END;
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2003 Lars Knoll (knoll\@kde.org)
  *
  *
@@ -73,30 +71,36 @@ typedef unsigned int flex_uint32_t;
 END
 }
 
-
+# Skip over the flex output prologue: the above typedefs, forward declarations, etc.
+# Stop when we get to the declarations of tables.
 while (<>) {
     last if /YY_NUM_RULES/;
 }
 
+# Dump the generated tables.  /yy_last_accepting/ matches the first declaration after the tables.
 print;
 while (<>) {
     last if /yy_last_accepting/;
     print;
 }
 
-# media query, tokenizer state support
+# Skip down the the declaration of yytext; the body of the flex output begins after it.
 while (<>) {
   last if /yytext/;
 }
+# Dump the definitions of states (INITIAL, media query, tokenizer state support).
 while (<>) {
   last if not (/define/ || /line/) ;
   print;
 }
 
+# Skip to main scanner function.
 while (<>) {
     last if /^YY_DECL/;
 }
 
+# Dump main scanner declarations, substituting in our 16-bit character type.
+# Declarations end with the declaration matching /yy_act/.
 print;
 while (<>) {
     s/char/UChar/;
@@ -104,23 +108,34 @@ while (<>) {
     last if /yy_act/;
 }
 
+# Skip past initialization code, down to main loop.
 while (<>) {
     last if /while \( 1 \)/;
 }
 
+# Dump the main loop, skipping over labels we don't use.
+# Stop before dumping the end-of-buffer handling, because we output our own custom end-of-buffer handling.
 print;
 while (<>) {
     next if /^yy_match:/;
     next if /^do_action:/;
     last if /YY_END_OF_BUFFER/;
+    if (/^case YY_STATE_EOF\(INITIAL\):/) {
+        print "case YY_END_OF_BUFFER:\n";
+        # flex outputs a ton of logic related to end-of-buffer handling; we just want to fall through to
+        # the yyterminate() found in other EOF states.  But we need to be careful to back up to behind
+        # the terminating double-NUL so that subsequent calls to flex will have the pointers in order,
+        # so this logic is a reduction of the normal flex-generated YY_END_OF_BUFFER code.
+        print "\tyy_c_buf_p = yy_cp - 1;\n";
+        print "\tyy_cp = yy_c_buf_p;\n";
+    }
     print;
-    print "case YY_END_OF_BUFFER:\n" if /^case YY_STATE_EOF\(INITIAL\):/;
 }
 
+# Skip over the end-of-buffer handling; dump the rest of the function.
 while (<>) {
     last if /default:/;
 }
-
 print;
 while (<>) {
     print;
diff --git a/WebCore/css/mediaControls.css b/WebCore/css/mediaControls.css
index d0ec90d..de2c2fe 100644
--- a/WebCore/css/mediaControls.css
+++ b/WebCore/css/mediaControls.css
@@ -124,3 +124,10 @@ audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewin
 audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
     display: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+}
diff --git a/WebCore/css/mediaControlsQuickTime.css b/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..965685d 100644
--- a/WebCore/css/mediaControlsQuickTime.css
+++ b/WebCore/css/mediaControlsQuickTime.css
@@ -132,7 +132,7 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     height: 16px;
     margin-left: 7px;
     margin-right: 7px;
-    -webkit-box-ordinal-group: 3; /* At the very end */
+    -webkit-box-ordinal-group: 4; /* At the very end */
 }
 
 audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
@@ -175,3 +175,13 @@ audio::-webkit-media-controls-status-display, video::-webkit-media-controls-stat
     text-indent: 0;
     text-decoration: none;
 }
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+    margin-left: 7px;
+    margin-right: 7px;
+    -webkit-box-ordinal-group: 3; /* between mute and fullscreen */
+}
diff --git a/WebCore/dom/BeforeUnloadEvent.cpp b/WebCore/dom/BeforeUnloadEvent.cpp
index 2521aa1..97d7f97 100644
--- a/WebCore/dom/BeforeUnloadEvent.cpp
+++ b/WebCore/dom/BeforeUnloadEvent.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/BeforeUnloadEvent.h b/WebCore/dom/BeforeUnloadEvent.h
index 39c96fd..2644693 100644
--- a/WebCore/dom/BeforeUnloadEvent.h
+++ b/WebCore/dom/BeforeUnloadEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/CSSMappedAttributeDeclaration.cpp b/WebCore/dom/CSSMappedAttributeDeclaration.cpp
index 7fe0915..9ee6474 100644
--- a/WebCore/dom/CSSMappedAttributeDeclaration.cpp
+++ b/WebCore/dom/CSSMappedAttributeDeclaration.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/WebCore/dom/ClassNodeList.h b/WebCore/dom/ClassNodeList.h
index d40ee19..c519b3e 100644
--- a/WebCore/dom/ClassNodeList.h
+++ b/WebCore/dom/ClassNodeList.h
@@ -30,8 +30,8 @@
 #ifndef ClassNodeList_h
 #define ClassNodeList_h
 
-#include "ClassNames.h"
 #include "DynamicNodeList.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -47,7 +47,7 @@ namespace WebCore {
 
         virtual bool nodeMatches(Element*) const;
 
-        ClassNames m_classNames;
+        SpaceSplitString m_classNames;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Clipboard.cpp b/WebCore/dom/Clipboard.cpp
index 6d1bc15..2aea90a 100644
--- a/WebCore/dom/Clipboard.cpp
+++ b/WebCore/dom/Clipboard.cpp
@@ -55,6 +55,8 @@ void Clipboard::setAccessPolicy(ClipboardAccessPolicy policy)
 static DragOperation dragOpFromIEOp(const String& op)
 {
     // yep, it's really just this fixed set
+    if (op == "uninitialized")
+        return DragOperationEvery;
     if (op == "none")
         return DragOperationNone;
     if (op == "copy")
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/WebCore/dom/CompositionEvent.cpp
index 20cd805..508d5e6 100644
--- a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
+++ b/WebCore/dom/CompositionEvent.cpp
@@ -9,7 +9,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
@@ -21,30 +21,43 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
 #include "config.h"
+#include "CompositionEvent.h"
 
-#if ENABLE(3D_CANVAS)
+#include "EventNames.h"
 
-#include "JSCanvasFloatArray.h"
+namespace WebCore {
 
-#include "CanvasFloatArray.h"
+CompositionEvent::CompositionEvent()
+{
+}
 
-using namespace JSC;
+CompositionEvent::CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+    : UIEvent(type, true, true, view, 0)
+    , m_data(data)
+{
+}
 
-namespace WebCore {
+CompositionEvent::~CompositionEvent()
+{
+}
 
-void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+void CompositionEvent::initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view, const String& data)
 {
-    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+    if (dispatched())
+        return;
+
+    initUIEvent(type, canBubble, cancelable, view, 0);
+
+    m_data = data;
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+bool CompositionEvent::isCompositionEvent() const
 {
-    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+    return true;
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/dom/CompositionEvent.h b/WebCore/dom/CompositionEvent.h
new file mode 100644
index 0000000..4ff01ae
--- /dev/null
+++ b/WebCore/dom/CompositionEvent.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef CompositionEvent_h
+#define CompositionEvent_h
+
+#include "UIEvent.h"
+
+namespace WebCore {
+
+    class CompositionEvent : public UIEvent {
+    public:
+        static PassRefPtr<CompositionEvent> create()
+        {
+            return adoptRef(new CompositionEvent);
+        }
+        static PassRefPtr<CompositionEvent> create(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data)
+        {
+          return adoptRef(new CompositionEvent(type, view, data));
+        }
+        virtual ~CompositionEvent();
+    
+        void initCompositionEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>, const String& data);
+    
+        String data() const { return m_data; }
+
+        virtual bool isCompositionEvent() const;
+
+    private:
+        CompositionEvent();
+        CompositionEvent(const AtomicString& type, PassRefPtr<AbstractView> view, const String& data);
+
+        String m_data;
+    };
+
+} // namespace WebCore
+
+#endif // CompositionEvent_h
diff --git a/WebCore/dom/CompositionEvent.idl b/WebCore/dom/CompositionEvent.idl
new file mode 100644
index 0000000..3752091
--- /dev/null
+++ b/WebCore/dom/CompositionEvent.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    // Introduced in DOM Level 3:
+    interface [
+        GenerateConstructor
+    ] CompositionEvent : UIEvent {
+
+        readonly attribute DOMString data;
+
+        void initCompositionEvent(in DOMString typeArg, 
+                                  in boolean canBubbleArg, 
+                                  in boolean cancelableArg, 
+                                  in DOMWindow viewArg, 
+                                  in DOMString dataArg);
+
+    };
+
+}
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 59b9703..f7c8242 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -305,7 +305,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 {
     RefPtr<HTMLDocument> d = HTMLDocument::create(0);
     d->open();
-    d->write("<!doctype html><html><head><title>" + title + "</title></head><body></body></html>");
+    d->write("<!doctype html><html><body></body></html>");
+    d->setTitle(title);
     return d.release();
 }
 
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index 174e58d..ba6dc97 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -98,6 +98,7 @@
 #include "PageGroup.h"
 #include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
+#include "PopStateEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
@@ -386,15 +387,18 @@ Document::Document(Frame* frame, bool isXHTML)
     m_ignoreAutofocus = false;
 
     m_frame = frame;
+<<<<<<< HEAD:WebCore/dom/Document.cpp
     m_renderArena = 0;
 #if !PLATFORM(ANDROID)
+=======
+
+>>>>>>> webkit.org at r51976:WebCore/dom/Document.cpp
     m_axObjectCache = 0;
 #endif    
     m_docLoader = new DocLoader(this);
 
     visuallyOrdered = false;
     m_bParsing = false;
-    m_tokenizer = 0;
     m_wellFormed = false;
 
     setParseMode(Strict);
@@ -465,8 +469,7 @@ void Document::removedLastRef()
         deleteAllValues(m_markers);
         m_markers.clear();
 
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
 
         m_cssCanvasElements.clear();
 
@@ -500,18 +503,15 @@ Document::~Document()
     forgetAllDOMNodesForDocument(this);
 #endif
 
-    delete m_tokenizer;
+    m_tokenizer.clear();
     m_document = 0;
     delete m_styleSelector;
-    delete m_docLoader;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_docLoader.clear();
+
+    m_renderArena.clear();
 
 #if ENABLE(XBL)
-    delete m_bindingManager;
+    m_bindingManager.clear();
 #endif
 
     deleteAllValues(m_markers);
@@ -1264,13 +1264,13 @@ void Document::recalcStyle(StyleChange change)
         return; // Guard against re-entrancy. -dwh
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willRecalculateStyle();
 #endif
 
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
     if (view())
         view()->pauseScheduledEvents();
     
@@ -1341,6 +1341,7 @@ bail_out:
 
     if (view())
         view()->resumeScheduledEvents();
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
 
@@ -1351,7 +1352,7 @@ bail_out:
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didRecalculateStyle();
 #endif
 }
@@ -1442,7 +1443,7 @@ void Document::attach()
         m_renderArena = new RenderArena();
     
     // Create the rendering tree
-    setRenderer(new (m_renderArena) RenderView(this, view()));
+    setRenderer(new (m_renderArena.get()) RenderView(this, view()));
 #if USE(ACCELERATED_COMPOSITING)
     renderView()->didMoveOnscreen();
 #endif
@@ -1514,17 +1515,19 @@ void Document::detach()
     if (render)
         render->destroy();
     
+    HashSet<RefPtr<HistoryItem> > associatedHistoryItems;
+    associatedHistoryItems.swap(m_associatedHistoryItems);
+    HashSet<RefPtr<HistoryItem> >::iterator end = associatedHistoryItems.end();
+    for (HashSet<RefPtr<HistoryItem> >::iterator i = associatedHistoryItems.begin(); i != end; ++i)
+        (*i)->documentDetached(this);
+    
     // This is required, as our Frame might delete itself as soon as it detaches
     // us. However, this violates Node::detach() symantics, as it's never
     // possible to re-attach. Eventually Document::detach() should be renamed,
     // or this setting of the frame to 0 could be made explicit in each of the
     // callers of Document::detach().
     m_frame = 0;
-    
-    if (m_renderArena) {
-        delete m_renderArena;
-        m_renderArena = 0;
-    }
+    m_renderArena.clear();
 }
 
 void Document::removeAllEventListeners()
@@ -1647,8 +1650,7 @@ void Document::cancelParsing()
         // the onload handler when closing as a side effect of a cancel-style
         // change, such as opening a new document or closing the window while
         // still parsing
-        delete m_tokenizer;
-        m_tokenizer = 0;
+        m_tokenizer.clear();
         close();
     }
 }
@@ -1657,8 +1659,7 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     removeChildren();
 
@@ -1755,8 +1756,7 @@ void Document::implicitClose()
 
     // We have to clear the tokenizer, in case someone document.write()s from the
     // onLoad event handler, as in Radar 3206524.
-    delete m_tokenizer;
-    m_tokenizer = 0;
+    m_tokenizer.clear();
 
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
@@ -1793,6 +1793,9 @@ void Document::implicitClose()
     ImageLoader::dispatchPendingEvents();
     dispatchWindowLoadEvent();
     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
+    if (m_pendingStateObject)
+        dispatchWindowEvent(PopStateEvent::create(m_pendingStateObject.release()));
+    
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -2291,8 +2294,10 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
-        if (isHTMLDocument())
-            static_cast<HTMLDocument*>(this)->setCookie(content);
+        if (isHTMLDocument()) {
+            ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+            static_cast<HTMLDocument*>(this)->setCookie(content, ec);
+        }
     } else if (equalIgnoringCase(equiv, "content-language"))
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
@@ -2608,7 +2613,7 @@ void Document::recalcStyleSelector()
                     sheet = cssSheet.get();
                 }
             }
-        } else if (n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag))
+        } else if ((n->isHTMLElement() && (n->hasTagName(linkTag) || n->hasTagName(styleTag)))
 #if ENABLE(SVG)
             ||  (n->isSVGElement() && n->hasTagName(SVGNames::styleTag))
 #endif
@@ -2770,14 +2775,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             oldFocusedNode->setActive(false);
 
         oldFocusedNode->setFocus(false);
-                
+
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
-        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+        if (r && r->isTextControl() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            static_cast<Element*>(oldFocusedNode.get())->dispatchFormControlChangeEvent();
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
@@ -2861,6 +2866,8 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
+    if (!focusChangeBlocked)
+        page()->chrome()->focusedNodeChanged(m_focusedNode.get());
 
 SetFocusedNodeDone:
     updateStyleIfNeeded();
@@ -3112,11 +3119,20 @@ Element* Document::ownerElement() const
     return frame()->ownerElement();
 }
 
-String Document::cookie() const
+String Document::cookie(ExceptionCode& ec) const
 {
     if (page() && !page()->cookieEnabled())
         return String();
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on getting if the Document has no
+    // browsing context.
+
+    if (securityOrigin()->isSandboxed(SandboxOrigin)) {
+        ec = SECURITY_ERR;
+        return String();
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return String();
@@ -3124,11 +3140,20 @@ String Document::cookie() const
     return cookies(this, cookieURL);
 }
 
-void Document::setCookie(const String& value)
+void Document::setCookie(const String& value, ExceptionCode& ec)
 {
     if (page() && !page()->cookieEnabled())
         return;
 
+    // FIXME: The HTML5 DOM spec states that this attribute can raise an
+    // INVALID_STATE_ERR exception on setting if the Document has no
+    // browsing context.
+
+    if (securityOrigin()->isSandboxed(SandboxOrigin)) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
     KURL cookieURL = this->cookieURL();
     if (cookieURL.isEmpty())
         return;
@@ -3855,7 +3880,7 @@ void Document::repaintMarkers(DocumentMarker::MarkerType markerType)
     }
 }
 
-void Document::setRenderedRectForMarker(Node* node, DocumentMarker marker, const IntRect& r)
+void Document::setRenderedRectForMarker(Node* node, const DocumentMarker& marker, const IntRect& r)
 {
     MarkerMapVectorPair* vectorPair = m_markers.get(node);
     if (!vectorPair) {
@@ -4377,6 +4402,8 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
+    updateSandboxFlags();
+ 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
@@ -4427,6 +4454,46 @@ void Document::setSecurityOrigin(SecurityOrigin* securityOrigin)
     initDNSPrefetch();
 }
 
+void Document::updateURLForPushOrReplaceState(const KURL& url)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+
+    setURL(url);
+    f->loader()->documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+}
+
+void Document::statePopped(SerializedScriptValue* stateObject)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+    
+    if (f->loader()->isComplete())
+        dispatchWindowEvent(PopStateEvent::create(stateObject));
+    else
+        m_pendingStateObject = stateObject;
+}
+
+void Document::registerHistoryItem(HistoryItem* item)
+{
+    ASSERT(!m_associatedHistoryItems.contains(item));
+    m_associatedHistoryItems.add(item);
+}
+
+void Document::unregisterHistoryItem(HistoryItem* item)
+{
+    ASSERT(m_associatedHistoryItems.contains(item) || m_associatedHistoryItems.isEmpty());
+    m_associatedHistoryItems.remove(item);
+}
+
+void Document::updateSandboxFlags()
+{
+    if (m_frame && securityOrigin())
+        securityOrigin()->setSandboxFlags(m_frame->loader()->sandboxFlags());
+}
+
 void Document::updateFocusAppearanceSoon()
 {
     if (!m_updateFocusAppearanceTimer.isActive())
@@ -4690,7 +4757,7 @@ void Document::scriptImported(unsigned long identifier, const String& sourceStri
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
 public:
-    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassRefPtr<ScriptExecutionContext::Task> task)
+    ScriptExecutionContextTaskTimer(PassRefPtr<Document> context, PassOwnPtr<ScriptExecutionContext::Task> task)
         : m_context(context)
         , m_task(task)
     {
@@ -4704,18 +4771,18 @@ private:
     }
 
     RefPtr<Document> m_context;
-    RefPtr<ScriptExecutionContext::Task> m_task;
+    OwnPtr<ScriptExecutionContext::Task> m_task;
 };
 
-struct PerformTaskContext {
-    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassRefPtr<ScriptExecutionContext::Task> task)
+struct PerformTaskContext : Noncopyable {
+    PerformTaskContext(ScriptExecutionContext* scriptExecutionContext, PassOwnPtr<ScriptExecutionContext::Task> task)
         : scriptExecutionContext(scriptExecutionContext)
         , task(task)
     {
     }
 
     ScriptExecutionContext* scriptExecutionContext; // The context should exist until task execution.
-    RefPtr<ScriptExecutionContext::Task> task;
+    OwnPtr<ScriptExecutionContext::Task> task;
 };
 
 static void performTask(void* ctx)
@@ -4725,7 +4792,7 @@ static void performTask(void* ctx)
     delete ptctx;
 }
 
-void Document::postTask(PassRefPtr<Task> task)
+void Document::postTask(PassOwnPtr<Task> task)
 {
     if (isMainThread()) {
         ScriptExecutionContextTaskTimer* timer = new ScriptExecutionContextTaskTimer(static_cast<Document*>(this), task);
@@ -4790,4 +4857,11 @@ bool Document::isXHTMLMPDocument() const
 }
 #endif
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Document::inspectorTimelineAgent() const 
+{
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index 9f5785e..3d0582c 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -33,7 +33,6 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
-#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
@@ -68,7 +67,6 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
-    class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
     class HTMLAllCollection;
@@ -78,6 +76,8 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class HistoryItem;
+    class HitTestRequest;
     class InspectorTimelineAgent;
     class IntPoint;
     class DOMWrapperWorld;
@@ -85,6 +85,7 @@ namespace WebCore {
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
+    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -93,6 +94,7 @@ namespace WebCore {
     class RenderView;
     class ScriptElementData;
     class SecurityOrigin;
+    class SerializedScriptValue;
     class SegmentedString;
     class Settings;
     class StyleSheet;
@@ -451,12 +453,12 @@ public:
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
     static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
-    DocLoader* docLoader() { return m_docLoader; }
+    DocLoader* docLoader() { return m_docLoader.get(); }
 
     virtual void attach();
     virtual void detach();
 
-    RenderArena* renderArena() { return m_renderArena; }
+    RenderArena* renderArena() { return m_renderArena.get(); }
 
     RenderView* renderView() const;
 
@@ -504,7 +506,7 @@ public:
     CSSStyleSheet* mappedElementSheet();
     
     virtual Tokenizer* createTokenizer();
-    Tokenizer* tokenizer() { return m_tokenizer; }
+    Tokenizer* tokenizer() { return m_tokenizer.get(); }
     
     bool printing() const { return m_printing; }
     void setPrinting(bool p) { m_printing = p; }
@@ -683,8 +685,8 @@ public:
     void setTitle(const String&, Element* titleElement = 0);
     void removeTitle(Element* titleElement);
 
-    String cookie() const;
-    void setCookie(const String&);
+    String cookie(ExceptionCode&) const;
+    void setCookie(const String&, ExceptionCode&);
 
     String referrer() const;
 
@@ -738,7 +740,7 @@ public:
     void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(Node*);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
+    void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setMarkersActive(Range*, bool);
@@ -772,7 +774,7 @@ public:
 
 #if ENABLE(XBL)
     // XBL methods
-    XBLBindingManager* bindingManager() const { return m_bindingManager; }
+    XBLBindingManager* bindingManager() const { return m_bindingManager.get(); }
 #endif
 
     void incDOMTreeVersion() { ++m_domtree_version; }
@@ -832,7 +834,7 @@ public:
     virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
     virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     virtual void scriptImported(unsigned long, const String&);
-    virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+    virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
     typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
     typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
@@ -900,6 +902,13 @@ public:
     //       that already contains content.
     void setSecurityOrigin(SecurityOrigin*);
 
+    void updateURLForPushOrReplaceState(const KURL&);
+    void statePopped(SerializedScriptValue*);
+    void registerHistoryItem(HistoryItem* item);
+    void unregisterHistoryItem(HistoryItem* item);
+
+    void updateSandboxFlags(); // Set sandbox flags as determined by the frame.
+
     bool processingLoadEvent() const { return m_processingLoadEvent; }
 
 #if ENABLE(DATABASE)
@@ -976,8 +985,8 @@ private:
     bool m_didCalculateStyleSelector;
 
     Frame* m_frame;
-    DocLoader* m_docLoader;
-    Tokenizer* m_tokenizer;
+    OwnPtr<DocLoader> m_docLoader;
+    OwnPtr<Tokenizer> m_tokenizer;
     bool m_wellFormed;
 
     // Document URLs.
@@ -1076,8 +1085,8 @@ private:
     String m_title;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
-    
-    RenderArena* m_renderArena;
+
+    OwnPtr<RenderArena> m_renderArena;
 
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
@@ -1090,6 +1099,8 @@ private:
     Element* m_cssTarget;
     
     bool m_processingLoadEvent;
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+    HashSet<RefPtr<HistoryItem> > m_associatedHistoryItems;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
 
@@ -1102,7 +1113,7 @@ private:
 #endif
 
 #if ENABLE(XBL)
-    XBLBindingManager* m_bindingManager; // The access point through which documents and elements communicate with XBL.
+    OwnPtr<XBLBindingManager> m_bindingManager; // The access point through which documents and elements communicate with XBL.
 #endif
     
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
@@ -1204,12 +1215,6 @@ inline bool Node::isDocumentNode() const
     return this == m_document;
 }
 
-#if ENABLE(INSPECTOR)
-inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
-    return page() ? page()->inspectorTimelineAgent() : 0;
-}
-#endif
-
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index ce7010a..e54add0 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -35,7 +35,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +64,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [HintAtomic] DOMString elementId);
+        Element            getElementById(in DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -162,10 +162,9 @@ module core {
 #endif
         readonly attribute DOMString URL;
 
-        // FIXME: the DOM spec states that this attribute can 
-        // raise an exception on setting.
                  attribute [ConvertNullToNullString] DOMString cookie
-                     /*setter raises (DOMException)*/;
+                     setter raises (DOMException),
+                     getter raises (DOMException);
 
         // FIXME: the DOM spec does NOT have this attribute
         // raising an exception.
diff --git a/WebCore/dom/DynamicNodeList.cpp b/WebCore/dom/DynamicNodeList.cpp
index 892a5e7..3f0744b 100644
--- a/WebCore/dom/DynamicNodeList.cpp
+++ b/WebCore/dom/DynamicNodeList.cpp
@@ -129,7 +129,9 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
                     return node;
             }
         }
-        return 0;
+        if (!node)
+            return 0;
+        // In the case of multiple nodes with the same name, just fall through.
     }
 
     unsigned length = this->length();
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 9edde25..d7f1b11 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -47,6 +47,7 @@
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
 
@@ -135,6 +136,12 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
     ExceptionCode ec;
     setAttribute(name, value, ec);
 }
+    
+void Element::setCStringAttribute(const QualifiedName& name, const char* cStringValue)
+{
+    ExceptionCode ec;
+    setAttribute(name, AtomicString(cStringValue), ec);
+}
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 {
@@ -488,8 +495,10 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 const AtomicString& Element::getAttribute(const String& name) const
 {
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    if (localName == styleAttr.localName() && !m_isStyleAttributeValid)
+    bool ignoreCase = shouldIgnoreAttributeCase(this);
+    
+    // Update the 'style' attribute if it's invalid and being requested:
+    if (!m_isStyleAttributeValid && equalPossiblyIgnoringCase(name, styleAttr.localName(), ignoreCase))
         updateStyleAttribute();
 
 #if ENABLE(SVG)
@@ -498,8 +507,8 @@ const AtomicString& Element::getAttribute(const String& name) const
 #endif
 
     if (namedAttrMap)
-        if (Attribute* a = namedAttrMap->getAttributeItem(name, shouldIgnoreAttributeCase(this)))
-            return a->value();
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name, ignoreCase))
+            return attribute->value();
     
     return nullAtom;
 }
@@ -727,6 +736,7 @@ void Element::removedFromDocument()
 void Element::attach()
 {
     suspendPostAttachCallbacks();
+    RenderWidget::suspendWidgetHierarchyUpdates();
 
     createRendererIfNeeded();
     ContainerNode::attach();
@@ -739,20 +749,25 @@ void Element::attach()
         }
     }
 
+    RenderWidget::resumeWidgetHierarchyUpdates();
     resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
+    RenderWidget::suspendWidgetHierarchyUpdates();
+
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
     ContainerNode::detach();
+
+    RenderWidget::resumeWidgetHierarchyUpdates();
 }
 
 bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle)
 {
-    ASSERT(currentStyle = renderStyle());
+    ASSERT(currentStyle == renderStyle());
 
     if (!renderer() || !currentStyle)
         return false;
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index d27976a..97d3eb4 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -167,6 +167,9 @@ public:
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
+    // Please don't use setCStringAttribute in performance-sensitive code;
+    // use a static AtomicString value instead to avoid the conversion overhead.
+    void setCStringAttribute(const QualifiedName&, const char* cStringValue);
 
     virtual NamedNodeMap* attributes() const;
     NamedNodeMap* attributes(bool readonly) const;
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index 5d8eaaa..eda44b0 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -96,6 +96,11 @@ bool Event::isTextEvent() const
     return false;
 }
 
+bool Event::isCompositionEvent() const
+{
+    return false;
+}
+
 bool Event::isDragEvent() const
 {
     return false;
@@ -131,6 +136,11 @@ bool Event::isPageTransitionEvent() const
     return false;
 }
 
+bool Event::isPopStateEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index b391985..7ec85a7 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -103,6 +103,7 @@ namespace WebCore {
         virtual bool isMutationEvent() const;
         virtual bool isKeyboardEvent() const;
         virtual bool isTextEvent() const;
+        virtual bool isCompositionEvent() const;
         virtual bool isDragEvent() const; // a subset of mouse events
         virtual bool isClipboardEvent() const;
         virtual bool isMessageEvent() const;
@@ -110,6 +111,7 @@ namespace WebCore {
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
         virtual bool isPageTransitionEvent() const;
+        virtual bool isPopStateEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
diff --git a/WebCore/dom/EventNames.cpp b/WebCore/dom/EventNames.cpp
index 00191ab..900b8ef 100644
--- a/WebCore/dom/EventNames.cpp
+++ b/WebCore/dom/EventNames.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index b2db177..63460a5 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -41,6 +41,9 @@ namespace WebCore {
     macro(checking) \
     macro(click) \
     macro(close) \
+    macro(compositionend) \
+    macro(compositionstart) \
+    macro(compositionupdate) \
     macro(connect) \
     macro(contextmenu) \
     macro(copy) \
@@ -81,6 +84,7 @@ namespace WebCore {
     macro(pagehide) \
     macro(pageshow) \
     macro(paste) \
+    macro(popstate) \
     macro(readystatechange) \
     macro(reset) \
     macro(resize) \
@@ -135,6 +139,9 @@ namespace WebCore {
     macro(volumechange) \
     macro(waiting) \
     \
+    macro(webkitbeginfullscreen) \
+    macro(webkitendfullscreen) \
+    \
     macro(progress) \
     macro(stalled) \
     macro(suspend) \
@@ -149,7 +156,7 @@ namespace WebCore {
     \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
-    class EventNames {
+    class EventNames : public Noncopyable {
         int dummy; // Needed to make initialization macro work.
         // Private to prevent accidental call to EventNames() instead of eventNames()
         EventNames();
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 694e78a..65d751a 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
@@ -68,6 +66,11 @@ bool eventDispatchForbidden()
 }
 #endif // NDEBUG
 
+EventTargetData::~EventTargetData()
+{
+    deleteAllValues(eventListenerMap);
+}
+
 EventTarget::~EventTarget()
 {
 }
@@ -157,16 +160,19 @@ bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<Eve
 {
     EventTargetData* d = ensureEventTargetData();
 
-    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
-    EventListenerVector& entry = result.first->second;
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, 0);
+    EventListenerVector*& entry = result.first->second;
+    const bool isNewEntry = result.second;
+    if (isNewEntry)
+        entry = new EventListenerVector();
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    if (!result.second) { // pre-existing entry
-        if (entry.find(registeredListener) != notFound) // duplicate listener
+    if (!isNewEntry) {
+        if (entry->find(registeredListener) != notFound) // duplicate listener
             return false;
     }
 
-    entry.append(registeredListener);
+    entry->append(registeredListener);
     return true;
 }
 
@@ -179,16 +185,18 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
     EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector* entry = result->second;
 
     RegisteredEventListener registeredListener(listener, useCapture);
-    size_t index = entry.find(registeredListener);
+    size_t index = entry->find(registeredListener);
     if (index == notFound)
         return false;
 
-    entry.remove(index);
-    if (!entry.size())
+    entry->remove(index);
+    if (entry->isEmpty()) {
+        delete entry;
         d->eventListenerMap.remove(result);
+    }
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
@@ -266,7 +274,7 @@ bool EventTarget::fireEventListeners(Event* event)
     EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
     if (result == d->eventListenerMap.end())
         return false;
-    EventListenerVector& entry = result->second;
+    EventListenerVector& entry = *result->second;
 
     RefPtr<EventTarget> protect = this;
 
@@ -303,7 +311,7 @@ const EventListenerVector& EventTarget::getEventListeners(const AtomicString& ev
     EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
     if (it == d->eventListenerMap.end())
         return emptyVector;
-    return it->second;
+    return *it->second;
 }
 
 void EventTarget::removeAllEventListeners()
@@ -311,6 +319,7 @@ void EventTarget::removeAllEventListeners()
     EventTargetData* d = eventTargetData();
     if (!d)
         return;
+    deleteAllValues(d->eventListenerMap);
     d->eventListenerMap.clear();
 
     // Notify firing events planning to invoke the listener at 'index' that
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 9a1975c..2d77c87 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -76,9 +76,11 @@ namespace WebCore {
     typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
-    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+    typedef HashMap<AtomicString, EventListenerVector*> EventListenerMap;
+
+    struct EventTargetData : Noncopyable {
+        ~EventTargetData();
 
-    struct EventTargetData {
         EventListenerMap eventListenerMap;
         FiringEventIteratorVector firingEventIterators;
     };
@@ -190,7 +192,7 @@ namespace WebCore {
 
         EventListenerMap::iterator end = d->eventListenerMap.end();
         for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
-            EventListenerVector& entry = it->second;
+            EventListenerVector& entry = *it->second;
             for (size_t i = 0; i < entry.size(); ++i)
                 entry[i].listener->markJSFunction(markStack);
         }
@@ -202,6 +204,7 @@ namespace WebCore {
         if (!d)
             return;
 
+        deleteAllValues(d->eventListenerMap);
         d->eventListenerMap.clear();
     }
 #endif
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index e0e7110..2ae0312 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -48,7 +48,8 @@ public:
 
     virtual int size() const = 0;
     virtual String value() const = 0;
-    virtual void setValue(const String&) = 0;
+    virtual void setValue(const String&, bool sendChangeEvent = false) = 0;
+    virtual void setValueForUser(const String&) = 0;
 
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
diff --git a/WebCore/dom/KeyboardEvent.cpp b/WebCore/dom/KeyboardEvent.cpp
index 6bc825f..99c9220 100644
--- a/WebCore/dom/KeyboardEvent.cpp
+++ b/WebCore/dom/KeyboardEvent.cpp
@@ -80,7 +80,6 @@ KeyboardEvent::KeyboardEvent(const AtomicString& eventType, bool canBubble, bool
 
 KeyboardEvent::~KeyboardEvent()
 {
-    delete m_keyEvent;
 }
 
 void KeyboardEvent::initKeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView* view,
diff --git a/WebCore/dom/KeyboardEvent.h b/WebCore/dom/KeyboardEvent.h
index 2b0a131..793ac41 100644
--- a/WebCore/dom/KeyboardEvent.h
+++ b/WebCore/dom/KeyboardEvent.h
@@ -79,7 +79,7 @@ namespace WebCore {
 
         bool altGraphKey() const { return m_altGraphKey; }
     
-        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent; }
+        const PlatformKeyboardEvent* keyEvent() const { return m_keyEvent.get(); }
 
         int keyCode() const; // key code for keydown and keyup, character for keypress
         int charCode() const; // character code for keypress, 0 for keydown and keyup
@@ -99,7 +99,7 @@ namespace WebCore {
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
 
-        PlatformKeyboardEvent* m_keyEvent;
+        OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
         unsigned m_keyLocation;
         bool m_altGraphKey : 1;
diff --git a/WebCore/dom/MappedAttributeEntry.h b/WebCore/dom/MappedAttributeEntry.h
index 745ad23..842e7a8 100644
--- a/WebCore/dom/MappedAttributeEntry.h
+++ b/WebCore/dom/MappedAttributeEntry.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
diff --git a/WebCore/dom/MessagePort.cpp b/WebCore/dom/MessagePort.cpp
index 9f6e649..1051920 100644
--- a/WebCore/dom/MessagePort.cpp
+++ b/WebCore/dom/MessagePort.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 MessagePort::MessagePort(ScriptExecutionContext& scriptExecutionContext)
     : m_entangledChannel(0)
     , m_started(false)
+    , m_closed(false)
     , m_scriptExecutionContext(&scriptExecutionContext)
 {
     m_scriptExecutionContext->createdMessagePort(this);
@@ -131,6 +132,7 @@ void MessagePort::start()
 
 void MessagePort::close()
 {
+    m_closed = true;
     if (!m_entangledChannel)
         return;
     m_entangledChannel->close();
@@ -200,7 +202,7 @@ PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessageP
     // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
     for (unsigned int i = 0; i < ports->size(); ++i) {
         MessagePort* port = (*ports)[i].get();
-        if (!port || !port->isEntangled() || portSet.contains(port)) {
+        if (!port || port->isCloned() || portSet.contains(port)) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
diff --git a/WebCore/dom/MessagePort.h b/WebCore/dom/MessagePort.h
index 0ab0f50..ae1eb22 100644
--- a/WebCore/dom/MessagePort.h
+++ b/WebCore/dom/MessagePort.h
@@ -103,7 +103,10 @@ namespace WebCore {
         // Returns null otherwise.
         // NOTE: This is used solely to enable a GC optimization. Some platforms may not be able to determine ownership of the remote port (since it may live cross-process) - those platforms may always return null.
         MessagePort* locallyEntangledPort();
-        bool isEntangled() { return m_entangledChannel; }
+        // A port starts out its life entangled, and remains entangled until it is closed or is cloned.
+        bool isEntangled() { return !m_closed && !isCloned(); }
+        // A port is cloned if its entangled channel has been removed and sent to a new owner via postMessage().
+        bool isCloned() { return !m_entangledChannel; }
 
     private:
         MessagePort(ScriptExecutionContext&);
@@ -116,6 +119,7 @@ namespace WebCore {
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
+        bool m_closed;
 
         ScriptExecutionContext* m_scriptExecutionContext;
         EventTargetData m_eventTargetData;
diff --git a/WebCore/dom/MessagePortChannel.h b/WebCore/dom/MessagePortChannel.h
index 2321b1f..90cb0d9 100644
--- a/WebCore/dom/MessagePortChannel.h
+++ b/WebCore/dom/MessagePortChannel.h
@@ -78,7 +78,7 @@ namespace WebCore {
         // Returns true if the proxy currently contains messages for this port.
         bool hasPendingActivity();
 
-        class EventData {
+        class EventData : public Noncopyable {
         public:
             static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
diff --git a/WebCore/dom/MouseRelatedEvent.h b/WebCore/dom/MouseRelatedEvent.h
index 7649aa9..fc494d1 100644
--- a/WebCore/dom/MouseRelatedEvent.h
+++ b/WebCore/dom/MouseRelatedEvent.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
  * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index d4ec598..56b40b9 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -177,11 +177,33 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
 Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
+    bool doSlowCheck = shouldIgnoreAttributeCase;
+    
+    // Optimize for the case where the attribute exists and its name exactly matches.
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
-            return m_attributes[i].get();
-        if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
-            return m_attributes[i].get();
+        const QualifiedName& attrName = m_attributes[i]->name();
+        if (!attrName.hasPrefix()) {
+            if (name == attrName.localName())
+                return m_attributes[i].get();
+        } else
+            doSlowCheck = true;
+    }
+    
+    // Continue to checking case-insensitively and/or full namespaced names if necessary:
+    if (doSlowCheck) {
+        for (unsigned i = 0; i < len; ++i) {
+            const QualifiedName& attrName = m_attributes[i]->name();
+            if (!attrName.hasPrefix()) {
+                if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attrName.localName()))
+                    return m_attributes[i].get();
+            } else {
+                // FIXME: Would be faster to do this comparison without calling toString, which
+                // generates a temporary string by concatenation. But this branch is only reached
+                // if the attribute name has a prefix, which is rare in HTML.
+                if (equalPossiblyIgnoringCase(name, attrName.toString(), shouldIgnoreAttributeCase))
+                    return m_attributes[i].get();
+            }
+        }
     }
     return 0;
 }
diff --git a/WebCore/dom/NamedMappedAttrMap.h b/WebCore/dom/NamedMappedAttrMap.h
index 0afa278..a288685 100644
--- a/WebCore/dom/NamedMappedAttrMap.h
+++ b/WebCore/dom/NamedMappedAttrMap.h
@@ -26,8 +26,8 @@
 #ifndef NamedMappedAttrMap_h
 #define NamedMappedAttrMap_h
 
-#include "ClassNames.h"
 #include "NamedNodeMap.h"
+#include "SpaceSplitString.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ public:
 
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
-    const ClassNames& classNames() const { return m_classNames; }
+    const SpaceSplitString& classNames() const { return m_classNames; }
 
     bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
@@ -53,7 +53,7 @@ private:
 
     int declCount() const;
 
-    ClassNames m_classNames;
+    SpaceSplitString m_classNames;
     int m_mappedAttributeCount;
 };
 
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 446efda..4ae83de 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -415,7 +415,6 @@ Node::Node(Document* document, ConstructionType type)
     , m_hovered(false)
     , m_inActiveChain(false)
     , m_inDetach(false)
-    , m_inSubtreeMark(false)
     , m_hasRareData(false)
     , m_isElement(isElement(type))
     , m_isContainer(isContainer(type))
@@ -1768,23 +1767,22 @@ bool Node::isEqualNode(Node *other) const
     return true;
 }
 
-bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
+bool Node::isDefaultNamespace(const AtomicString& namespaceURIMaybeEmpty) const
 {
-    // Implemented according to
-    // http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/namespaces-algorithms.html#isDefaultNamespaceAlgo
-    
+    const AtomicString& namespaceURI = namespaceURIMaybeEmpty.isEmpty() ? nullAtom : namespaceURIMaybeEmpty;
+
     switch (nodeType()) {
         case ELEMENT_NODE: {
-            const Element *elem = static_cast<const Element *>(this);
+            const Element* elem = static_cast<const Element*>(this);
             
             if (elem->prefix().isNull())
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedNodeMap *attrs = elem->attributes();
+                NamedNodeMap* attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
-                    Attribute *attr = attrs->attributeItem(i);
+                    Attribute* attr = attrs->attributeItem(i);
                     
                     if (attr->localName() == "xmlns")
                         return attr->value() == namespaceURI;
@@ -1806,7 +1804,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
         case DOCUMENT_FRAGMENT_NODE:
             return false;
         case ATTRIBUTE_NODE: {
-            const Attr *attr = static_cast<const Attr *>(this);
+            const Attr* attr = static_cast<const Attr*>(this);
             if (attr->ownerElement())
                 return attr->ownerElement()->isDefaultNamespace(namespaceURI);
             return false;
@@ -2539,6 +2537,23 @@ bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
     return dispatchGenericEvent(event.release());
 }
 
+static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    if (window && window->hasEventListeners(eventType))
+        return true;
+
+    if (node->hasEventListeners(eventType))
+        return true;
+
+    for (size_t i = 0; i < ancestors.size(); i++) {
+        ContainerNode* ancestor = ancestors[i].get();
+        if (ancestor->hasEventListeners(eventType))
+            return true;
+    }
+
+   return false;    
+}
+
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 {
     RefPtr<Event> event(prpEvent);
@@ -2547,12 +2562,6 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willDispatchDOMEvent(*event);
-#endif
-
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
@@ -2570,6 +2579,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
             targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && eventHasListeners(event->type(), targetForWindowEvents, this, ancestors);
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = preDispatchEventHandler(event.get());
     if (event->propagationStopped())
@@ -2651,8 +2667,8 @@ doneDispatching:
 
 doneWithDefault:
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didDispatchDOMEvent();
+    if (timelineAgentIsActive && (timelineAgent = document()->inspectorTimelineAgent()))
+        timelineAgent->didDispatchEvent();
 #endif
 
     Document::updateStyleForAllDocuments();
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 082ab16..7da8634 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -289,9 +289,6 @@ public:
     void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
-    bool inSubtreeMark() const { return m_inSubtreeMark; }
-    void setInSubtreeMark(bool b = true) { m_inSubtreeMark = b; }
-
     void lazyAttach();
     virtual bool canLazyAttach();
 
@@ -642,7 +639,6 @@ private:
     bool m_hovered : 1;
     bool m_inActiveChain : 1;
     bool m_inDetach : 1;
-    bool m_inSubtreeMark : 1;
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
diff --git a/WebCore/dom/NodeFilter.h b/WebCore/dom/NodeFilter.h
index 5a542ad..53b32e1 100644
--- a/WebCore/dom/NodeFilter.h
+++ b/WebCore/dom/NodeFilter.h
@@ -73,8 +73,9 @@ namespace WebCore {
         short acceptNode(ScriptState*, Node*) const;
         void markAggregate(JSC::MarkStack& markStack) { m_condition->markAggregate(markStack); };
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(node), node); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        short acceptNode(Node* node) const { return acceptNode(scriptStateFromNode(mainThreadNormalWorld(), node), node); }
 
     private:
         NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
diff --git a/WebCore/dom/NodeIterator.h b/WebCore/dom/NodeIterator.h
index 2a992d3..3eec49a 100644
--- a/WebCore/dom/NodeIterator.h
+++ b/WebCore/dom/NodeIterator.h
@@ -52,9 +52,10 @@ namespace WebCore {
         // This function is called before any node is removed from the document tree.
         void nodeWillBeRemoved(Node*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(referenceNode()), ec); }
-        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(referenceNode()), ec); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        PassRefPtr<Node> nextNode(ExceptionCode& ec) { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
+        PassRefPtr<Node> previousNode(ExceptionCode& ec) { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), referenceNode()), ec); }
 
     private:
         NodeIterator(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index 8b9e1bf..6e9d0e4 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-struct NodeListsNodeData {
+struct NodeListsNodeData : Noncopyable {
     typedef HashSet<DynamicNodeList*> NodeListSet;
     NodeListSet m_listsWithCaches;
     
@@ -62,7 +62,7 @@ private:
     }
 };
     
-class NodeRareData {
+class NodeRareData : public Noncopyable {
 public:    
     NodeRareData()
         : m_tabIndex(0)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/WebCore/dom/PopStateEvent.cpp
index 04697ce..b9ad862 100644
--- a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
+++ b/WebCore/dom/PopStateEvent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -21,30 +21,30 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
 #include "config.h"
+#include "PopStateEvent.h"
 
-#if ENABLE(3D_CANVAS)
-
-#include "JSCanvasByteArray.h"
-
-#include "CanvasByteArray.h"
-
-using namespace JSC;
+#include "EventNames.h"
 
 namespace WebCore {
 
-void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> stateObject)
+    : Event(eventNames().popstateEvent, false, true)
+    , m_stateObject(stateObject)
 {
-    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
 }
-
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+    
+void PopStateEvent::initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> stateObject)
 {
-    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubble, cancelable);
+
+    m_stateObject = stateObject;
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/dom/PopStateEvent.h b/WebCore/dom/PopStateEvent.h
new file mode 100644
index 0000000..2fb8d06
--- /dev/null
+++ b/WebCore/dom/PopStateEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef PopStateEvent_h
+#define PopStateEvent_h
+
+#include "Event.h"
+#include "SerializedScriptValue.h"
+
+namespace WebCore {
+
+class SerializedScriptValue;
+
+class PopStateEvent : public Event {
+public:
+    static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue> stateObject)
+    {
+        return adoptRef(new PopStateEvent(stateObject));
+    }
+
+    void initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue>);
+    bool isPopStateEvent() const { return true; }
+
+    SerializedScriptValue* state() const { return m_stateObject.get(); }    
+
+private:
+    PopStateEvent(PassRefPtr<SerializedScriptValue>);
+
+    RefPtr<SerializedScriptValue> m_stateObject;
+};
+
+} // namespace WebCore
+
+#endif // PopStateEvent_h
diff --git a/WebCore/dom/PopStateEvent.idl b/WebCore/dom/PopStateEvent.idl
new file mode 100644
index 0000000..c6775ec
--- /dev/null
+++ b/WebCore/dom/PopStateEvent.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] PopStateEvent : Event {
+        [Custom] void initPopStateEvent(in DOMString typeArg, 
+                               in boolean canBubbleArg, 
+                               in boolean cancelableArg, 
+                               in any stateArg);
+                               
+        readonly attribute [CustomGetter] any state;
+    };
+
+}
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 060b28c..0ff8262 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -307,6 +307,27 @@ bool Position::atLastEditingPositionForNode() const
     return m_offset >= lastOffsetForEditing(node());
 }
 
+// A position is considered at editing boundary if one of the following is true:
+// 1. It is the first position in the node and the next visually equivalent position
+//    is non editable.
+// 2. It is the last position in the node and the previous visually equivalent position
+//    is non editable.
+// 3. It is an editable position and both the next and previous visually equivalent
+//    positions are both non editable.
+bool Position::atEditingBoundary() const
+{
+    Position nextPosition = downstream(CanCrossEditingBoundary);
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.node()->isContentEditable())
+        return true;
+        
+    Position prevPosition = upstream(CanCrossEditingBoundary);
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable())
+        return true;
+        
+    return nextPosition.isNotNull() && !nextPosition.node()->isContentEditable()
+        && prevPosition.isNotNull() && !prevPosition.node()->isContentEditable();
+}
+
 bool Position::atStartOfTree() const
 {
     if (isNull())
@@ -448,7 +469,7 @@ static bool isStreamer(const PositionIterator& pos)
 // and downstream() will return the right one.
 // Also, upstream() will return [boundary, 0] for any of the positions from [boundary, 0] to the first candidate
 // in boundary, where endsOfNodeAreVisuallyDistinctPositions(boundary) is true.
-Position Position::upstream() const
+Position Position::upstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -460,6 +481,7 @@ Position Position::upstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
@@ -468,8 +490,11 @@ Position Position::upstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
             lastNode = currentNode;
         }
 
@@ -483,6 +508,11 @@ Position Position::upstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
                  
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -560,7 +590,7 @@ Position Position::upstream() const
 // and upstream() will return the left one.
 // Also, downstream() will return the last position in the last atomic node in boundary for all of the positions
 // in boundary after the last candidate, where endsOfNodeAreVisuallyDistinctPositions(boundary).
-Position Position::downstream() const
+Position Position::downstream(EditingBoundaryCrossingRule rule) const
 {
     Node* startNode = node();
     if (!startNode)
@@ -572,6 +602,7 @@ Position Position::downstream() const
     PositionIterator currentPos = lastVisible;
     bool startEditable = startNode->isContentEditable();
     Node* lastNode = startNode;
+    bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
@@ -580,8 +611,12 @@ Position Position::downstream() const
         if (currentNode != lastNode) {
             // Don't change editability.
             bool currentEditable = currentNode->isContentEditable();
-            if (startEditable != currentEditable)
-                break;
+            if (startEditable != currentEditable) {
+                if (rule == CannotCrossEditingBoundary)
+                    break;
+                boundaryCrossed = true;
+            }
+                
             lastNode = currentNode;
         }
 
@@ -604,6 +639,11 @@ Position Position::downstream() const
         if (!renderer || renderer->style()->visibility() != VISIBLE)
             continue;
             
+        if (rule == CanCrossEditingBoundary && boundaryCrossed) {
+            lastVisible = currentPos;
+            break;
+        }
+        
         // track last visible streamer position
         if (isStreamer(currentPos))
             lastVisible = currentPos;
@@ -704,10 +744,14 @@ bool Position::isCandidate() const
     if (isTableElement(node()) || editingIgnoresContent(node()))
         return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
-    if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
-        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(node());
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(node()) && atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
@@ -949,7 +993,22 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
 {
     caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
+          
     if (!renderer->isText()) {
+        if (renderer->isBlockFlow() && hasRenderedNonAnonymousDescendantsWithHeight(renderer)) {
+            bool lastPosition = caretOffset == lastOffsetInNode(node());
+            Node* startNode = lastPosition ? node()->childNode(caretOffset - 1) : node()->childNode(caretOffset);
+            while (startNode && (!startNode->renderer() || (startNode->isTextNode() && toRenderText(startNode->renderer())->isAllCollapsibleWhitespace())))
+                startNode = (lastPosition)? startNode->previousSibling(): startNode->nextSibling();
+            if (startNode) {
+                Position pos(startNode, 0);
+                pos = pos.downstream(CanCrossEditingBoundary);
+                pos.getInlineBoxAndOffset(UPSTREAM, primaryDirection, inlineBox, caretOffset);
+                if (lastPosition && inlineBox)
+                    caretOffset = inlineBox->caretMaxOffset();
+                return;
+            }
+        }
         inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
         if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
             return;
diff --git a/WebCore/dom/Position.h b/WebCore/dom/Position.h
index c08872d..1e0304e 100644
--- a/WebCore/dom/Position.h
+++ b/WebCore/dom/Position.h
@@ -56,6 +56,11 @@ public:
         PositionIsBeforeAnchor
     };
 
+    enum EditingBoundaryCrossingRule {
+        CanCrossEditingBoundary,
+        CannotCrossEditingBoundary
+    };
+    
     Position()
         : m_offset(0)
         , m_anchorType(PositionIsOffsetInAnchor)
@@ -130,6 +135,9 @@ public:
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
+    // Retuns true if the visually equivalent positions around have different editability
+    bool atEditingBoundary() const;
+    
     bool atStartOfTree() const;
     bool atEndOfTree() const;
 
@@ -139,8 +147,8 @@ public:
     Position trailingWhitespacePosition(EAffinity, bool considerNonCollapsibleWhitespace = false) const;
     
     // These return useful visually equivalent positions.
-    Position upstream() const;
-    Position downstream() const;
+    Position upstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
+    Position downstream(EditingBoundaryCrossingRule = CannotCrossEditingBoundary) const;
     
     bool isCandidate() const;
     bool inRenderedText() const;
diff --git a/WebCore/dom/PositionIterator.cpp b/WebCore/dom/PositionIterator.cpp
index 8d881ba..f5b65f5 100644
--- a/WebCore/dom/PositionIterator.cpp
+++ b/WebCore/dom/PositionIterator.cpp
@@ -156,10 +156,14 @@ bool PositionIterator::isCandidate() const
     if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
         return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-    
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow()) {
+        if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
+                return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
+            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+        }
+    }
+
     return false;
 }
 
diff --git a/WebCore/dom/ProcessingInstruction.cpp b/WebCore/dom/ProcessingInstruction.cpp
index 8a94864..8adf9aa 100644
--- a/WebCore/dom/ProcessingInstruction.cpp
+++ b/WebCore/dom/ProcessingInstruction.cpp
@@ -42,6 +42,7 @@ inline ProcessingInstruction::ProcessingInstruction(Document* document, const St
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
+    , m_createdByParser(false)
 #if ENABLE(XSLT)
     , m_isXSL(false)
 #endif
diff --git a/WebCore/dom/QualifiedName.cpp b/WebCore/dom/QualifiedName.cpp
index 2c5f39a..795bdb6 100644
--- a/WebCore/dom/QualifiedName.cpp
+++ b/WebCore/dom/QualifiedName.cpp
@@ -51,7 +51,7 @@ struct QNameComponentsTranslator {
 
 static QNameSet* gNameCache;
 
-QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+void QualifiedName::init(const AtomicString& p, const AtomicString& l, const AtomicString& n)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
@@ -62,6 +62,16 @@ QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const
         m_impl->ref();
 }
 
+QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+{
+    init(p, l, n);
+}
+
+QualifiedName::QualifiedName(const AtomicString& p, const char* l, const AtomicString& n)
+{
+    init(p, AtomicString(l), n);
+}
+
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
diff --git a/WebCore/dom/QualifiedName.h b/WebCore/dom/QualifiedName.h
index 3b9f5c4..a7e1fcb 100644
--- a/WebCore/dom/QualifiedName.h
+++ b/WebCore/dom/QualifiedName.h
@@ -32,7 +32,7 @@ struct QualifiedNameComponents {
     StringImpl* m_namespace;
 };
 
-class QualifiedName {
+class QualifiedName : public FastAllocBase {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
@@ -57,6 +57,7 @@ public:
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
+    QualifiedName(const AtomicString& prefix, const char* localName, const AtomicString& namespaceURI);
     ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
@@ -88,6 +89,7 @@ public:
     static void init();
     
 private:
+    void init(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
     void ref() const { m_impl->ref(); }
     void deref();
     
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index 122130d..84a46c2 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -1595,12 +1595,32 @@ IntRect Range::boundingBox()
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
-    if (!m_start.container() || !m_end.container())
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+
+    if (!startContainer || !endContainer)
         return;
 
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+    }
+}
+
+void Range::textQuads(Vector<FloatQuad>& quads, bool useSelectionHeight)
+{
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
 
+    if (!startContainer || !endContainer)
+        return;
+
     Node* stopNode = pastLastNode();
     for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
         RenderObject* r = node->renderer();
@@ -1608,8 +1628,8 @@ void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
             continue;
         RenderText* renderText = toRenderText(r);
         int startOffset = node == startContainer ? m_start.offset() : 0;
-        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
-        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
+        int endOffset = node == endContainer ? m_end.offset() : numeric_limits<int>::max();
+        renderText->absoluteQuadsForRange(quads, startOffset, endOffset, useSelectionHeight);
     }
 }
 
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index e2e282b..583f9f0 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -105,7 +105,10 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
+    // Not transform-friendly
     void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    // Transform-friendly
+    void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
diff --git a/WebCore/dom/RangeException.h b/WebCore/dom/RangeException.h
index 2eee3b0..c9f4f5c 100644
--- a/WebCore/dom/RangeException.h
+++ b/WebCore/dom/RangeException.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index 827aff3..83ed2bb 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -229,12 +229,14 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
          We want to accept all the values that either of these browsers accept, but not other values.
      */
     String type = m_scriptElement->typeAttributeValue();
-    if (!type.isEmpty())
-        return MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower());
-
-    String language = m_scriptElement->languageAttributeValue();
-    if (!language.isEmpty())
-        return isSupportedJavaScriptLanguage(language);
+    if (!type.isEmpty()) {
+        if (!MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace().lower()))
+            return false;
+    } else {
+        String language = m_scriptElement->languageAttributeValue();
+        if (!language.isEmpty() && !isSupportedJavaScriptLanguage(language))
+            return false;
+    }    
 
     // No type or language is specified, so we assume the script to be JavaScript.
     // We don't yet support setting event listeners via the 'for' attribute for scripts.
diff --git a/WebCore/dom/ScriptExecutionContext.cpp b/WebCore/dom/ScriptExecutionContext.cpp
index f7046e3..bc71084 100644
--- a/WebCore/dom/ScriptExecutionContext.cpp
+++ b/WebCore/dom/ScriptExecutionContext.cpp
@@ -44,9 +44,9 @@ namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<ProcessMessagesSoonTask> create()
+    static PassOwnPtr<ProcessMessagesSoonTask> create()
     {
-        return adoptRef(new ProcessMessagesSoonTask);
+        return new ProcessMessagesSoonTask;
     }
 
     virtual void performTask(ScriptExecutionContext* context)
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index 398afec..cf332c3 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -92,13 +93,13 @@ namespace WebCore {
         void ref() { refScriptExecutionContext(); }
         void deref() { derefScriptExecutionContext(); }
 
-        class Task : public ThreadSafeShared<Task> {
+        class Task : public Noncopyable {
         public:
             virtual ~Task();
             virtual void performTask(ScriptExecutionContext*) = 0;
         };
 
-        virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
         void addTimeout(int timeoutId, DOMTimer*);
         void removeTimeout(int timeoutId);
diff --git a/WebCore/dom/ClassNames.cpp b/WebCore/dom/SpaceSplitString.cpp
index 1c5ff47..b062dbf 100644
--- a/WebCore/dom/ClassNames.cpp
+++ b/WebCore/dom/SpaceSplitString.cpp
@@ -19,7 +19,7 @@
  */
 
 #include "config.h"
-#include "ClassNames.h"
+#include "SpaceSplitString.h"
 
 #include <wtf/ASCIICType.h>
 
@@ -41,7 +41,7 @@ static bool hasNonASCIIOrUpper(const String& string)
     return hasUpper || (ored & ~0x7F);
 }
 
-void ClassNamesData::createVector()
+void SpaceSplitStringData::createVector()
 {
     ASSERT(!m_createdVector);
     ASSERT(m_vector.isEmpty());
@@ -70,7 +70,7 @@ void ClassNamesData::createVector()
     m_createdVector = true;
 }
 
-bool ClassNamesData::containsAll(ClassNamesData& other)
+bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
 {
     ensureVector();
     other.ensureVector();
diff --git a/WebCore/dom/ClassNames.h b/WebCore/dom/SpaceSplitString.h
index a836606..2ef3fc4 100644
--- a/WebCore/dom/ClassNames.h
+++ b/WebCore/dom/SpaceSplitString.h
@@ -18,8 +18,8 @@
  *
  */
 
-#ifndef ClassNames_h
-#define ClassNames_h
+#ifndef SpaceSplitString_h
+#define SpaceSplitString_h
 
 #include "AtomicString.h"
 #include <wtf/OwnPtr.h>
@@ -27,9 +27,9 @@
 
 namespace WebCore {
 
-    class ClassNamesData : public Noncopyable {
+    class SpaceSplitStringData : public Noncopyable {
     public:
-        ClassNamesData(const String& string, bool shouldFoldCase)
+        SpaceSplitStringData(const String& string, bool shouldFoldCase)
             : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
         {
         }
@@ -45,7 +45,7 @@ namespace WebCore {
             return false;
         }
 
-        bool containsAll(ClassNamesData&);
+        bool containsAll(SpaceSplitStringData&);
 
         size_t size() { ensureVector(); return m_vector.size(); }
         const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
@@ -54,29 +54,29 @@ namespace WebCore {
         void ensureVector() { if (!m_createdVector) createVector(); }
         void createVector();
 
-        typedef Vector<AtomicString, 8> ClassNameVector;
+        typedef Vector<AtomicString, 8> StringVector;
         String m_string;
-        ClassNameVector m_vector;
+        StringVector m_vector;
         bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
-    class ClassNames {
+    class SpaceSplitString {
     public:
-        ClassNames() { }
-        ClassNames(const String& string, bool shouldFoldCase) : m_data(new ClassNamesData(string, shouldFoldCase)) { }
+        SpaceSplitString() { }
+        SpaceSplitString(const String& string, bool shouldFoldCase) : m_data(new SpaceSplitStringData(string, shouldFoldCase)) { }
 
-        void set(const String& string, bool shouldFoldCase) { m_data.set(new ClassNamesData(string, shouldFoldCase)); }
+        void set(const String& string, bool shouldFoldCase) { m_data.set(new SpaceSplitStringData(string, shouldFoldCase)); }
         void clear() { m_data.clear(); }
 
         bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
-        bool containsAll(const ClassNames& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
+        bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
 
         size_t size() const { return m_data ? m_data->size() : 0; }
         const AtomicString& operator[](size_t i) const { ASSERT(i < size()); return (*m_data)[i]; }
 
     private:
-        OwnPtr<ClassNamesData> m_data;
+        OwnPtr<SpaceSplitStringData> m_data;
     };
 
     inline bool isClassWhitespace(UChar c)
@@ -86,4 +86,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ClassNames_h
+#endif // SpaceSplitString_h
diff --git a/WebCore/dom/StyleElement.h b/WebCore/dom/StyleElement.h
index 7f83909..9d3ac84 100644
--- a/WebCore/dom/StyleElement.h
+++ b/WebCore/dom/StyleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006, 2007 Rob Buis
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 85fa7a7..52bffd3 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -66,7 +66,7 @@ public:
     CSSStyleDeclaration* style();
     void invalidateStyleAttribute();
 
-    const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
+    const SpaceSplitString& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
 
diff --git a/WebCore/dom/Tokenizer.h b/WebCore/dom/Tokenizer.h
index ea303f9..9a9b7b3 100644
--- a/WebCore/dom/Tokenizer.h
+++ b/WebCore/dom/Tokenizer.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006 Apple Computer, Inc.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
@@ -30,7 +28,7 @@ namespace WebCore {
     class SegmentedString;
     class XSSAuditor;
 
-    class Tokenizer {
+    class Tokenizer : public Noncopyable {
     public:
         virtual ~Tokenizer() { }
 
diff --git a/WebCore/dom/TreeWalker.h b/WebCore/dom/TreeWalker.h
index 4cc8e9a..88e59da 100644
--- a/WebCore/dom/TreeWalker.h
+++ b/WebCore/dom/TreeWalker.h
@@ -52,14 +52,15 @@ namespace WebCore {
         Node* previousNode(ScriptState*);
         Node* nextNode(ScriptState*);
 
-        // For non-JS bindings. Silently ignores the JavaScript exception if any.
-        Node* parentNode() { return parentNode(scriptStateFromNode(m_current.get())); }
-        Node* firstChild() { return firstChild(scriptStateFromNode(m_current.get())); }
-        Node* lastChild() { return lastChild(scriptStateFromNode(m_current.get())); }
-        Node* previousSibling() { return previousSibling(scriptStateFromNode(m_current.get())); }
-        Node* nextSibling() { return nextSibling(scriptStateFromNode(m_current.get())); }
-        Node* previousNode() { return previousNode(scriptStateFromNode(m_current.get())); }
-        Node* nextNode() { return nextNode(scriptStateFromNode(m_current.get())); }
+        // Do not call these functions. They are just scaffolding to support the Objective-C bindings.
+        // They operate in the main thread normal world, and they swallow JS exceptions.
+        Node* parentNode() { return parentNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* firstChild() { return firstChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* lastChild() { return lastChild(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousSibling() { return previousSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextSibling() { return nextSibling(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* previousNode() { return previousNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
+        Node* nextNode() { return nextNode(scriptStateFromNode(mainThreadNormalWorld(), m_current.get())); }
 
     private:
         TreeWalker(PassRefPtr<Node>, unsigned whatToShow, PassRefPtr<NodeFilter>, bool expandEntityReferences);
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 30d39e0..56f8ff4 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -91,7 +91,8 @@ void XMLTokenizer::pushCurrentNode(Node* n)
 
 void XMLTokenizer::popCurrentNode()
 {
-    ASSERT(m_currentNode);
+    if (!m_currentNode)
+        return;
     ASSERT(m_currentNodeStack.size());
 
     if (m_currentNode != m_doc)
diff --git a/WebCore/dom/XMLTokenizer.h b/WebCore/dom/XMLTokenizer.h
index 095e8db..2f9c113 100644
--- a/WebCore/dom/XMLTokenizer.h
+++ b/WebCore/dom/XMLTokenizer.h
@@ -161,6 +161,23 @@ namespace WebCore {
     class PendingCallbacks;
     class ScriptElement;
 
+#if !USE(QXMLSTREAM)
+    class XMLParserContext : public RefCounted<XMLParserContext> {
+    public:
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        ~XMLParserContext();
+        xmlParserCtxtPtr context() const { return m_context; }
+
+    private:
+        XMLParserContext(xmlParserCtxtPtr context)
+            : m_context(context)
+        {
+        }
+        xmlParserCtxtPtr m_context;
+    };
+#endif
+
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
@@ -255,7 +272,8 @@ public:
         QXmlStreamReader m_stream;
         bool m_wroteText;
 #else
-        xmlParserCtxtPtr m_context;
+        xmlParserCtxtPtr context() const { return m_context ? m_context->context() : 0; };
+        RefPtr<XMLParserContext> m_context;
         OwnPtr<PendingCallbacks> m_pendingCallbacks;
         Vector<xmlChar> m_bufferedText;
 #endif
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index 9aa0961..42c8b9b 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -465,7 +465,7 @@ static void errorFunc(void*, const char*, ...)
 
 static bool didInit = false;
 
-static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
+PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerPtr handlers, void* userData)
 {
     if (!didInit) {
         xmlInitParser();
@@ -482,12 +482,12 @@ static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* user
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
     xmlSwitchEncoding(parser, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
-    return parser;
+    return adoptRef(new XMLParserContext(parser));
 }
 
 
 // Chunk should be encoded in UTF-8
-static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -518,8 +518,8 @@ static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* user
     parser->str_xmlns = xmlDictLookup(parser->dict, BAD_CAST "xmlns", 5);
     parser->str_xml_ns = xmlDictLookup(parser->dict, XML_XML_NAMESPACE, 36);
     parser->_private = userData;
-
-    return parser;
+    
+    return adoptRef(new XMLParserContext(parser));
 }
 
 // --------------------------------
@@ -609,6 +609,13 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         m_defaultNamespaceURI = parentElement->namespaceURI();
 }
 
+XMLParserContext::~XMLParserContext()
+{
+    if (m_context->myDoc)
+        xmlFreeDoc(m_context->myDoc);
+    xmlFreeParserCtxt(m_context);
+}
+
 XMLTokenizer::~XMLTokenizer()
 {
     clearCurrentNodeStack();
@@ -616,15 +623,16 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-    if (m_context)
-        xmlFreeParserCtxt(m_context);
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
 {
     if (!m_context)
         initializeParserContext();
-    
+
+    // Protect the libxml context from deletion during a callback
+    RefPtr<XMLParserContext> context = m_context;
+
     // libXML throws an error if you try to switch the encoding for an empty string.
     if (parseString.length()) {
         // Hack around libxml2's lack of encoding overide support by manually
@@ -633,15 +641,15 @@ void XMLTokenizer::doWrite(const String& parseString)
         // and switch encodings, causing the parse to fail.
         const UChar BOM = 0xFEFF;
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-        xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
+        xmlSwitchEncoding(context->context(), BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
         XMLTokenizerScope scope(m_doc->docLoader());
-        xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
+        xmlParseChunk(context->context(), reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
     if (m_doc->decoder() && m_doc->decoder()->sawError()) {
         // If the decoder saw an error, report it as fatal (stops parsing)
-        handleError(fatal, "Encoding error", lineNumber(), columnNumber());
+        handleError(fatal, "Encoding error", context->context()->input->line, context->context()->input->col);
     }
 
     return;
@@ -1277,9 +1285,9 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 
     XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
-        m_context = createMemoryParser(&sax, this, chunk);
+        m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else
-        m_context = createStringParser(&sax, this);
+        m_context = XMLParserContext::createStringParser(&sax, this);
 }
 
 void XMLTokenizer::doEnd()
@@ -1300,12 +1308,9 @@ void XMLTokenizer::doEnd()
         // Tell libxml we're done.
         {
             XMLTokenizerScope scope(m_doc->docLoader());
-            xmlParseChunk(m_context, 0, 0, 1);
+            xmlParseChunk(context(), 0, 0, 1);
         }
 
-        if (m_context->myDoc)
-            xmlFreeDoc(m_context->myDoc);
-        xmlFreeParserCtxt(m_context);
         m_context = 0;
     }
 }
@@ -1334,18 +1339,19 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
 
 int XMLTokenizer::lineNumber() const
 {
-    return m_context ? m_context->input->line : 1;
+    return context() ? context()->input->line : 1;
 }
 
 int XMLTokenizer::columnNumber() const
 {
-    return m_context ? m_context->input->col : 1;
+    return context() ? context()->input->col : 1;
 }
 
 void XMLTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    xmlStopParser(m_context);
+    if (context())
+        xmlStopParser(context());
 }
 
 void XMLTokenizer::resumeParsing()
@@ -1384,17 +1390,17 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
 
-    xmlParseContent(tokenizer.m_context);
+    xmlParseContent(tokenizer.context());
 
     tokenizer.endDocument();
 
     // Check if all the chunk has been processed.
-    long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
+    long bytesProcessed = xmlByteConsumed(tokenizer.context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
-    return tokenizer.m_context->wellFormed || xmlCtxtGetLastError(tokenizer.m_context) == 0;
+    return tokenizer.context()->wellFormed || xmlCtxtGetLastError(tokenizer.context()) == 0;
 }
 
 // --------------------------------
@@ -1437,12 +1443,9 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     memset(&sax, 0, sizeof(sax));
     sax.startElementNs = attributesStartElementNsHandler;
     sax.initialized = XML_SAX2_MAGIC;
-    xmlParserCtxtPtr parser = createStringParser(&sax, &state);
+    RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
-    xmlParseChunk(parser, reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
-    if (parser->myDoc)
-        xmlFreeDoc(parser->myDoc);
-    xmlFreeParserCtxt(parser);
+    xmlParseChunk(parser->context(), reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index c6e73ba..4e61715 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -66,7 +66,6 @@ using namespace std;
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 class EntityResolver : public QXmlStreamEntityResolver {
     virtual QString resolveUndeclaredEntity(const QString &name);
 };
@@ -76,7 +75,6 @@ QString EntityResolver::resolveUndeclaredEntity(const QString &name)
     UChar c = decodeNamedEntity(name.toUtf8().constData());
     return QString(c);
 }
-#endif
 
 // --------------------------------
 
@@ -103,9 +101,7 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_scriptStartLine(0)
     , m_parsingFragment(false)
 {
-#if QT_VERSION >= 0x040400
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 }
 
 XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
@@ -149,19 +145,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     if (elemStack.isEmpty())
         return;
     
-#if QT_VERSION < 0x040400
-    for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedNodeMap* attrs = element->attributes()) {
-            for (unsigned i = 0; i < attrs->length(); i++) {
-                Attribute* attr = attrs->attributeItem(i);
-                if (attr->localName() == "xmlns")
-                    m_defaultNamespaceURI = attr->value();
-                else if (attr->prefix() == "xmlns")
-                    m_prefixToNamespaceMap.set(attr->localName(), attr->value());
-            }
-        }
-    }
-#else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
         if (NamedNodeMap* attrs = element->attributes()) {
@@ -176,7 +159,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     }
     m_stream.addExtraNamespaceDeclarations(namespaces);
     m_stream.setEntityResolver(new EntityResolver);
-#endif
 
     // If the parent element is not in document tree, there may be no xmlns attribute; just default to the parent's namespace.
     if (m_defaultNamespaceURI.isNull() && !parentElement->inDocument())
@@ -190,9 +172,7 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-#if QT_VERSION >= 0x040400
     delete m_stream.entityResolver();
-#endif
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
@@ -207,27 +187,6 @@ void XMLTokenizer::doWrite(const String& parseString)
 
     QString data(parseString);
     if (!data.isEmpty()) {
-#if QT_VERSION < 0x040400
-        if (!m_sawFirstElement) {
-            int idx = data.indexOf(QLatin1String("<?xml"));
-            if (idx != -1) {
-                int start = idx + 5;
-                int end = data.indexOf(QLatin1String("?>"), start);
-                QString content = data.mid(start, end-start);
-                bool ok = true;
-                HashMap<String, String> attrs = parseAttributes(content, ok);
-                String version = attrs.get("version");
-                String encoding = attrs.get("encoding");
-                ExceptionCode ec = 0;
-                if (!m_parsingFragment) {
-                    if (!version.isEmpty())
-                        m_doc->setXMLVersion(version, ec);
-                    if (!encoding.isEmpty())
-                        m_doc->setXMLEncoding(encoding);
-                }
-            }
-        }
-#endif
         m_stream.addData(data);
         parse();
     }
@@ -256,7 +215,7 @@ void XMLTokenizer::doEnd()
 #endif
     
     if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError
-        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform))
+        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform && !m_sawError))
         handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(), columnNumber());
 }
 
@@ -485,14 +444,12 @@ void XMLTokenizer::startDocument()
     if (!m_parsingFragment) {
         m_doc->setXMLStandalone(m_stream.isStandaloneDocument(), ec);
 
-#if QT_VERSION >= 0x040400
         QStringRef version = m_stream.documentVersion();
         if (!version.isEmpty())
             m_doc->setXMLVersion(version, ec);
         QStringRef encoding = m_stream.documentEncoding();
         if (!encoding.isEmpty())
             m_doc->setXMLEncoding(encoding);
-#endif
     }
 }
 
@@ -702,83 +659,11 @@ bool XMLTokenizer::hasError() const
     return m_stream.hasError();
 }
 
-#if QT_VERSION < 0x040400
-static QString parseId(const QString &dtd, int *pos, bool *ok)
-{
-    *ok = true;
-    int start = *pos + 1;
-    int end = start;
-    if (dtd.at(*pos) == QLatin1Char('\''))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\''))
-            ++end;
-    else if (dtd.at(*pos) == QLatin1Char('\"'))
-        while (start < dtd.length() && dtd.at(end) != QLatin1Char('\"'))
-            ++end;
-    else {
-        *ok = false;
-        return QString();
-    }
-    *pos = end + 1;
-    return dtd.mid(start, end - start);
-}
-#endif
-
 void XMLTokenizer::parseDtd()
 {
-#if QT_VERSION >= 0x040400
     QStringRef name = m_stream.dtdName();
     QStringRef publicId = m_stream.dtdPublicId();
     QStringRef systemId = m_stream.dtdSystemId();
-#else
-    QString dtd = m_stream.text().toString();
-
-    int start = dtd.indexOf("<!DOCTYPE ") + 10;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    int end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString name = dtd.mid(start, end - start);
-
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    end = start;
-    while (start < dtd.length() && !dtd.at(end).isSpace())
-        ++end;
-    QString id = dtd.mid(start, end - start);
-    start = end;
-    while (start < dtd.length() && dtd.at(start).isSpace())
-        ++start;
-    QString publicId;
-    QString systemId;
-    if (id == QLatin1String("PUBLIC")) {
-        bool ok;
-        publicId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-        while (start < dtd.length() && dtd.at(start).isSpace())
-            ++start;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("SYSTEM")) {
-        bool ok;
-        systemId = parseId(dtd, &start, &ok);
-        if (!ok) {
-            handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-            return;
-        }
-    } else if (id == QLatin1String("[") || id == QLatin1String(">")) {
-    } else {
-        handleError(fatal, "Invalid DOCTYPE", lineNumber(), columnNumber());
-        return;
-    }
-#endif    
 
     //qDebug() << dtd << name << publicId << systemId;
     if ((publicId == QLatin1String("-//W3C//DTD XHTML 1.0 Transitional//EN"))
diff --git a/WebCore/dom/default/PlatformMessagePortChannel.cpp b/WebCore/dom/default/PlatformMessagePortChannel.cpp
index d668703..9e0e7dc 100644
--- a/WebCore/dom/default/PlatformMessagePortChannel.cpp
+++ b/WebCore/dom/default/PlatformMessagePortChannel.cpp
@@ -193,7 +193,8 @@ void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChann
 bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
 {
     MutexLocker lock(m_mutex);
-    return m_incomingQueue->tryGetMessage(result);
+    result = m_incomingQueue->tryGetMessage();
+    return result;
 }
 
 bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
diff --git a/WebCore/dom/default/PlatformMessagePortChannel.h b/WebCore/dom/default/PlatformMessagePortChannel.h
index 0ce2d13..2aad952 100644
--- a/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -63,18 +63,14 @@ namespace WebCore {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
-            bool tryGetMessage(OwnPtr<MessagePortChannel::EventData>& message)
+            PassOwnPtr<MessagePortChannel::EventData> tryGetMessage()
             {
-                MessagePortChannel::EventData* holder = 0;
-                bool messageAvailable = m_queue.tryGetMessage(holder);
-                if (messageAvailable)
-                    message.set(holder);
-                return messageAvailable;
+                return m_queue.tryGetMessage();
             }
 
             bool appendAndCheckEmpty(PassOwnPtr<MessagePortChannel::EventData> message)
             {
-                return m_queue.appendAndCheckEmpty(message.release());
+                return m_queue.appendAndCheckEmpty(message);
             }
 
             bool isEmpty()
@@ -82,19 +78,10 @@ namespace WebCore {
                 return m_queue.isEmpty();
             }
 
-            ~MessagePortQueue()
-            {
-                // Manually free any items left in the queue, since we can't use OwnPtr internally.
-                MessagePortChannel::EventData* data = 0;
-                while (m_queue.tryGetMessage(data))
-                    delete data;
-            }
         private:
             MessagePortQueue() { }
 
-            // OwnPtr is Noncopyable, so we can't use it as the template type in a MessageQueue. So we just store a pointer to EventData and manually free it in the destructor.
-            // FIXME: Use a lock-free queue implementation to completely eliminate contention when sending/receiving messages.
-            MessageQueue<MessagePortChannel::EventData*> m_queue;
+            MessageQueue<MessagePortChannel::EventData> m_queue;
         };
 
         ~PlatformMessagePortChannel();
diff --git a/WebCore/editing/AppendNodeCommand.cpp b/WebCore/editing/AppendNodeCommand.cpp
index ef79e9c..6178641 100644
--- a/WebCore/editing/AppendNodeCommand.cpp
+++ b/WebCore/editing/AppendNodeCommand.cpp
@@ -44,12 +44,18 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
 
 void AppendNodeCommand::doApply()
 {
+    if (!m_parent->isContentEditable() && m_parent->attached())
+        return;
+        
     ExceptionCode ec;
     m_parent->appendChild(m_node.get(), ec);
 }
 
 void AppendNodeCommand::doUnapply()
 {
+    if (!m_parent->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->remove(ec);
 }
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 1617be8..2796690 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -746,8 +746,9 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 {
     // First we clone the outerNode
     
-    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
-    appendNode(lastNode, blockElement);
+    RefPtr<Node> topNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(topNode, blockElement);
+    RefPtr<Node> lastNode = topNode;
 
     if (start.node() != outerNode) {
         Vector<RefPtr<Node> > ancestors;
@@ -769,12 +770,15 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
     // Handle the case of paragraphs with more than one node,
     // cloning all the siblings until end.node() is reached.
     
-    if (start.node() != end.node()) {
-        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+    if (start.node() != end.node() && !start.node()->isDescendantOf(end.node())) {
+        for (Node* n = start.node()->traverseNextSibling(outerNode); n; n = n->nextSibling()) {
+            if (n->parentNode() != start.node()->parentNode())
+                lastNode = topNode->firstChild();
+
             RefPtr<Node> clonedNode = n->cloneNode(true);
             insertNodeAfter(clonedNode, lastNode);
             lastNode = clonedNode.release();
-            if (n == end.node())
+            if (n == end.node() || end.node()->isDescendantOf(n))
                 break;
         }
     }
diff --git a/WebCore/editing/DeleteButtonController.h b/WebCore/editing/DeleteButtonController.h
index 713ae8b..1286c07 100644
--- a/WebCore/editing/DeleteButtonController.h
+++ b/WebCore/editing/DeleteButtonController.h
@@ -36,7 +36,7 @@ class HTMLElement;
 class RenderObject;
 class VisibleSelection;
 
-class DeleteButtonController {
+class DeleteButtonController : public Noncopyable {
 public:
     DeleteButtonController(Frame*);
 
diff --git a/WebCore/editing/DeleteFromTextNodeCommand.cpp b/WebCore/editing/DeleteFromTextNodeCommand.cpp
index e942fef..f1d79af 100644
--- a/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -45,6 +45,9 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
     m_text = m_node->substringData(m_offset, m_count, ec);
     if (ec)
@@ -57,6 +60,9 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index fbb5aea..9e4ba29 100644
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -595,6 +595,14 @@ void DeleteSelectionCommand::mergeParagraphs()
         return;
     }
     
+    // Block images, tables and horizontal rules cannot be made inline with content at mergeDestination.  If there is 
+    // any (!isStartOfParagraph(mergeDestination)), don't merge, just move the caret to just before the selection we deleted.
+    // See https://bugs.webkit.org/show_bug.cgi?id=25439
+    if (isRenderedAsNonInlineTableImageOrHR(startOfParagraphToMove.deepEquivalent().node()) && !isStartOfParagraph(mergeDestination)) {
+        m_endingPosition = m_upstreamStart;
+        return;
+    }
+    
     RefPtr<Range> range = Range::create(document(), rangeCompliantEquivalent(startOfParagraphToMove.deepEquivalent()), rangeCompliantEquivalent(endOfParagraphToMove.deepEquivalent()));
     RefPtr<Range> rangeToBeReplaced = Range::create(document(), rangeCompliantEquivalent(mergeDestination.deepEquivalent()), rangeCompliantEquivalent(mergeDestination.deepEquivalent()));
     if (!document()->frame()->editor()->client()->shouldMoveRangeAfterDelete(range.get(), rangeToBeReplaced.get()))
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index 3f3f736..0744fd6 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -30,6 +30,7 @@
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
 #include "CharacterNames.h"
+#include "CompositionEvent.h"
 #include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSMutableStyleDeclaration.h"
@@ -831,7 +832,7 @@ TriState Editor::selectionHasStyle(CSSStyleDeclaration* style) const
                 TriState nodeState = triStateOfStyleInComputedStyle(style, nodeStyle.get(), !node->isTextNode());
                 if (node == m_frame->selection()->start().node())
                     state = nodeState;
-                else if (state != nodeState) {
+                else if (state != nodeState && node->isTextNode()) {
                     state = MixedTriState;
                     break;
                 }
@@ -1003,6 +1004,16 @@ bool Editor::insertParagraphSeparator()
     return true;
 }
 
+static bool nodeIsInTextFormControl(Node* node)
+{
+    if (!node)
+        return false;
+    Node* ancestor = node->shadowAncestorNode();
+    if (ancestor == node)
+        return false;
+    return ancestor->isElementNode() && static_cast<Element*>(ancestor)->isTextFormControl();
+}
+
 void Editor::cut()
 {
     if (tryDHTMLCut())
@@ -1013,7 +1024,10 @@ void Editor::cut()
     }
     RefPtr<Range> selection = selectedRange();
     if (shouldDeleteRange(selection.get())) {
-        Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
+        if (nodeIsInTextFormControl(m_frame->selection()->start().node()))
+            Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selection.get(), canSmartCopyOrDelete(), m_frame);
         didWriteSelectionToPasteboard();
         deleteSelectionWithSmartDelete(canSmartCopyOrDelete());
     }
@@ -1027,13 +1041,17 @@ void Editor::copy()
         systemBeep();
         return;
     }
-    
-    Document* document = m_frame->document();
-    if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
-        Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
-    else
-        Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
-    
+
+    if (nodeIsInTextFormControl(m_frame->selection()->start().node()))
+        Pasteboard::generalPasteboard()->writePlainText(m_frame->selectedText());
+    else {
+        Document* document = m_frame->document();
+        if (HTMLImageElement* imageElement = imageElementFromImageDocument(document))
+            Pasteboard::generalPasteboard()->writeImage(imageElement, document->url(), document->title());
+        else
+            Pasteboard::generalPasteboard()->writeSelection(selectedRange().get(), canSmartCopyOrDelete(), m_frame);
+    }
+
     didWriteSelectionToPasteboard();
 }
 
@@ -1353,6 +1371,16 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
         return;
     }
     
+    // Dispatch a compositionend event to the focused node.
+    // We should send this event before sending a TextEvent as written in Section 6.2.2 and 6.2.3 of
+    // the DOM Event specification.
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        RefPtr<CompositionEvent> event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        ExceptionCode ec = 0;
+        target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1379,7 +1407,38 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         setIgnoreCompositionSelectionChange(false);
         return;
     }
-    
+
+    Node* target = m_frame->document()->focusedNode();
+    if (target) {
+        // Dispatch an appropriate composition event to the focused node.
+        // We check the composition status and choose an appropriate composition event since this
+        // function is used for three purposes:
+        // 1. Starting a new composition.
+        //    Send a compositionstart event when this function creates a new composition node, i.e.
+        //    m_compositionNode == 0 && !text.isEmpty().
+        // 2. Updating the existing composition node.
+        //    Send a compositionupdate event when this function updates the existing composition
+        //    node, i.e. m_compositionNode != 0 && !text.isEmpty().
+        // 3. Canceling the ongoing composition.
+        //    Send a compositionend event when function deletes the existing composition node, i.e.
+        //    m_compositionNode != 0 && test.isEmpty().
+        RefPtr<CompositionEvent> event;
+        if (!m_compositionNode) {
+            // We should send a compositionstart event only when the given text is not empty because this
+            // function doesn't create a composition node when the text is empty.
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionstartEvent, m_frame->domWindow(), text);
+        } else {
+            if (!text.isEmpty())
+                event = CompositionEvent::create(eventNames().compositionupdateEvent, m_frame->domWindow(), text);
+            else
+              event = CompositionEvent::create(eventNames().compositionendEvent, m_frame->domWindow(), text);
+        }
+        ExceptionCode ec = 0;
+        if (event.get())
+            target->dispatchEvent(event, ec);
+    }
+
     // If text is empty, then delete the old composition here.  If text is non-empty, InsertTextCommand::input
     // will delete the old composition with an optimized replace operation.
     if (text.isEmpty())
@@ -1754,8 +1813,9 @@ static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Rang
         }
         if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
             break;
-        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
-        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        VisiblePosition newParagraphStart = startOfNextParagraph(paragraphRange->endPosition());
+        setStart(paragraphRange.get(), newParagraphStart);
+        setEnd(paragraphRange.get(), endOfParagraph(newParagraphStart));
         firstIteration = false;
         totalLengthProcessed += currentLength;
     }
@@ -2693,6 +2753,9 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
@@ -2719,6 +2782,9 @@ bool Editor::insideVisibleArea(Range* range) const
         return true;
     
     RenderPart* renderer = frame->ownerRenderer();
+    if (!renderer)
+        return false;
+
     RenderBlock* container = renderer->containingBlock();
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 808a2f8..5e6f339 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -129,17 +129,8 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
         targetBlockquote = 0;
 }
 
-void IndentOutdentCommand::indentRegion()
+void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
-    VisiblePosition startOfSelection = selection.visibleStart();
-    VisiblePosition endOfSelection = selection.visibleEnd();
-    int startIndex = indexForVisiblePosition(startOfSelection);
-    int endIndex = indexForVisiblePosition(endOfSelection);
-
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     // Special case empty unsplittable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -162,6 +153,12 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -169,14 +166,7 @@ void IndentOutdentCommand::indentRegion()
             return;
         }
         endOfCurrentParagraph = endOfNextParagraph;
-    }
-    
-    updateLayout();
-    
-    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
-    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
-    if (startRange && endRange)
-        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+    }   
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -242,36 +232,40 @@ void IndentOutdentCommand::outdentParagraph()
     moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), VisiblePosition(Position(placeholder.get(), 0)), true);
 }
 
-void IndentOutdentCommand::outdentRegion()
+void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    VisiblePosition startOfSelection = endingSelection().visibleStart();
-    VisiblePosition endOfSelection = endingSelection().visibleEnd();
     VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
 
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-
     if (endOfParagraph(startOfSelection) == endOfLastParagraph) {
         outdentParagraph();
         return;
     }
-
+    
     Position originalSelectionEnd = endingSelection().end();
-    setEndingSelection(endingSelection().visibleStart());
-    outdentParagraph();
-    Position originalSelectionStart = endingSelection().start();
-    VisiblePosition endOfCurrentParagraph = endOfParagraph(endOfParagraph(endingSelection().visibleStart()).next(true));
+    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
+
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
             setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
+        
         outdentParagraph();
+        
+        // outdentParagraph could move more than one paragraph if the paragraph
+        // is in a list item. As a result, endAfterSelection and endOfNextParagraph
+        // could refer to positions no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
+            
+        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
+            endOfCurrentParagraph = endingSelection().end();
+            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
+        }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -295,10 +289,27 @@ void IndentOutdentCommand::doApply()
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
         setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
+    VisiblePosition startOfSelection = selection.visibleStart();
+    VisiblePosition endOfSelection = selection.visibleEnd();
+    
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
+    
+    ASSERT(!startOfSelection.isNull());
+    ASSERT(!endOfSelection.isNull());
+    
     if (m_typeOfAction == Indent)
-        indentRegion();
+        indentRegion(startOfSelection, endOfSelection);
     else
-        outdentRegion();
+        outdentRegion(startOfSelection, endOfSelection);
+
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 }
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index 817b4c8..8705bf1 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,8 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void indentRegion();
-    void outdentRegion();
+    void indentRegion(const VisiblePosition&, const VisiblePosition&);
+    void outdentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentParagraph();
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
diff --git a/WebCore/editing/InsertIntoTextNodeCommand.cpp b/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 4905fae..9c3423a 100644
--- a/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -43,12 +43,18 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
+    if (!m_node->isContentEditable())
+        return;
+    
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 }
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
+    if (!m_node->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_node->deleteData(m_offset, m_text.length(), ec);
 }
diff --git a/WebCore/editing/InsertNodeBeforeCommand.cpp b/WebCore/editing/InsertNodeBeforeCommand.cpp
index 4f60963..2ce9846 100644
--- a/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -46,7 +46,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 void InsertNodeBeforeCommand::doApply()
 {
     Node* parent = m_refChild->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
@@ -55,6 +55,9 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
+    if (!m_insertChild->isContentEditable())
+        return;
+        
     ExceptionCode ec;
     m_insertChild->remove(ec);
 }
diff --git a/WebCore/editing/JoinTextNodesCommand.cpp b/WebCore/editing/JoinTextNodesCommand.cpp
index f981481..fa0987d 100644
--- a/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/WebCore/editing/JoinTextNodesCommand.cpp
@@ -45,6 +45,10 @@ void JoinTextNodesCommand::doApply()
     if (m_text1->nextSibling() != m_text2)
         return;
 
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+    
     ExceptionCode ec = 0;
     m_text2->insertData(0, m_text1->data(), ec);
     if (ec)
@@ -59,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     Node* parent = m_text2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/WebCore/editing/MergeIdenticalElementsCommand.cpp b/WebCore/editing/MergeIdenticalElementsCommand.cpp
index 99ba286..f56f726 100644
--- a/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2)
+    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     Node* parent = m_element2->parent();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/WebCore/editing/RemoveNodeCommand.cpp b/WebCore/editing/RemoveNodeCommand.cpp
index 62a36be..f6d6a4b 100644
--- a/WebCore/editing/RemoveNodeCommand.cpp
+++ b/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     Node* parent = m_node->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<Node> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
 
     ExceptionCode ec;
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index 00672f2..af89ccb 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -994,11 +994,14 @@ void SelectionController::paintCaret(GraphicsContext* p, int tx, int ty, const I
     IntRect caret = intersection(drawingRect, clipRect);
     if (!caret.isEmpty()) {
         Color caretColor = Color::black;
+        ColorSpace colorSpace = DeviceColorSpace;
         Element* element = rootEditableElement();
-        if (element && element->renderer())
+        if (element && element->renderer()) {
             caretColor = element->renderer()->style()->color();
+            colorSpace = element->renderer()->style()->colorSpace();
+        }
 
-        p->fillRect(caret, caretColor);
+        p->fillRect(caret, caretColor, colorSpace);
     }
 }
 
diff --git a/WebCore/editing/SplitElementCommand.cpp b/WebCore/editing/SplitElementCommand.cpp
index 35dfc6f..2998c6a 100644
--- a/WebCore/editing/SplitElementCommand.cpp
+++ b/WebCore/editing/SplitElementCommand.cpp
@@ -41,35 +41,39 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
     ASSERT(m_atChild->parentNode() == m_element2);
 }
 
-void SplitElementCommand::doApply()
+void SplitElementCommand::executeApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
-
     if (m_atChild->parentNode() != m_element2)
         return;
-
+    
     Vector<RefPtr<Node> > children;
     for (Node* node = m_element2->firstChild(); node != m_atChild; node = node->nextSibling())
         children.append(node);
-
+    
     ExceptionCode ec = 0;
-
+    
     Node* parent = m_element2->parentNode();
-    if (!parent)
+    if (!parent || !parent->isContentEditable())
         return;
-    parent->insertBefore(prefixElement.get(), m_element2.get(), ec);
+    parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
         return;
-    m_element1 = prefixElement.release();
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
         m_element1->appendChild(children[i], ec);
 }
+    
+void SplitElementCommand::doApply()
+{
+    m_element1 = m_element2->cloneElementWithoutChildren();
+    
+    executeApply();
+}
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1)
+    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -85,7 +89,14 @@ void SplitElementCommand::doUnapply()
         m_element2->insertBefore(children[i].get(), refChild.get(), ec);
 
     m_element1->remove(ec);
-    m_element1 = 0;
 }
 
+void SplitElementCommand::doReapply()
+{
+    if (!m_element1)
+        return;
+    
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/WebCore/editing/SplitElementCommand.h b/WebCore/editing/SplitElementCommand.h
index 2732762..7ea8f5b 100644
--- a/WebCore/editing/SplitElementCommand.h
+++ b/WebCore/editing/SplitElementCommand.h
@@ -42,6 +42,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element1;
     RefPtr<Element> m_element2;
diff --git a/WebCore/editing/SplitTextNodeCommand.cpp b/WebCore/editing/SplitTextNodeCommand.cpp
index 3b04e01..15daa49 100644
--- a/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/WebCore/editing/SplitTextNodeCommand.cpp
@@ -49,6 +49,10 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 
 void SplitTextNodeCommand::doApply()
 {
+    Node* parent = m_text2->parentNode();
+    if (!parent || !parent->isContentEditable())
+        return;
+
     ExceptionCode ec = 0;
 
     String prefixText = m_text2->substringData(0, m_offset, ec);
@@ -59,9 +63,6 @@ void SplitTextNodeCommand::doApply()
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
-    Node* parent = m_text2->parentNode();
-    if (!parent)
-        return;
     parent->insertBefore(prefixTextNode.get(), m_text2.get(), ec);
     if (ec)
         return;
@@ -72,7 +73,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1)
+    if (!m_text1 || !m_text1->isContentEditable())
         return;
 
     ASSERT(m_text1->document() == document());
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index d36849c..df271b6 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -218,7 +218,7 @@ static void pushFullyClippedState(BitStack& stack, Node* node)
 
     // Push true if this node full clips its contents, or if a parent already has fully
     // clipped and this is not a node that ignores its container's clip.
-    stack.push(fullyClipsContents(node) || stack.top() && !ignoresContainerClip(node));
+    stack.push(fullyClipsContents(node) || (stack.top() && !ignoresContainerClip(node)));
 }
 
 static void setUpFullyClippedStack(BitStack& stack, Node* node)
diff --git a/WebCore/editing/TypingCommand.cpp b/WebCore/editing/TypingCommand.cpp
index f5901d7..2b0f61e 100644
--- a/WebCore/editing/TypingCommand.cpp
+++ b/WebCore/editing/TypingCommand.cpp
@@ -90,7 +90,7 @@ void TypingCommand::deleteKeyPressed(Document *document, bool smartDelete, TextG
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->deleteKeyPressed(granularity, killRing);
         return;
     }
@@ -109,7 +109,7 @@ void TypingCommand::forwardDeleteKeyPressed(Document *document, bool smartDelete
     ASSERT(frame);
     
     EditCommand* lastEditCommand = frame->editor()->lastEditCommand();
-    if (isOpenForMoreTypingCommand(lastEditCommand)) {
+    if (granularity == CharacterGranularity && isOpenForMoreTypingCommand(lastEditCommand)) {
         static_cast<TypingCommand*>(lastEditCommand)->forwardDeleteKeyPressed(granularity, killRing);
         return;
     }
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 206de86..68d5a3e 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -237,7 +237,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
+        if ((!isSpaceOrNewline(c) && c != noBreakSpace) || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
diff --git a/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 7622c1e..5fa0b39 100644
--- a/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -38,35 +38,37 @@ WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand(PassRefPtr<Elemen
     ASSERT(m_element);
 }
 
-void WrapContentsInDummySpanCommand::doApply()
+void WrapContentsInDummySpanCommand::executeApply()
 {
     Vector<RefPtr<Node> > children;
     for (Node* child = m_element->firstChild(); child; child = child->nextSibling())
         children.append(child);
-
-    RefPtr<HTMLElement> span = createStyleSpanElement(document());
- 
+    
     ExceptionCode ec;
-
+    
     size_t size = children.size();
     for (size_t i = 0; i < size; ++i)
-        span->appendChild(children[i].release(), ec);
-
-    m_element->appendChild(span.get(), ec);
-
-    m_dummySpan = span.release();
+        m_dummySpan->appendChild(children[i].release(), ec);
+    
+    m_element->appendChild(m_dummySpan.get(), ec);
 }
 
+void WrapContentsInDummySpanCommand::doApply()
+{
+    m_dummySpan = createStyleSpanElement(document());
+    
+    executeApply();
+}
+    
 void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    RefPtr<HTMLElement> span = m_dummySpan.release();
-    if (!span)
+    if (!m_dummySpan || !m_element->isContentEditable())
         return;
 
     Vector<RefPtr<Node> > children;
-    for (Node* child = span->firstChild(); child; child = child->nextSibling())
+    for (Node* child = m_dummySpan->firstChild(); child; child = child->nextSibling())
         children.append(child);
 
     ExceptionCode ec;
@@ -75,7 +77,17 @@ void WrapContentsInDummySpanCommand::doUnapply()
     for (size_t i = 0; i < size; ++i)
         m_element->appendChild(children[i].release(), ec);
 
-    span->remove(ec);
+    m_dummySpan->remove(ec);
 }
 
+void WrapContentsInDummySpanCommand::doReapply()
+{
+    ASSERT(m_element);
+    
+    if (!m_dummySpan || !m_element->isContentEditable())
+        return;
+
+    executeApply();
+}
+    
 } // namespace WebCore
diff --git a/WebCore/editing/WrapContentsInDummySpanCommand.h b/WebCore/editing/WrapContentsInDummySpanCommand.h
index b12131a..be3af66 100644
--- a/WebCore/editing/WrapContentsInDummySpanCommand.h
+++ b/WebCore/editing/WrapContentsInDummySpanCommand.h
@@ -44,6 +44,8 @@ private:
 
     virtual void doApply();
     virtual void doUnapply();
+    virtual void doReapply();
+    void executeApply();
 
     RefPtr<Element> m_element;
     RefPtr<HTMLElement> m_dummySpan;
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index d19ef6b..8b1c98d 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -289,7 +289,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -310,7 +310,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
-    if (p.node() && !p.node()->isDescendantOf(highestRoot))
+    if (p.node() && p.node() != highestRoot && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
     
     return VisiblePosition(p);
@@ -494,6 +494,7 @@ bool validBlockTag(const AtomicString& blockTag)
 
 static Node* firstInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -509,6 +510,7 @@ static Node* firstInSpecialElement(const Position& pos)
 
 static Node* lastInSpecialElement(const Position& pos)
 {
+    // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
     Node* rootEditableElement = pos.node()->rootEditableElement();
     for (Node* n = pos.node(); n && n->rootEditableElement() == rootEditableElement; n = n->parentNode())
         if (isSpecialElement(n)) {
@@ -1077,6 +1079,14 @@ bool isNodeVisiblyContainedWithin(Node* node, const Range* selectedRange)
         && visiblePositionAfterNode(node) == selectedRange->endPosition();
 }
 
+bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
+{
+    if (!node)
+        return false;
+    RenderObject* renderer = node->renderer();
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || (renderer->isImage() && !renderer->isInline()) || renderer->isHR());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index f44181c..43048e0 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -91,6 +91,7 @@ bool isTableStructureNode(const Node*);
 bool isListElement(Node*);
 bool isNodeRendered(const Node*);
 bool isNodeVisiblyContainedWithin(Node*, const Range*);
+bool isRenderedAsNonInlineTableImageOrHR(const Node*);
     
     
 // -------------------------------------------------------------------------
diff --git a/WebCore/editing/visible_units.cpp b/WebCore/editing/visible_units.cpp
index c96fdfd..84ace83 100644
--- a/WebCore/editing/visible_units.cpp
+++ b/WebCore/editing/visible_units.cpp
@@ -776,12 +776,6 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
-static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
-{
-    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
-}
-
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
@@ -790,7 +784,7 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     if (!startNode)
         return VisiblePosition();
     
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
@@ -841,7 +835,6 @@ VisiblePosition startOfParagraph(const VisiblePosition& c)
     return VisiblePosition(node, offset, DOWNSTREAM);
 }
 
-// FIXME: Broken for positions before/after images that aren't inline (5027702)
 VisiblePosition endOfParagraph(const VisiblePosition &c)
 {    
     if (c.isNull())
@@ -850,7 +843,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+    if (isRenderedAsNonInlineTableImageOrHR(startNode))
         return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
diff --git a/WebCore/history/BackForwardList.cpp b/WebCore/history/BackForwardList.cpp
index 0aad98b..3550e37 100644
--- a/WebCore/history/BackForwardList.cpp
+++ b/WebCore/history/BackForwardList.cpp
@@ -34,6 +34,7 @@
 #include "Logging.h"
 #include "Page.h"
 #include "PageCache.h"
+#include "SerializedScriptValue.h"
 
 using namespace std;
 
@@ -58,12 +59,17 @@ BackForwardList::~BackForwardList()
 
 void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
 {
+    insertItemAfterCurrent(prpItem, true);
+}
+
+void BackForwardList::insertItemAfterCurrent(PassRefPtr<HistoryItem> prpItem, bool removeForwardList)
+{
     ASSERT(prpItem);
     if (m_capacity == 0 || !m_enabled)
         return;
     
     // Toss anything in the forward list    
-    if (m_current != NoCurrentItemIndex) {
+    if (removeForwardList && m_current != NoCurrentItemIndex) {
         unsigned targetSize = m_current + 1;
         while (m_entries.size() > targetSize) {
             RefPtr<HistoryItem> item = m_entries.last();
@@ -84,8 +90,8 @@ void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
         m_page->mainFrame()->loader()->client()->dispatchDidRemoveBackForwardItem(item.get());
     }
     
-    m_entries.append(prpItem);
-    m_entryHash.add(m_entries.last());
+    m_entryHash.add(prpItem.get());
+    m_entries.insert(m_current + 1, prpItem);
     m_current++;
     m_page->mainFrame()->loader()->client()->dispatchDidAddBackForwardItem(currentItem());
 }
@@ -235,6 +241,30 @@ HistoryItemVector& BackForwardList::entries()
     return m_entries;
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+    ASSERT(newItem);
+    ASSERT(newItem->document());
+    ASSERT(newItem->stateObject());
+    
+    RefPtr<HistoryItem> current = currentItem();
+    ASSERT(current);
+
+    Document* newItemDocument = newItem->document();
+    while (HistoryItem* item = forwardItem()) {
+        if (item->document() != newItemDocument)
+            break;
+        removeItem(item);
+    }
+
+    insertItemAfterCurrent(newItem, false);
+    
+    if (!current->document()) {
+        current->setDocument(newItemDocument);
+        current->setStateObject(SerializedScriptValue::create());
+    }
+}
+
 void BackForwardList::close()
 {
     int size = m_entries.size();
@@ -267,7 +297,7 @@ void BackForwardList::removeItem(HistoryItem* item)
             else {
                 size_t count = m_entries.size();
                 if (m_current >= count)
-                    m_current = count ? count-1 : NoCurrentItemIndex;
+                    m_current = count ? count - 1 : NoCurrentItemIndex;
             }
             break;
         }
diff --git a/WebCore/history/BackForwardList.h b/WebCore/history/BackForwardList.h
index fdc3360..88398a5 100644
--- a/WebCore/history/BackForwardList.h
+++ b/WebCore/history/BackForwardList.h
@@ -35,8 +35,11 @@
 
 namespace WebCore {
 
+class Document;
 class HistoryItem;
 class Page;
+class SerializedScriptValue;
+class String;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 typedef HashSet<RefPtr<HistoryItem> > HistoryItemHashSet;
@@ -96,12 +99,16 @@ public:
     void removeItem(HistoryItem*);
     HistoryItemVector& entries();
     
+    void pushStateItem(PassRefPtr<HistoryItem>);
+
 #if ENABLE(WML)
     void clearWMLPageHistory();
 #endif
 
 private:
     BackForwardList(Page*);
+    
+    void insertItemAfterCurrent(PassRefPtr<HistoryItem>, bool removeForwardList);
 
     Page* m_page;
 #if PLATFORM(CHROMIUM) 
diff --git a/WebCore/history/BackForwardListChromium.cpp b/WebCore/history/BackForwardListChromium.cpp
index 34f294c..f539e80 100644
--- a/WebCore/history/BackForwardListChromium.cpp
+++ b/WebCore/history/BackForwardListChromium.cpp
@@ -121,6 +121,11 @@ HistoryItem* BackForwardList::itemAtIndex(int index)
     return m_client->itemAtIndex(index);
 }
 
+void BackForwardList::pushStateItem(PassRefPtr<HistoryItem> newItem)
+{
+  // FIXME: Need to implement state support for chromium.
+}
+
 HistoryItemVector& BackForwardList::entries()
 {
     static HistoryItemVector noEntries;
diff --git a/WebCore/history/CachedFrame.cpp b/WebCore/history/CachedFrame.cpp
index a868134..227c437 100644
--- a/WebCore/history/CachedFrame.cpp
+++ b/WebCore/history/CachedFrame.cpp
@@ -99,10 +99,13 @@ void CachedFrameBase::restore()
     for (unsigned i = 0; i < m_childFrames.size(); ++i)
         m_childFrames[i]->open();
 
+<<<<<<< HEAD:WebCore/history/CachedFrame.cpp
 #ifdef ANDROID_PAGE_CACHE_UNLOAD
     // matches pageshowEvent as in Document::implicitClose()
     m_document->dispatchWindowLoadEvent();
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/history/CachedFrame.cpp
     m_document->dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, true), m_document);
 }
 
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index ba0764c..f6fbd59 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -48,6 +48,7 @@ HistoryItem::HistoryItem()
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {
 }
 
@@ -60,6 +61,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, double ti
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -74,6 +76,7 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, const Str
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -89,6 +92,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
     , m_lastVisitWasFailure(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
+    , m_document(0)
 {    
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
@@ -96,6 +100,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
 HistoryItem::~HistoryItem()
 {
     ASSERT(!m_cachedPage);
+    ASSERT(!m_document);
     iconDatabase()->releaseIconForPageURL(m_urlString);
 #if PLATFORM(ANDROID)
     if (m_bridge)
@@ -120,10 +125,9 @@ inline HistoryItem::HistoryItem(const HistoryItem& item)
     , m_visitCount(item.m_visitCount)
     , m_dailyVisitCounts(item.m_dailyVisitCounts)
     , m_weeklyVisitCounts(item.m_weeklyVisitCounts)
+    , m_document(0)
     , m_formContentType(item.m_formContentType)
 {
-    ASSERT(!item.m_cachedPage);
-
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
@@ -389,6 +393,35 @@ void HistoryItem::setIsTargetItem(bool flag)
 #if PLATFORM(ANDROID)
     notifyHistoryItemChanged(this);
 #endif
+<<<<<<< HEAD:WebCore/history/HistoryItem.cpp
+=======
+}
+
+void HistoryItem::setStateObject(PassRefPtr<SerializedScriptValue> object)
+{
+    ASSERT(m_document);
+    m_stateObject = object;
+}
+
+void HistoryItem::setDocument(Document* document)
+{
+    if (m_document == document)
+        return;
+    
+    if (m_document)
+        m_document->unregisterHistoryItem(this);
+    if (document)
+        document->registerHistoryItem(this);
+        
+    m_document = document;
+}
+
+void HistoryItem::documentDetached(Document* document)
+{
+    ASSERT_UNUSED(document, m_document == document);
+    m_document = 0;
+    m_stateObject = 0;
+>>>>>>> webkit.org at r51976:WebCore/history/HistoryItem.cpp
 }
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
diff --git a/WebCore/history/HistoryItem.h b/WebCore/history/HistoryItem.h
index e0cade0..4c91e76 100644
--- a/WebCore/history/HistoryItem.h
+++ b/WebCore/history/HistoryItem.h
@@ -28,6 +28,7 @@
 
 #include "IntPoint.h"
 #include "PlatformString.h"
+#include "SerializedScriptValue.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -54,7 +55,7 @@ class FormData;
 class HistoryItem;
 class Image;
 class KURL;
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
@@ -132,6 +133,12 @@ public:
     void setTitle(const String&);
     void setIsTargetItem(bool);
     
+    void setStateObject(PassRefPtr<SerializedScriptValue> object);
+    SerializedScriptValue* stateObject() const { return m_stateObject.get(); }
+    void setDocument(Document* document);
+    Document* document() const { return m_document; }
+    void documentDetached(Document*);
+    
     void setFormInfoFromRequest(const ResourceRequest&);
     void setFormData(PassRefPtr<FormData>);
     void setFormContentType(const String&);
@@ -235,6 +242,10 @@ private:
 
     OwnPtr<Vector<String> > m_redirectURLs;
 
+    // Support for HTML5 History
+    RefPtr<SerializedScriptValue> m_stateObject;
+    Document* m_document;
+    
     // info used to repost form data
     RefPtr<FormData> m_formData;
     String m_formContentType;
diff --git a/WebCore/history/android/AndroidWebHistoryBridge.h b/WebCore/history/android/AndroidWebHistoryBridge.h
index b401933..c6d5147 100644
--- a/WebCore/history/android/AndroidWebHistoryBridge.h
+++ b/WebCore/history/android/AndroidWebHistoryBridge.h
@@ -34,11 +34,19 @@ class HistoryItem;
 
 class AndroidWebHistoryBridge : public RefCounted<AndroidWebHistoryBridge> {
 public:
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
     AndroidWebHistoryBridge(HistoryItem* item)
+=======
+    AndroidWebHistoryBridge()
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
         : m_scale(100)
         , m_screenWidthScale(100)
         , m_active(false)
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
         , m_historyItem(item) { }
+=======
+        , m_historyItem(0) { }
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
     virtual ~AndroidWebHistoryBridge() { }
     virtual void updateHistoryItem(HistoryItem* item) = 0;
 
@@ -46,7 +54,10 @@ public:
     void setScreenWidthScale(int s) { m_screenWidthScale = s; }
     int scale() const { return m_scale; }
     int screenWidthScale() const { return m_screenWidthScale; }
+<<<<<<< HEAD:WebCore/history/android/AndroidWebHistoryBridge.h
     void detachHistoryItem() { m_historyItem = 0; }
+=======
+>>>>>>> webkit.org at r51976:WebCore/history/android/AndroidWebHistoryBridge.h
     HistoryItem* historyItem() const { return m_historyItem; }
     void setActive() { m_active = true; }
 
diff --git a/WebCore/html/CollectionCache.h b/WebCore/html/CollectionCache.h
index 7cdcdd5..0a49fb8 100644
--- a/WebCore/html/CollectionCache.h
+++ b/WebCore/html/CollectionCache.h
@@ -29,7 +29,7 @@ namespace WebCore {
 class AtomicStringImpl;
 class Element;
 
-struct CollectionCache {
+struct CollectionCache : FastAllocBase {
     CollectionCache();
     CollectionCache(const CollectionCache&);
     CollectionCache& operator=(const CollectionCache& other)
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index f735104..1d5d569 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -58,6 +58,15 @@ PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tag
     return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
+// This function does not allow leading spaces before the port number.
+static unsigned parsePortFromStringPosition(const String& value, unsigned portStart, unsigned& portEnd)
+{
+    portEnd = portStart;
+    while (isASCIIDigit(value[portEnd]))
+        ++portEnd;
+    return value.substring(portStart, portEnd - portStart).toUInt();
+}
+
 bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
@@ -69,10 +78,12 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if PLATFORM(MAC)
+#if !PLATFORM(GTK) && !PLATFORM(QT)
     if (isLink())
-        return false;
+        // Only allow links with tabIndex or contentEditable to be mouse focusable.
+        return HTMLElement::supportsFocus();
 #endif
+
     // Allow tab index etc to control focus.
     return HTMLElement::isMouseFocusable();
 }
@@ -332,7 +343,7 @@ bool HTMLAnchorElement::hasRel(uint32_t relation) const
 void HTMLAnchorElement::setRel(const String& value)
 {
     m_linkRelations = 0;
-    ClassNames newLinkRelations(value, true);
+    SpaceSplitString newLinkRelations(value, true);
     // FIXME: Add link relations as they are implemented
     if (newLinkRelations.contains("noreferrer"))
         m_linkRelations |= RelationNoReferrer;
@@ -360,42 +371,165 @@ String HTMLAnchorElement::hash() const
     return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
+void HTMLAnchorElement::setHash(const String& value)
+{
+    KURL url = href();
+    if (value[0] == '#')
+        url.setFragmentIdentifier(value.substring(1));
+    else
+        url.setFragmentIdentifier(value);
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::host() const
 {
     const KURL& url = href();
     if (url.hostEnd() == url.pathStart())
         return url.host();
-    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+    if (isDefaultPortForProtocol(url.port(), url.protocol()))
         return url.host();
     return url.host() + ":" + String::number(url.port());
 }
 
+void HTMLAnchorElement::setHost(const String& value)
+{
+    if (value.isEmpty())
+        return;
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    int separator = value.find(':');
+    if (!separator)
+        return;
+
+    if (separator == -1)
+        url.setHostAndPort(value);
+    else {
+        unsigned portEnd;
+        unsigned port = parsePortFromStringPosition(value, separator + 1, portEnd);
+        if (!port) {
+            // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+            // specifically goes against RFC 3986 (p3.2) and
+            // requires setting the port to "0" if it is set to empty string.
+            url.setHostAndPort(value.substring(0, separator + 1) + "0");
+        } else {
+            if (isDefaultPortForProtocol(port, url.protocol()))
+                url.setHostAndPort(value.substring(0, separator));
+            else
+                url.setHostAndPort(value.substring(0, portEnd));
+        }
+    }
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::hostname() const
 {
     return href().host();
 }
 
+void HTMLAnchorElement::setHostname(const String& value)
+{
+    // Before setting new value:
+    // Remove all leading U+002F SOLIDUS ("/") characters.
+    unsigned i = 0;
+    unsigned hostLength = value.length();
+    while (value[i] == '/')
+        i++;
+
+    if (i == hostLength)
+        return;
+
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    url.setHost(value.substring(i));
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::pathname() const
 {
     return href().path();
 }
 
+void HTMLAnchorElement::setPathname(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetPathname())
+        return;
+
+    if (value[0] == '/')
+        url.setPath(value);
+    else
+        url.setPath("/" + value);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::port() const
 {
     return String::number(href().port());
 }
 
+void HTMLAnchorElement::setPort(const String& value)
+{
+    KURL url = href();
+    if (!url.canSetHostOrPort())
+        return;
+
+    // http://dev.w3.org/html5/spec/infrastructure.html#url-decomposition-idl-attributes
+    // specifically goes against RFC 3986 (p3.2) and
+    // requires setting the port to "0" if it is set to empty string.
+    unsigned port = value.toUInt();
+    if (isDefaultPortForProtocol(port, url.protocol()))
+        url.removePort();
+    else
+        url.setPort(port);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::protocol() const
 {
     return href().protocol() + ":";
 }
 
+void HTMLAnchorElement::setProtocol(const String& value)
+{
+    int separator = value.find(':');
+
+    if (!separator)
+        return;
+    if (value.isEmpty())
+        return;
+
+    KURL url = href();
+    // Following Firefox 3.5.2 which removes anything after the first ":"
+    String newProtocol = value.substring(0, separator);
+    if (!isValidProtocol(newProtocol))
+        return;
+    url.setProtocol(newProtocol);
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::search() const
 {
     String query = href().query();
     return query.isEmpty() ? "" : "?" + query;
 }
 
+void HTMLAnchorElement::setSearch(const String& value)
+{
+    KURL url = href();
+    String newSearch = (value[0] == '?') ? value.substring(1) : value;
+    // Make sure that '#' in the query does not leak to the hash.
+    url.setQuery(newSearch.replace('#', "%23"));
+
+    setHref(url.string());
+}
+
 String HTMLAnchorElement::text() const
 {
     return innerText();
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index e47ea99..03d3529 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -62,12 +62,26 @@ public:
     const AtomicString& name() const;
 
     String hash() const;
+    void setHash(const String&);
+
     String host() const;
+    void setHost(const String&);
+
     String hostname() const;
+    void setHostname(const String&);
+
     String pathname() const;
+    void setPathname(const String&);
+
     String port() const;
+    void setPort(const String&);
+
     String protocol() const;
+    void setProtocol(const String&);
+
     String search() const;
+    void setSearch(const String&);
+
     String text() const;
 
     String toString() const;
diff --git a/WebCore/html/HTMLAnchorElement.idl b/WebCore/html/HTMLAnchorElement.idl
index 057358e..e55bd86 100644
--- a/WebCore/html/HTMLAnchorElement.idl
+++ b/WebCore/html/HTMLAnchorElement.idl
@@ -37,7 +37,7 @@ module html {
         attribute [ConvertNullToNullString, Reflect] DOMString target;
         attribute [ConvertNullToNullString, Reflect] DOMString type;
 
-        // IE Extensions
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString hash;
         readonly attribute DOMString host;
         readonly attribute DOMString hostname;
@@ -45,6 +45,16 @@ module html {
         readonly attribute DOMString port;
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
+#else
+        attribute [ConvertNullToNullString] DOMString hash;
+        attribute [ConvertNullToNullString] DOMString host;
+        attribute [ConvertNullToNullString] DOMString hostname;
+        attribute [ConvertNullToNullString] DOMString pathname;
+        attribute [ConvertNullToNullString] DOMString port;
+        attribute [ConvertNullToNullString] DOMString protocol;
+        attribute [ConvertNullToNullString] DOMString search;
+#endif
+
         readonly attribute DOMString text;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index 46045d6..f67e9dc 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -28,6 +28,7 @@
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
 #include "RenderApplet.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -108,9 +109,7 @@ bool HTMLAppletElement::rendererIsNeeded(RenderStyle* style)
 
 RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
 {
-    Settings* settings = document()->settings();
-
-    if (settings && settings->isJavaEnabled()) {
+    if (canEmbedJava()) {
         HashMap<String, String> args;
 
         args.set("code", getAttribute(codeAttr));
@@ -142,8 +141,7 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
 
 RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
 {
-    Settings* settings = document()->settings();
-    if (!settings || !settings->isJavaEnabled())
+    if (!canEmbedJava())
         return 0;
 
     RenderApplet* applet = toRenderApplet(renderer());
@@ -153,6 +151,15 @@ RenderWidget* HTMLAppletElement::renderWidgetForJSBindings() const
     return applet;
 }
 
+bool HTMLAppletElement::canEmbedJava() const
+{
+    if (document()->securityOrigin()->isSandboxed(SandboxPlugins))
+        return false;
+
+    Settings* settings = document()->settings();
+    return settings && settings->isJavaEnabled();
+}
+
 void HTMLAppletElement::finishParsingChildren()
 {
     // The parser just reached </applet>, so all the params are available now.
diff --git a/WebCore/html/HTMLAppletElement.h b/WebCore/html/HTMLAppletElement.h
index baaab38..a53bd5c 100644
--- a/WebCore/html/HTMLAppletElement.h
+++ b/WebCore/html/HTMLAppletElement.h
@@ -51,6 +51,7 @@ private:
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
     void setupApplet() const;
+    bool canEmbedJava() const;
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index ac8ce11..c989dbd 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -14,16 +14,25 @@ alt
 archive
 aria-activedescendant
 aria-checked
+aria-controls
 aria-describedby
 aria-disabled
+aria-dropeffect
+aria-expanded
+aria-flowto
+aria-grabbed
 aria-hidden
 aria-label
 aria-labeledby
 aria-labelledby
 aria-level
+aria-multiselectable
+aria-orientation
+aria-owns
 aria-pressed
 aria-readonly
 aria-required
+aria-selected
 aria-valuemax
 aria-valuemin
 aria-valuenow
@@ -174,6 +183,7 @@ onpaste
 onpause
 onplay
 onplaying
+onpopstate
 onprogress
 onratechange
 onreset
@@ -201,6 +211,8 @@ onwaiting
 onwebkitanimationstart
 onwebkitanimationiteration
 onwebkitanimationend
+onwebkitbeginfullscreen
+onwebkitendfullscreen
 onwebkittransitionend
 pattern
 placeholder
@@ -220,6 +232,7 @@ role
 rows
 rowspan
 rules
+sandbox
 scheme
 scope
 scrollamount
@@ -235,6 +248,7 @@ spellcheck
 src
 standby
 start
+step
 style
 summary
 tabindex
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index b203cc0..b9e2c75 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -144,6 +144,8 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onpageshowAttr)
         document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index e898c88..76b49a1 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -52,13 +52,15 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
 
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+
 #if ENABLE(ORIENTATION_EVENTS)
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 2e93e2e..b2f0c65 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -40,6 +40,7 @@ module html {
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
diff --git a/WebCore/html/HTMLButtonElement.idl b/WebCore/html/HTMLButtonElement.idl
index 55803df..cb9383d 100644
--- a/WebCore/html/HTMLButtonElement.idl
+++ b/WebCore/html/HTMLButtonElement.idl
@@ -37,6 +37,7 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        readonly attribute DOMString             validationMessage;
         boolean  checkValidity();
         void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 0405669..be0fa36 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -31,7 +31,7 @@
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
 #if ENABLE(3D_CANVAS)    
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
 #endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
@@ -149,9 +149,9 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 {
-    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
-    // context is already 2D, just return that. If the existing context is 3D, then destroy it
-    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // A Canvas can either be "2D" or "webgl" but never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is WebGL, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a WebGL canvas. Requesting a
     // context with any other type string will destroy any existing context.
     
     // FIXME - The code depends on the context not going away once created, to prevent JS from
@@ -167,12 +167,14 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 #if ENABLE(3D_CANVAS)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()) {
+        // Accept the legacy "webkit-3d" name as well as the provisional "experimental-webgl" name.
+        // Once ratified, we will also accept "webgl" as the context name.
         if ((type == "webkit-3d") ||
-            (type == "GL")) {
+            (type == "experimental-webgl")) {
             if (m_context && !m_context->is3d())
                 return 0;
             if (!m_context) {
-                m_context = CanvasRenderingContext3D::create(this);
+                m_context = WebGLRenderingContext::create(this);
                 if (m_context) {
                     // Need to make sure a RenderLayer and compositing layer get created for the Canvas
                     setNeedsStyleRecalc(SyntheticStyleChange);
@@ -249,9 +251,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
         return;
     
 #if ENABLE(3D_CANVAS)
-    CanvasRenderingContext3D* context3D = NULL;
+    WebGLRenderingContext* context3D = NULL;
     if (m_context && m_context->is3d()) {
-        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D = static_cast<WebGLRenderingContext*>(m_context.get());
         context3D->beginPaint();
     }
 #endif
@@ -259,7 +261,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
-            context->drawImage(image, r);
+            context->drawImage(image, DeviceColorSpace, r);
     }
 
 #if ENABLE(3D_CANVAS)
diff --git a/WebCore/html/HTMLFieldSetElement.idl b/WebCore/html/HTMLFieldSetElement.idl
index ca8563b..c55e604 100644
--- a/WebCore/html/HTMLFieldSetElement.idl
+++ b/WebCore/html/HTMLFieldSetElement.idl
@@ -29,6 +29,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 96ecc7d..2531c48 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -288,6 +288,11 @@ bool HTMLFormControlElement::willValidate() const
     return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
 }
 
+String HTMLFormControlElement::validationMessage()
+{
+    return validity()->validationMessage();
+}
+
 bool HTMLFormControlElement::checkValidity()
 {
     if (willValidate() && !isValidFormControlElement()) {
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index b5dc7ce..7105112 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -107,6 +107,7 @@ public:
     virtual short tabIndex() const;
 
     virtual bool willValidate() const;
+    String validationMessage();
     bool checkValidity();
     void updateValidity();
     void setCustomValidity(const String&);
diff --git a/WebCore/html/HTMLFrameOwnerElement.cpp b/WebCore/html/HTMLFrameOwnerElement.cpp
index 84958c2..7598da2 100644
--- a/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
+    , m_sandboxFlags(SandboxNone)
 {
 }
 
@@ -64,6 +65,17 @@ DOMWindow* HTMLFrameOwnerElement::contentWindow() const
     return m_contentFrame ? m_contentFrame->domWindow() : 0;
 }
 
+void HTMLFrameOwnerElement::setSandboxFlags(SandboxFlags flags)
+{
+    if (m_sandboxFlags == flags)
+        return;
+
+    m_sandboxFlags = flags;
+    
+    if (Frame* frame = contentFrame())
+        frame->loader()->ownerElementSandboxFlagsChanged();
+}
+
 #if ENABLE(SVG)
 SVGDocument* HTMLFrameOwnerElement::getSVGDocument(ExceptionCode& ec) const
 {
diff --git a/WebCore/html/HTMLFrameOwnerElement.h b/WebCore/html/HTMLFrameOwnerElement.h
index 1437e2c..308a100 100644
--- a/WebCore/html/HTMLFrameOwnerElement.h
+++ b/WebCore/html/HTMLFrameOwnerElement.h
@@ -21,6 +21,7 @@
 #ifndef HTMLFrameOwnerElement_h
 #define HTMLFrameOwnerElement_h
 
+#include "FrameLoaderTypes.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -46,9 +47,13 @@ public:
 
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+    
 protected:
     HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
+    void setSandboxFlags(SandboxFlags);
+    
 private:
     friend class Frame;
 
@@ -58,6 +63,7 @@ private:
     virtual void willRemove();
 
     Frame* m_contentFrame;
+    SandboxFlags m_sandboxFlags;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index 5874b84..f4d1558 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -151,6 +151,8 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onofflineAttr)
         document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpopstateAttr)
+        document()->setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()->frame(), attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index 2b2d7ea..0c75efe 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -79,6 +79,7 @@ public:
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
diff --git a/WebCore/html/HTMLFrameSetElement.idl b/WebCore/html/HTMLFrameSetElement.idl
index b44a071..6ab1a8b 100644
--- a/WebCore/html/HTMLFrameSetElement.idl
+++ b/WebCore/html/HTMLFrameSetElement.idl
@@ -37,6 +37,7 @@ module html {
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onpopstate;
         attribute [DontEnum] EventListener onresize;
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
diff --git a/WebCore/html/HTMLHeadElement.h b/WebCore/html/HTMLHeadElement.h
index 21d8a2f..14a4409 100644
--- a/WebCore/html/HTMLHeadElement.h
+++ b/WebCore/html/HTMLHeadElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLHeadingElement.cpp b/WebCore/html/HTMLHeadingElement.cpp
index 452f7c3..95c82d1 100644
--- a/WebCore/html/HTMLHeadingElement.cpp
+++ b/WebCore/html/HTMLHeadingElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLHeadingElement.h b/WebCore/html/HTMLHeadingElement.h
index dac1107..765bede 100644
--- a/WebCore/html/HTMLHeadingElement.h
+++ b/WebCore/html/HTMLHeadingElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/WebCore/html/HTMLHtmlElement.h b/WebCore/html/HTMLHtmlElement.h
index 86603b5..de80ba8 100644
--- a/WebCore/html/HTMLHtmlElement.h
+++ b/WebCore/html/HTMLHtmlElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index cae9b8d..a2f287e 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Ericsson AB. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -66,6 +67,40 @@ bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttribut
     return HTMLFrameElementBase::mapToEntry(attrName, result);
 }
 
+static SandboxFlags parseSandboxAttribute(MappedAttribute* attribute)
+{
+    if (attribute->isNull())
+        return SandboxNone;
+
+    // Parse the unordered set of unique space-separated tokens.
+    SandboxFlags flags = SandboxAll;
+    const UChar* characters = attribute->value().characters();
+    unsigned length = attribute->value().length();
+    unsigned start = 0;
+    while (true) {
+        while (start < length && isASCIISpace(characters[start]))
+            ++start;
+        if (start >= length)
+            break;
+        unsigned end = start + 1;
+        while (end < length && !isASCIISpace(characters[end]))
+            ++end;
+
+        // Turn off the corresponding sandbox flag if it's set as "allowed".
+        String sandboxToken = String(characters + start, end - start);
+        if (equalIgnoringCase(sandboxToken, "allow-same-origin"))
+            flags &= ~SandboxOrigin;
+        else if (equalIgnoringCase(sandboxToken, "allow-forms"))
+            flags &= ~SandboxForms;
+        else if (equalIgnoringCase(sandboxToken, "allow-scripts"))
+            flags &= ~SandboxScripts;
+
+        start = end + 1;
+    }
+    
+    return flags;
+}
+
 void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == widthAttr)
@@ -88,7 +123,9 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
         if (!attr->isNull() && !attr->value().toInt())
             // Add a rule that nulls out our border width.
             addCSSLength(attr, CSSPropertyBorderWidth, "0");
-    } else
+    } else if (attr->name() == sandboxAttr)
+        setSandboxFlags(parseSandboxAttribute(attr));
+    else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index e288b54..dad8416 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -33,6 +33,7 @@ module html {
                  attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
                  attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
                  attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       sandbox;
                  attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
                  attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
                  attribute [ConvertNullToNullString, Reflect] DOMString       width;
diff --git a/WebCore/html/HTMLImageLoader.h b/WebCore/html/HTMLImageLoader.h
index 9e9564b..d3b6068 100644
--- a/WebCore/html/HTMLImageLoader.h
+++ b/WebCore/html/HTMLImageLoader.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index f63ccc8..85fa64d 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -45,6 +45,7 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
+#include "ISODateTime.h"
 #include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
@@ -59,12 +60,18 @@
 #include "RenderText.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
+#include "StringHash.h"
 #include "TextEvent.h"
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
 #include "WebViewCore.h"
 #endif
+=======
+#include <wtf/HashMap.h>
+>>>>>>> webkit.org at r51976:WebCore/html/HTMLInputElement.cpp
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/dtoa.h>
 
 using namespace std;
 
@@ -74,6 +81,16 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
+// Constant values for getAllowedValueStep().
+static const double numberDefaultStep = 1.0;
+static const double numberStepScaleFactor = 1.0;
+// Constant values for minimum().
+static const double numberDefaultMinimum = -DBL_MAX;
+static const double rangeDefaultMinimum = 0.0;
+// Constant values for maximum().
+static const double numberDefaultMaximum = DBL_MAX;
+static const double rangeDefaultMaximum = 100.0;
+
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
@@ -129,14 +146,20 @@ bool HTMLInputElement::valueMissing() const
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
-        case NUMBER:
         case FILE:
+        case MONTH:
+        case NUMBER:
+        case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return value().isEmpty();
         case CHECKBOX:
             return !checked();
@@ -144,13 +167,13 @@ bool HTMLInputElement::valueMissing() const
             return !document()->checkedRadioButtons().checkedButtonForGroup(name());
         case COLOR:
             return false;
+        case BUTTON:
         case HIDDEN:
-        case RANGE:
-        case SUBMIT:
         case IMAGE:
-        case RESET:
-        case BUTTON:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             break;
     }
 
@@ -161,25 +184,31 @@ bool HTMLInputElement::valueMissing() const
 bool HTMLInputElement::patternMismatch() const
 {
     switch (inputType()) {
-        case ISINDEX:
+        case BUTTON:
         case CHECKBOX:
-        case RADIO:
-        case SUBMIT:
-        case RESET:
+        case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case FILE:
         case HIDDEN:
         case IMAGE:
-        case BUTTON:
-        case RANGE:
+        case ISINDEX:
+        case MONTH:
         case NUMBER:
-        case COLOR:
+        case RADIO:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
+        case TIME:
+        case WEEK:
             return false;
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
         case EMAIL:
         case PASSWORD:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case URL:
             const AtomicString& pattern = getAttribute(patternAttr);
             String value = this->value();
 
@@ -220,15 +249,21 @@ bool HTMLInputElement::tooLong() const
     case BUTTON:
     case CHECKBOX:
     case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case FILE:
     case HIDDEN:
     case IMAGE:
     case ISINDEX:
+    case MONTH:
     case NUMBER:
     case RADIO:
     case RANGE:
     case RESET:
     case SUBMIT:
+    case TIME:
+    case WEEK:
         return false;
     }
     ASSERT_NOT_REACHED();
@@ -237,60 +272,204 @@ bool HTMLInputElement::tooLong() const
 
 bool HTMLInputElement::rangeUnderflow() const
 {
-    if (inputType() == NUMBER) {
-        double min = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
-            return doubleValue < min;
-    } else if (inputType() == RANGE) {
+    if (inputType() == NUMBER || inputType() == RANGE) {
         double doubleValue;
         if (formStringToDouble(value(), &doubleValue))
-            return doubleValue < rangeMinimum();
+            return doubleValue < minimum();
     }
     return false;
 }
 
 bool HTMLInputElement::rangeOverflow() const
 {
-    if (inputType() == NUMBER) {
-        double max = 0.0;
-        double doubleValue = 0.0;
-        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
-            return doubleValue > max;
-    } else if (inputType() == RANGE) {
+    if (inputType() == NUMBER || inputType() == RANGE) {
         double doubleValue;
         if (formStringToDouble(value(), &doubleValue))
-            return doubleValue > rangeMaximum();
+            return doubleValue > maximum();
     }
     return false;
 }
 
-double HTMLInputElement::rangeMinimum() const
+double HTMLInputElement::minimum() const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default minimum" is 0.
-    double min = 0.0;
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double min = inputType() == RANGE ? rangeDefaultMinimum : numberDefaultMinimum;
     formStringToDouble(getAttribute(minAttr), &min);
     return min;
 }
 
-double HTMLInputElement::rangeMaximum() const
+double HTMLInputElement::maximum() const
 {
-    ASSERT(inputType() == RANGE);
-    // The range type's "default maximum" is 100.
-    static const double defaultMaximum = 100.0;
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double defaultMaximum = inputType() == RANGE ? rangeDefaultMaximum : numberDefaultMaximum;
     double max = defaultMaximum;
     formStringToDouble(getAttribute(maxAttr), &max);
-    const double min = rangeMinimum();
-
-    if (max < min) {
-        // A remedy for the inconsistent min/max values.
-        // Sets the maxmimum to the default (100.0) or the minimum value.
-        max = min < defaultMaximum ? defaultMaximum : min;
+    if (inputType() == RANGE) {
+        // A remedy for the inconsistent min/max values for RANGE.
+        // Sets the maxmimum to the default or the minimum value.
+        double min = minimum();
+        if (max < min)
+            max = std::max(min, defaultMaximum);
     }
     return max;
 }
 
+double HTMLInputElement::stepBase() const
+{
+    if (inputType() == RANGE)
+        return minimum();
+    if (inputType() == NUMBER) {
+        static const double defaultStepBase = 0.0;
+        double min = defaultStepBase;
+        formStringToDouble(getAttribute(minAttr), &min);
+        return min;
+    }
+    ASSERT_NOT_REACHED();
+    return 0.0;
+}
+
+bool HTMLInputElement::stepMismatch() const
+{
+    double step;
+    if (!getAllowedValueStep(&step))
+        return false;
+    if (inputType() == NUMBER) {
+        double doubleValue;
+        if (!formStringToDouble(value(), &doubleValue))
+            return false;
+        doubleValue = fabs(doubleValue - stepBase());
+        if (isinf(doubleValue))
+            return false;
+        // double's fractional part size is DBL_MAN_DIG-bit.  If the current
+        // value is greater than step*2^DBL_MANT_DIG, the following fmod() makes
+        // no sense.
+        if (doubleValue / pow(2, DBL_MANT_DIG) > step)
+            return false;
+        double remainder = fmod(doubleValue, step);
+        // Accepts errors in lower 7-bit.
+        double acceptableError = step / pow(2, DBL_MANT_DIG - 7);
+        return acceptableError < remainder && remainder < (step - acceptableError);
+    }
+    // Non-RANGE types should be rejected by getAllowedValueStep().
+    ASSERT(inputType() == RANGE);
+    // stepMismatch doesn't occur for RANGE. RenderSlider guarantees the
+    // value matches to step.
+    return false;
+}
+
+bool HTMLInputElement::getStepParameters(double* defaultStep, double* stepScaleFactor) const
+{
+    ASSERT(defaultStep);
+    ASSERT(stepScaleFactor);
+    switch (inputType()) {
+    case NUMBER:
+    case RANGE:
+        *defaultStep = numberDefaultStep;
+        *stepScaleFactor = numberStepScaleFactor;
+        return true;
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case MONTH:
+    case TIME:
+    case WEEK:
+        // FIXME: Implement for these types.
+        return false;
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case EMAIL:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SEARCH:
+    case SUBMIT:
+    case TELEPHONE:
+    case TEXT:
+    case URL:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::getAllowedValueStep(double* step) const
+{
+    ASSERT(step);
+    double defaultStep;
+    double stepScaleFactor;
+    if (!getStepParameters(&defaultStep, &stepScaleFactor))
+        return false;
+    const AtomicString& stepString = getAttribute(stepAttr);
+    if (stepString.isEmpty()) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    if (equalIgnoringCase(stepString, "any"))
+        return false;
+    double parsed;
+    if (!formStringToDouble(stepString, &parsed) || parsed <= 0.0) {
+        *step = defaultStep * stepScaleFactor;
+        return true;
+    }
+    *step = parsed * stepScaleFactor;
+    ASSERT(*step > 0);
+    return true;
+}
+
+void HTMLInputElement::applyStepForNumberOrRange(double count, ExceptionCode& ec)
+{
+    ASSERT(inputType() == NUMBER || inputType() == RANGE);
+    double step;
+    if (!getAllowedValueStep(&step)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double current;
+    if (!formStringToDouble(value(), &current)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double newValue = current + step * count;
+    if (isinf(newValue)) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    if (newValue < minimum()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    double base = stepBase();
+    newValue = base + round((newValue - base) / step) * step;
+    if (newValue > maximum()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    setValue(formStringFromDouble(newValue));
+}
+
+void HTMLInputElement::stepUp(int n, ExceptionCode& ec)
+{
+    if (inputType() != NUMBER && inputType() != RANGE) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    applyStepForNumberOrRange(n, ec);
+}
+
+void HTMLInputElement::stepDown(int n, ExceptionCode& ec)
+{
+    if (inputType() != NUMBER && inputType() != RANGE) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+    applyStepForNumberOrRange(-n, ec);
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -375,8 +554,40 @@ void HTMLInputElement::setType(const String& t)
         setAttribute(typeAttr, t);
 }
 
+typedef HashMap<String, HTMLInputElement::InputType, CaseFoldingHash> InputTypeMap;
+static const InputTypeMap* createTypeMap()
+{
+    InputTypeMap* map = new InputTypeMap;
+    map->add("button", HTMLInputElement::BUTTON);
+    map->add("checkbox", HTMLInputElement::CHECKBOX);
+    map->add("color", HTMLInputElement::COLOR);
+    map->add("date", HTMLInputElement::DATE);
+    map->add("datetime", HTMLInputElement::DATETIME);
+    map->add("datetime-local", HTMLInputElement::DATETIMELOCAL);
+    map->add("email", HTMLInputElement::EMAIL);
+    map->add("file", HTMLInputElement::FILE);
+    map->add("hidden", HTMLInputElement::HIDDEN);
+    map->add("image", HTMLInputElement::IMAGE);
+    map->add("khtml_isindex", HTMLInputElement::ISINDEX);
+    map->add("month", HTMLInputElement::MONTH);
+    map->add("number", HTMLInputElement::NUMBER);
+    map->add("password", HTMLInputElement::PASSWORD);
+    map->add("radio", HTMLInputElement::RADIO);
+    map->add("range", HTMLInputElement::RANGE);
+    map->add("reset", HTMLInputElement::RESET);
+    map->add("search", HTMLInputElement::SEARCH);
+    map->add("submit", HTMLInputElement::SUBMIT);
+    map->add("tel", HTMLInputElement::TELEPHONE);
+    map->add("time", HTMLInputElement::TIME);
+    map->add("url", HTMLInputElement::URL);
+    map->add("week", HTMLInputElement::WEEK);
+    // No need to register "text" because it is the default type.
+    return map;
+}
+
 void HTMLInputElement::setInputType(const String& t)
 {
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
     InputType newType;
     
     if (equalIgnoringCase(t, "password"))
@@ -425,6 +636,10 @@ void HTMLInputElement::setInputType(const String& t)
         newType = COLOR;
     else
         newType = TEXT;
+=======
+    static const InputTypeMap* typeMap = createTypeMap();
+    InputType newType = t.isNull() ? TEXT : typeMap->get(t);
+>>>>>>> webkit.org at r51976:WebCore/html/HTMLInputElement.cpp
 
     // IMPORTANT: Don't allow the type to be changed to FILE after the first
     // type change, otherwise a JavaScript programmer would be able to set a text
@@ -495,82 +710,42 @@ void HTMLInputElement::setInputType(const String& t)
         m_imageLoader.clear();
 }
 
+static const AtomicString* createFormControlTypes()
+{
+    AtomicString* types = new AtomicString[HTMLInputElement::numberOfTypes];
+    // The values must be lowercased because they will be the return values of
+    //  input.type and it must be lowercase according to DOM Level 2.
+    types[HTMLInputElement::BUTTON] = "button";
+    types[HTMLInputElement::CHECKBOX] = "checkbox";
+    types[HTMLInputElement::COLOR] = "color";
+    types[HTMLInputElement::DATE] = "date";
+    types[HTMLInputElement::DATETIME] = "datetime";
+    types[HTMLInputElement::DATETIMELOCAL] = "datetime-local";
+    types[HTMLInputElement::EMAIL] = "email";
+    types[HTMLInputElement::FILE] = "file";
+    types[HTMLInputElement::HIDDEN] = "hidden";
+    types[HTMLInputElement::IMAGE] = "image";
+    types[HTMLInputElement::ISINDEX] = emptyAtom;
+    types[HTMLInputElement::MONTH] = "month";
+    types[HTMLInputElement::NUMBER] = "number";
+    types[HTMLInputElement::PASSWORD] = "password";
+    types[HTMLInputElement::RADIO] = "radio";
+    types[HTMLInputElement::RANGE] = "range";
+    types[HTMLInputElement::RESET] = "reset";
+    types[HTMLInputElement::SEARCH] = "search";
+    types[HTMLInputElement::SUBMIT] = "submit";
+    types[HTMLInputElement::TELEPHONE] = "tel";
+    types[HTMLInputElement::TEXT] = "text";
+    types[HTMLInputElement::TIME] = "time";
+    types[HTMLInputElement::URL] = "url";
+    types[HTMLInputElement::WEEK] = "week";
+    return types;
+}
+
 const AtomicString& HTMLInputElement::formControlType() const
 {
-    // needs to be lowercase according to DOM spec
-    switch (inputType()) {
-        case BUTTON: {
-            DEFINE_STATIC_LOCAL(const AtomicString, button, ("button"));
-            return button;
-        }
-        case CHECKBOX: {
-            DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
-            return checkbox;
-        }
-        case COLOR: {
-            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
-            return color;
-        }
-        case EMAIL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
-            return email;
-        }
-        case FILE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
-            return file;
-        }
-        case HIDDEN: {
-            DEFINE_STATIC_LOCAL(const AtomicString, hidden, ("hidden"));
-            return hidden;
-        }
-        case IMAGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, image, ("image"));
-            return image;
-        }
-        case ISINDEX:
-            return emptyAtom;
-        case NUMBER: {
-            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
-            return number;
-        }
-        case PASSWORD: {
-            DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
-            return password;
-        }
-        case RADIO: {
-            DEFINE_STATIC_LOCAL(const AtomicString, radio, ("radio"));
-            return radio;
-        }
-        case RANGE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, range, ("range"));
-            return range;
-        }
-        case RESET: {
-            DEFINE_STATIC_LOCAL(const AtomicString, reset, ("reset"));
-            return reset;
-        }
-        case SEARCH: {
-            DEFINE_STATIC_LOCAL(const AtomicString, search, ("search"));
-            return search;
-        }
-        case SUBMIT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
-            return submit;
-        }
-        case TELEPHONE: {
-            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
-            return telephone;
-        }
-        case TEXT: {
-            DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
-            return text;
-        }
-        case URL: {
-            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
-            return url;
-        }
-    }
-    return emptyAtom;
+    static const AtomicString* formControlTypes = createFormControlTypes();
+    return formControlTypes[inputType()];
 }
 
 bool HTMLInputElement::saveFormControlState(String& result) const
@@ -581,11 +756,15 @@ bool HTMLInputElement::saveFormControlState(String& result) const
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -593,7 +772,9 @@ bool HTMLInputElement::saveFormControlState(String& result) const
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             result = value();
             return true;
         case CHECKBOX:
@@ -613,11 +794,15 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     switch (inputType()) {
         case BUTTON:
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case RANGE:
         case RESET:
@@ -625,7 +810,9 @@ void HTMLInputElement::restoreFormControlState(const String& state)
         case SUBMIT:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             setValue(state);
             break;
         case CHECKBOX:
@@ -668,14 +855,20 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
             // a no-op for this type
             break;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // should never restore previous selection here
             focus(false);
             break;
@@ -714,12 +907,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             m_autocomplete = Off;
             registerForActivationCallbackIfNeeded();
         } else {
-            if (m_autocomplete == Off)
-                unregisterForActivationCallbackIfNeeded();
+            bool needsToUnregister = m_autocomplete == Off;
+
             if (attr->isEmpty())
                 m_autocomplete = Uninitialized;
             else
                 m_autocomplete = On;
+
+            if (needsToUnregister)
+                unregisterForActivationCallbackIfNeeded();
         }
     } else if (attr->name() == typeAttr) {
         setInputType(attr->value());
@@ -802,30 +998,9 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
 {
-    switch (inputType()) {
-        case BUTTON:
-        case CHECKBOX:
-        case COLOR:
-        case EMAIL:
-        case FILE:
-        case IMAGE:
-        case ISINDEX:
-        case NUMBER:
-        case PASSWORD:
-        case RADIO:
-        case RANGE:
-        case RESET:
-        case SEARCH:
-        case SUBMIT:
-        case TELEPHONE:
-        case TEXT:
-        case URL:
-            return HTMLFormControlElementWithState::rendererIsNeeded(style);
-        case HIDDEN:
-            return false;
-    }
-    ASSERT(false);
-    return false;
+    if (inputType() == HIDDEN)
+        return false;
+    return HTMLFormControlElementWithState::rendererIsNeeded(style);
 }
 
 RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *style)
@@ -847,14 +1022,20 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case RANGE:
             return new (arena) RenderSlider(this);
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
@@ -934,16 +1115,22 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
 
     switch (inputType()) {
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -1021,6 +1208,40 @@ void HTMLInputElement::reset()
     m_useDefaultChecked = true;
 }
 
+bool HTMLInputElement::isTextField() const
+{
+    switch (inputType()) {
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
+    case EMAIL:
+    case ISINDEX:
+    case MONTH:
+    case NUMBER:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK:
+        return true;
+    case BUTTON:
+    case CHECKBOX:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 {
     if (checked() == nowChecked)
@@ -1112,11 +1333,15 @@ String HTMLInputElement::valueWithDefault() const
             case BUTTON:
             case CHECKBOX:
             case COLOR:
+            case DATE:
+            case DATETIME:
+            case DATETIMELOCAL:
             case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case MONTH:
             case NUMBER:
             case PASSWORD:
             case RADIO:
@@ -1124,7 +1349,9 @@ String HTMLInputElement::valueWithDefault() const
             case SEARCH:
             case TELEPHONE:
             case TEXT:
+            case TIME:
             case URL:
+            case WEEK:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -1137,7 +1364,13 @@ String HTMLInputElement::valueWithDefault() const
     return v;
 }
 
-void HTMLInputElement::setValue(const String& value)
+void HTMLInputElement::setValueForUser(const String& value)
+{
+    // Call setValue and make it send a change event.
+    setValue(value, true);
+}
+
+void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
 {
     // For security reasons, we don't allow setting the filename, but we do allow clearing it.
     // The HTML5 spec (as of the 10/24/08 working draft) says that the value attribute isn't applicable to the file upload control
@@ -1162,7 +1395,7 @@ void HTMLInputElement::setValue(const String& value)
         setNeedsStyleRecalc();
     } else
         setAttribute(valueAttr, sanitizeValue(value));
-    
+
     if (isTextField()) {
         unsigned max = m_data.value().length();
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
@@ -1174,6 +1407,12 @@ void HTMLInputElement::setValue(const String& value)
         else
             cacheSelection(max, max);
     }
+
+    // Don't dispatch the change event when focused, it will be dispatched
+    // when the control loses focus.
+    if (sendChangeEvent && document()->focusedNode() != this)
+        dispatchFormControlChangeEvent();
+
     InputElement::notifyFormStateChanged(this);
     updateValidity();
 }
@@ -1226,16 +1465,22 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case SUBMIT:
             return false;
         case COLOR:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
         case FILE:
         case ISINDEX:
+        case MONTH:
         case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
         case TELEPHONE:
         case TEXT:
+        case TIME:
         case URL:
+        case WEEK:
             return true;
     }
     return false;
@@ -1402,16 +1647,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             switch (inputType()) {
                 case CHECKBOX:
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1531,16 +1782,22 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                         clickElement = true;
                     break;
                 case COLOR:
+                case DATE:
+                case DATETIME:
+                case DATETIMELOCAL:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case MONTH:
                 case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
                 case TELEPHONE:
                 case TEXT:
+                case TIME:
                 case URL:
+                case WEEK:
                     break;
             }
         }
@@ -1560,12 +1817,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         }
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
+        if (r && r->isTextField() && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
             dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r && r->isTextField())
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         RefPtr<HTMLFormElement> formForSubmission = form();
@@ -1771,25 +2028,31 @@ bool HTMLInputElement::isRequiredFormControl() const
         return false;
 
     switch (inputType()) {
-        case TEXT:
-        case SEARCH:
-        case URL:
-        case TELEPHONE:
+        case CHECKBOX:
+        case DATE:
+        case DATETIME:
+        case DATETIMELOCAL:
         case EMAIL:
-        case PASSWORD:
+        case FILE:
+        case MONTH:
         case NUMBER:
-        case CHECKBOX:
+        case PASSWORD:
         case RADIO:
-        case FILE:
+        case SEARCH:
+        case TELEPHONE:
+        case TEXT:
+        case TIME:
+        case URL:
+        case WEEK:
             return true;
-        case HIDDEN:
-        case RANGE:
-        case SUBMIT:
-        case IMAGE:
-        case RESET:
         case BUTTON:
         case COLOR:
+        case HIDDEN:
+        case IMAGE:
         case ISINDEX:
+        case RANGE:
+        case RESET:
+        case SUBMIT:
             return false;
     }
 
@@ -1856,6 +2119,16 @@ bool HTMLInputElement::willValidate() const
            inputType() != BUTTON && inputType() != RESET;
 }
 
+String HTMLInputElement::formStringFromDouble(double number)
+{
+    // According to HTML5, "the best representation of the number n as a floating
+    // point number" is a string produced by applying ToString() to n.
+    DtoaBuffer buffer;
+    unsigned length;
+    doubleToStringInJavaScriptFormat(number, buffer, &length);
+    return String(buffer, length);
+}
+
 bool HTMLInputElement::formStringToDouble(const String& src, double* out)
 {
     // See HTML5 2.4.4.3 `Real numbers.'
@@ -1879,6 +2152,34 @@ bool HTMLInputElement::formStringToDouble(const String& src, double* out)
     return true;
 }
 
+bool HTMLInputElement::formStringToISODateTime(InputType type, const String& formString, ISODateTime* out)
+{
+    ISODateTime ignoredResult;
+    if (!out)
+        out = &ignoredResult;
+    const UChar* characters = formString.characters();
+    unsigned length = formString.length();
+    unsigned end;
+
+    switch (type) {
+    case DATE:
+        return out->parseDate(characters, length, 0, end) && end == length;
+    case DATETIME:
+        return out->parseDateTime(characters, length, 0, end) && end == length;
+    case DATETIMELOCAL:
+        return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
+    case MONTH:
+        return out->parseMonth(characters, length, 0, end) && end == length;
+    case WEEK:
+        return out->parseWeek(characters, length, 0, end) && end == length;
+    case TIME:
+        return out->parseTime(characters, length, 0, end) && end == length;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
 #if ENABLE(DATALIST)
 HTMLElement* HTMLInputElement::list() const
 {
@@ -1891,29 +2192,35 @@ HTMLDataListElement* HTMLInputElement::dataList() const
         return 0;
 
     switch (inputType()) {
-    case TEXT:
-    case SEARCH:
-    case URL:
-    case TELEPHONE:
+    case COLOR:
+    case DATE:
+    case DATETIME:
+    case DATETIMELOCAL:
     case EMAIL:
+    case MONTH:
     case NUMBER:
     case RANGE:
-    case COLOR: {
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case TIME:
+    case URL:
+    case WEEK: {
         Element* element = document()->getElementById(getAttribute(listAttr));
         if (element && element->hasTagName(datalistTag))
             return static_cast<HTMLDataListElement*>(element);
         break;
     }
-    case HIDDEN:
-    case PASSWORD:
+    case BUTTON:
     case CHECKBOX:
-    case RADIO:
     case FILE:
-    case SUBMIT:
+    case HIDDEN:
     case IMAGE:
-    case RESET:
-    case BUTTON:
     case ISINDEX:
+    case PASSWORD:
+    case RADIO:
+    case RESET:
+    case SUBMIT:
         break;
     }
     return 0;
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 0e2da32..8f00aeb 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -34,13 +34,14 @@ class FileList;
 class HTMLDataListElement;
 class HTMLImageLoader;
 class HTMLOptionElement;
+class ISODateTime;
 class KURL;
 class VisibleSelection;
 
 class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
-        TEXT,
+        TEXT = 0, // TEXT must be 0.
         PASSWORD,
         ISINDEX,
         CHECKBOX,
@@ -57,9 +58,17 @@ public:
         NUMBER,
         TELEPHONE,
         URL,
-        COLOR
+        COLOR,
+        DATE,
+        DATETIME,
+        DATETIMELOCAL,
+        MONTH,
+        TIME,
+        WEEK,
+        // If you add new types or change the order of enum values, update numberOfTypes below.
     };
-    
+    static const int numberOfTypes = WEEK + 1;
+
     enum AutoCompleteSetting {
         Uninitialized,
         On,
@@ -97,15 +106,25 @@ public:
     // For ValidityState
     bool rangeUnderflow() const;
     bool rangeOverflow() const;
-    // Returns the minimum value for type=range.  Don't call this for other types.
-    double rangeMinimum() const;
-    // Returns the maximum value for type=range.  Don't call this for other types.
-    // This always returns a value which is <= rangeMinimum().
-    double rangeMaximum() const;
+    // Returns the minimum value for type=number or range.  Don't call this for other types.
+    double minimum() const;
+    // Returns the maximum value for type=number or range.  Don't call this for other types.
+    // This always returns a value which is >= minimum().
+    double maximum() const;
+    // Sets the "allowed value step" defined in the HTML spec to the specified double pointer.
+    // Returns false if there is no "allowed value step."
+    bool getAllowedValueStep(double*) const;
+    // For ValidityState.
+    bool stepMismatch() const;
+    // Implementations of HTMLInputElement::stepUp() and stepDown().
+    void stepUp(int, ExceptionCode&);
+    void stepDown(int, ExceptionCode&);
+    void stepUp(ExceptionCode& ec) { stepUp(1, ec); }
+    void stepDown(ExceptionCode& ec) { stepDown(1, ec); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
+    virtual bool isTextField() const;
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -119,7 +138,8 @@ public:
     void setType(const String&);
 
     virtual String value() const;
-    virtual void setValue(const String&);
+    virtual void setValue(const String&, bool sendChangeEvent = false);
+    virtual void setValueForUser(const String&);
 
     virtual String placeholder() const;
     virtual void setPlaceholder(const String&);
@@ -234,6 +254,13 @@ public:
     // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
     // The double* parameter may be 0.
     static bool formStringToDouble(const String&, double*);
+    // Converts the specified number to a string. This is an implementation of
+    // HTML5's "algorithm to convert a number to a string" for NUMBER/RANGE types.
+    static String formStringFromDouble(double);
+    // Parses the specified string as the InputType, and returns true if it is successfully parsed.
+    // An instance pointed by the ISODateTime* parameter will have parsed values and be
+    // modified even if the parsing fails.  The ISODateTime* parameter may be 0.
+    static bool formStringToISODateTime(InputType, const String&, ISODateTime*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
@@ -257,6 +284,12 @@ private:
     virtual bool isRequiredFormControl() const;
 
     PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
+    // Helper for getAllowedValueStep();
+    bool getStepParameters(double* defaultStep, double* stepScaleFactor) const;
+    // Helper for stepUp()/stepDown().  Adds step value * count to the current number/range value.
+    void applyStepForNumberOrRange(double count, ExceptionCode&);
+    // Helper for applyStepForNumberOrRange().
+    double stepBase() const;
 
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index 59248f4..2ac6674 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -43,16 +43,16 @@ module html {
         readonly attribute HTMLElement     list;
 #endif
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString max;
+                 attribute [ConvertNullToNullString, Reflect] DOMString max;
 #endif
                  attribute long            maxLength
                      setter raises(DOMException);
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
-                 attribute [Reflect] DOMString min;
+                 attribute [ConvertNullToNullString, Reflect] DOMString min;
 #endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
-                 attribute [Reflect] DOMString       pattern;
+                 attribute [ConvertNullToNullString, Reflect] DOMString pattern;
                  attribute DOMString       placeholder;
                  attribute boolean         readOnly;
                  attribute boolean         required;
@@ -63,18 +63,30 @@ module html {
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString step;
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
 #if defined(ENABLE_DATALIST) && ENABLE_DATALIST
         readonly attribute HTMLOptionElement selectedOption;
 #endif
+
+        void               stepUp(in [Optional] long n)
+            raises(DOMException);
+        void               stepDown(in [Optional] long n)
+            raises(DOMException);
+
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
-        
+
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
+        void               setValueForUser(in [ConvertNullToNullString] DOMString value);
+#endif
+
         // WinIE extension:
                  attribute boolean         indeterminate;
 
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 47bcca8..ab06544 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -218,7 +218,7 @@ void HTMLLinkElement::process()
 
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
-    if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
+    if (m_disabledState != 2 && (m_isStyleSheet || (acceptIfTypeContainsTextCSS && type.contains("text/css"))) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
         
         String charset = getAttribute(charsetAttr);
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 729aceb..30f762a 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -117,6 +117,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
     , m_isFullscreen(false)
+    , m_closedCaptionsVisible(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -213,6 +214,10 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attr));
     else if (attrName == onwaitingAttr)
         setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitbeginfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitbeginfullscreenEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwebkitendfullscreenAttr)
+        setAttributeEventListener(eventNames().webkitendfullscreenEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -292,24 +297,6 @@ void HTMLMediaElement::scheduleNextSourceChild()
     m_loadTimer.startOneShot(0);
 }
 
-void HTMLMediaElement::scheduleProgressEvent(const AtomicString& eventName)
-{
-    if (!m_sendProgressEvents)
-        return;
-
-    // FIXME: don't schedule timeupdate or progress events unless there are registered listeners
-
-    bool totalKnown = m_player && m_player->totalBytesKnown();
-    unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
-    unsigned total = m_player ? m_player->totalBytes() : 0;
-
-    RefPtr<ProgressEvent> evt = ProgressEvent::create(eventName, totalKnown, loaded, total);
-    enqueueEvent(evt);
-
-    if (renderer())
-        renderer()->updateFromElement();
-}
-
 void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
     enqueueEvent(Event::create(eventName, false, true));
@@ -478,6 +465,7 @@ void HTMLMediaElement::loadInternal()
     m_autoplaying = true;
     m_playedTimeRanges = TimeRanges::create();
     m_lastSeekTime = 0;
+    m_closedCaptionsVisible = false;
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
@@ -523,7 +511,7 @@ void HTMLMediaElement::selectMediaResource()
     m_networkState = NETWORK_LOADING;
 
     // 5
-    scheduleProgressEvent(eventNames().loadstartEvent);
+    scheduleEvent(eventNames().loadstartEvent);
 
     // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
@@ -582,11 +570,10 @@ void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& content
         startProgressEventTimer();
 
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-    m_player.clear();
-    m_player.set(new MediaPlayer(this));
+    m_player = MediaPlayer::create(this);
 #else
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
 #endif
 
     m_player->setPreservesPitch(m_webkitPreservesPitch);
@@ -647,7 +634,7 @@ void HTMLMediaElement::noneSupported()
     // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
@@ -672,7 +659,7 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
 
     // 3 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().errorEvent);
+    scheduleEvent(eventNames().errorEvent);
 
     // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
@@ -739,7 +726,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
     if (state == MediaPlayer::Idle) {
         if (m_networkState > NETWORK_IDLE) {
             stopPeriodicTimers();
-            scheduleProgressEvent(eventNames().suspendEvent);
+            scheduleEvent(eventNames().suspendEvent);
         }
         m_networkState = NETWORK_IDLE;
     }
@@ -759,7 +746,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
 
             // Schedule one last progress event so we guarantee that at least one is fired
             // for files that load very quickly.
-            scheduleProgressEvent(eventNames().progressEvent);
+            scheduleEvent(eventNames().progressEvent);
 
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
@@ -768,7 +755,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleEvent(eventNames().loadEvent);
         }
     }
 }
@@ -885,14 +872,16 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 
     if (progress == m_previousProgress) {
         if (timedelta > 3.0 && !m_sentStalledEvent) {
-            scheduleProgressEvent(eventNames().stalledEvent);
+            scheduleEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
         }
     } else {
-        scheduleProgressEvent(eventNames().progressEvent);
+        scheduleEvent(eventNames().progressEvent);
         m_previousProgress = progress;
         m_previousProgressTime = time;
         m_sentStalledEvent = false;
+        if (renderer())
+            renderer()->updateFromElement();
     }
 }
 
@@ -1652,7 +1641,7 @@ void HTMLMediaElement::userCancelledLoad()
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().abortEvent);
+    scheduleEvent(eventNames().abortEvent);
 
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
@@ -1784,7 +1773,7 @@ void HTMLMediaElement::finishParsingChildren()
 {
     HTMLElement::finishParsingChildren();
     if (!m_player)
-        m_player.set(new MediaPlayer(this));
+        m_player = MediaPlayer::create(this);
     
     document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer())
@@ -1796,25 +1785,96 @@ void HTMLMediaElement::finishParsingChildren()
 void HTMLMediaElement::enterFullscreen()
 {
     ASSERT(!m_isFullscreen);
-    if (!renderer())
-        return;
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->enterFullscreenForNode(this);
-    m_isFullscreen = true;
+        scheduleEvent(eventNames().webkitbeginfullscreenEvent);
+        m_isFullscreen = true;
+    }
 }
 
 void HTMLMediaElement::exitFullscreen()
 {
     ASSERT(m_isFullscreen);
-    if (document() && document()->page())
+    if (document() && document()->page()) {
         document()->page()->chrome()->client()->exitFullscreenForNode(this);
+        scheduleEvent(eventNames().webkitendfullscreenEvent);
+    }
     m_isFullscreen = false;
 }
 
 PlatformMedia HTMLMediaElement::platformMedia() const
 {
     return m_player ? m_player->platformMedia() : NoPlatformMedia;
-}        
+}
+
+void HTMLMediaElement::webkitEnterFullScreen(ExceptionCode& ec)
+{
+    if (m_isFullscreen)
+        return;
+
+    // Generate an exception if this isn't called in response to a user gesture, or if the 
+    // element does not support fullscreen.
+    if (!processingUserGesture() || !supportsFullscreen()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    enterFullscreen();
+}
+
+void HTMLMediaElement::webkitExitFullScreen()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+}
+
+bool HTMLMediaElement::webkitSupportsFullscreen()
+{
+    return supportsFullscreen();
+}
+
+bool HTMLMediaElement::webkitDisplayingFullscreen()
+{
+    return m_isFullscreen;
+}
+
+bool HTMLMediaElement::hasClosedCaptions() const
+{
+    return m_player && m_player->hasClosedCaptions();
+}
+
+bool HTMLMediaElement::closedCaptionsVisible() const
+{
+    return m_closedCaptionsVisible;
+}
+
+void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
+{
+    if (!m_player ||!hasClosedCaptions())
+        return;
+
+    m_closedCaptionsVisible = closedCaptionVisible;
+    m_player->setClosedCaptionsVisible(closedCaptionVisible);
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLMediaElement::setWebkitClosedCaptionsVisible(bool visible)
+{
+    setClosedCaptionsVisible(visible);
+}
+
+bool HTMLMediaElement::webkitClosedCaptionsVisible() const
+{
+    return closedCaptionsVisible();
+}
+
+
+bool HTMLMediaElement::webkitHasClosedCaptions() const
+{
+    return hasClosedCaptions();
+}
+
 }
 
 #endif
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index 405f013..bc39dd7 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -131,7 +131,18 @@ public:
     void setLoop(bool b);
     void play();
     void pause();
-    
+
+// fullscreen
+    void webkitEnterFullScreen(ExceptionCode&);
+    void webkitExitFullScreen();
+    bool webkitSupportsFullscreen();
+    bool webkitDisplayingFullscreen();
+
+// captions
+    bool webkitHasClosedCaptions() const;
+    bool webkitClosedCaptionsVisible() const;
+    void setWebkitClosedCaptionsVisible(bool);
+
 // controls
     bool controls() const;
     void setControls(bool);
@@ -162,6 +173,10 @@ public:
     void enterFullscreen();
     void exitFullscreen();
 
+    bool hasClosedCaptions() const;
+    bool closedCaptionsVisible() const;
+    void setClosedCaptionsVisible(bool);
+
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
     void setTimeOffsetAttribute(const QualifiedName&, float value);
@@ -203,7 +218,6 @@ private:
     void addPlayedRange(float start, float end);
     
     void scheduleTimeupdateEvent(bool periodicEvent);
-    void scheduleProgressEvent(const AtomicString& eventName);
     void scheduleEvent(const AtomicString& eventName);
     void enqueueEvent(RefPtr<Event> event);
     
@@ -319,6 +333,7 @@ protected:
     bool m_sendProgressEvents : 1;
 
     bool m_isFullscreen : 1;
+    bool m_closedCaptionsVisible : 1;
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
diff --git a/WebCore/html/HTMLMediaElement.idl b/WebCore/html/HTMLMediaElement.idl
index 7278fa6..e418a63 100644
--- a/WebCore/html/HTMLMediaElement.idl
+++ b/WebCore/html/HTMLMediaElement.idl
@@ -77,7 +77,17 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
         setter raises (DOMException);
     attribute boolean muted;
     
-    // WebKit extension
+    // WebKit extensions
     attribute boolean webkitPreservesPitch;
+
+    readonly attribute boolean webkitSupportsFullscreen;
+    readonly attribute boolean webkitDisplayingFullscreen;
+
+    void webkitEnterFullScreen()
+        raises (DOMException);
+    void webkitExitFullScreen();
+
+    readonly attribute boolean webkitHasClosedCaptions;
+    attribute boolean webkitClosedCaptionsVisible;
 };
 }
diff --git a/WebCore/html/HTMLMetaElement.h b/WebCore/html/HTMLMetaElement.h
index d86df2e..19e8ecd 100644
--- a/WebCore/html/HTMLMetaElement.h
+++ b/WebCore/html/HTMLMetaElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLModElement.cpp b/WebCore/html/HTMLModElement.cpp
index b48182a..19b3403 100644
--- a/WebCore/html/HTMLModElement.cpp
+++ b/WebCore/html/HTMLModElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLModElement.h b/WebCore/html/HTMLModElement.h
index 83697f9..9d9e6c1 100644
--- a/WebCore/html/HTMLModElement.h
+++ b/WebCore/html/HTMLModElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
diff --git a/WebCore/html/HTMLOptionsCollection.cpp b/WebCore/html/HTMLOptionsCollection.cpp
index 0b88183..db9a457 100644
--- a/WebCore/html/HTMLOptionsCollection.cpp
+++ b/WebCore/html/HTMLOptionsCollection.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 1cb47ae..f13c19b 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -203,6 +203,25 @@ void HTMLParser::setCurrent(Node* newCurrent)
     m_didRefCurrent = didRefNewCurrent;
 }
 
+inline static int tagPriorityOfNode(Node* n)
+{
+    return n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
+}
+
+inline void HTMLParser::limitBlockDepth(int tagPriority)
+{
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+}
+
+inline bool HTMLParser::insertNodeAfterLimitBlockDepth(Node* n, bool flat)
+{
+    limitBlockDepth(tagPriorityOfNode(n));
+    return insertNode(n, flat);
+}
+
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 {
     if (!m_skipModeTag.isNull()) {
@@ -241,7 +260,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         while (charsLeft) {
             // split large blocks of text to nodes of manageable size
             n = Text::createWithLengthLimit(m_document, text, charsLeft);
-            if (!insertNode(n.get(), t->selfClosingTag))
+            if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag))
                 return 0;
         }
         return n;
@@ -271,7 +290,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         }
     }
 
-    if (!insertNode(n.get(), t->selfClosingTag)) {
+    if (!insertNodeAfterLimitBlockDepth(n.get(), t->selfClosingTag)) {
         // we couldn't insert the node
 
         if (n->isElementNode()) {
@@ -329,21 +348,17 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     RefPtr<Node> protectNode(n);
 
     const AtomicString& localName = n->localName();
-    int tagPriority = n->isHTMLElement() ? static_cast<HTMLElement*>(n)->tagPriority() : 0;
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
     // and close up the first table, and then start the second table as a sibling.
     if (m_inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
 
-    if (tagPriority >= minBlockLevelTagPriority) {
-        while (m_blocksInStack >= cMaxBlockDepth)
-            popBlock(m_blockStack->tagName);
-    }
-
     if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
         return false;
 
+    int tagPriority = tagPriorityOfNode(n);
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
     Node* newNode = m_current->addChild(n);
diff --git a/WebCore/html/HTMLParser.h b/WebCore/html/HTMLParser.h
index 0945826..f07b64b 100644
--- a/WebCore/html/HTMLParser.h
+++ b/WebCore/html/HTMLParser.h
@@ -111,6 +111,9 @@ private:
 
     void processCloseTag(Token*);
 
+    void limitBlockDepth(int tagPriority);
+
+    bool insertNodeAfterLimitBlockDepth(Node*, bool flat = false);
     bool insertNode(Node*, bool flat = false);
     bool handleError(Node*, bool flat, const AtomicString& localName, int tagPriority);
     
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 2f429b4..9626c83 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
diff --git a/WebCore/html/HTMLPreElement.cpp b/WebCore/html/HTMLPreElement.cpp
index f340ae3..030660f 100644
--- a/WebCore/html/HTMLPreElement.cpp
+++ b/WebCore/html/HTMLPreElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLPreElement.h b/WebCore/html/HTMLPreElement.h
index 691daf8..e84f4b3 100644
--- a/WebCore/html/HTMLPreElement.h
+++ b/WebCore/html/HTMLPreElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index 53fe848..ae47896 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -45,6 +45,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/WebCore/html/HTMLTableCellElement.cpp b/WebCore/html/HTMLTableCellElement.cpp
index f3b4674..94bf82e 100644
--- a/WebCore/html/HTMLTableCellElement.cpp
+++ b/WebCore/html/HTMLTableCellElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableCellElement.h b/WebCore/html/HTMLTableCellElement.h
index fc74cae..9cb7cf5 100644
--- a/WebCore/html/HTMLTableCellElement.h
+++ b/WebCore/html/HTMLTableCellElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableColElement.cpp b/WebCore/html/HTMLTableColElement.cpp
index e1008d1..27ff6f7 100644
--- a/WebCore/html/HTMLTableColElement.cpp
+++ b/WebCore/html/HTMLTableColElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTableColElement.h b/WebCore/html/HTMLTableColElement.h
index 83a26aa..af785f3 100644
--- a/WebCore/html/HTMLTableColElement.h
+++ b/WebCore/html/HTMLTableColElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTablePartElement.cpp b/WebCore/html/HTMLTablePartElement.cpp
index 0f9a3e8..f060dce 100644
--- a/WebCore/html/HTMLTablePartElement.cpp
+++ b/WebCore/html/HTMLTablePartElement.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTablePartElement.h b/WebCore/html/HTMLTablePartElement.h
index adbd63b..1fd5218 100644
--- a/WebCore/html/HTMLTablePartElement.h
+++ b/WebCore/html/HTMLTablePartElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/html/HTMLTextAreaElement.idl b/WebCore/html/HTMLTextAreaElement.idl
index db5154e..107a1fe 100644
--- a/WebCore/html/HTMLTextAreaElement.idl
+++ b/WebCore/html/HTMLTextAreaElement.idl
@@ -48,6 +48,7 @@ module html {
         void     select();
 
         readonly attribute boolean         willValidate;
+        readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
diff --git a/WebCore/html/HTMLTitleElement.h b/WebCore/html/HTMLTitleElement.h
index 5335d8d..677bffd 100644
--- a/WebCore/html/HTMLTitleElement.h
+++ b/WebCore/html/HTMLTitleElement.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index c38a9be..3ca6958 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -564,12 +564,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
         return state;
     m_executingScript++;
     
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willEvaluateScriptTag(sourceCode.url().isNull() ? String() : sourceCode.url().string(), sourceCode.startLine());
-#endif
-    
     SegmentedString* savedPrependingSrc = m_currentPrependingSrc;
     SegmentedString prependingSrc;
     m_currentPrependingSrc = &prependingSrc;
@@ -627,11 +621,6 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 
     m_currentPrependingSrc = savedPrependingSrc;
     
-#if ENABLE(INSPECTOR)
-    if (timelineAgent)
-        timelineAgent->didEvaluateScriptTag();
-#endif
-    
     return state;
 }
 
@@ -1692,8 +1681,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 #endif
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
         timelineAgent->willWriteHTML();
 #endif
   
@@ -1819,7 +1807,7 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 #endif
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent())
         timelineAgent->didWriteHTML();
 #endif
 
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index 5bbc167..d0b1042 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -35,6 +35,7 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
+#include "Page.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
@@ -119,9 +120,10 @@ bool HTMLVideoElement::supportsFullscreen() const
     if (!page) 
         return false;
 
-    if (!m_player || !m_player->supportsFullscreen())
+    if (!m_player || !m_player->supportsFullscreen() || !m_player->hasVideo())
         return false;
-    
+
+    // Check with the platform client.
     return page->chrome()->client()->supportsFullscreenForNode(this);
 }
 
diff --git a/WebCore/html/ISODateTime.cpp b/WebCore/html/ISODateTime.cpp
new file mode 100644
index 0000000..4c28ac0
--- /dev/null
+++ b/WebCore/html/ISODateTime.cpp
@@ -0,0 +1,435 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ISODateTime.h"
+
+#include <limits.h>
+#include <wtf/ASCIICType.h>
+
+namespace WebCore {
+
+// The oldest day of Gregorian Calendar is 1582-10-15. We don't support dates older than it.
+static const int gregorianStartYear = 1582;
+static const int gregorianStartMonth = 9; // This is October, since months are 0 based.
+static const int gregorianStartDay = 15;
+
+static const int daysInMonth[12] = {31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
+
+static bool isLeapYear(int year)
+{
+    if (year % 4)
+        return false;
+    if (!(year % 400))
+        return true;
+    if (!(year % 100))
+        return false;
+    return true;
+}
+
+// `month' is 0-based.
+static int maxDayOfMonth(int year, int month)
+{
+    if (month != 1) // February?
+        return daysInMonth[month];
+    return isLeapYear(year) ? 29 : 28;
+}
+
+// `month' is 0-based.
+static int dayOfWeek(int year, int month, int day)
+{
+    int shiftedMonth = month + 2;
+    // 2:January, 3:Feburuary, 4:March, ...
+
+    // Zeller's congruence
+    if (shiftedMonth <= 3) {
+        shiftedMonth += 12;
+        year--;
+    }
+    // 4:March, ..., 14:January, 15:February
+
+    int highYear = year / 100;
+    int lowYear = year % 100;
+    // We add 6 to make the result Sunday-origin.
+    int result = (day + 13 * shiftedMonth / 5 + lowYear + lowYear / 4 + highYear / 4 + 5 * highYear + 6) % 7;
+    return result;
+}
+
+int ISODateTime::maxWeekNumberInYear() const
+{
+    int day = dayOfWeek(m_year, 0, 1); // January 1.
+    return day == Thursday || (day == Wednesday && isLeapYear(m_year)) ? 53 : 52;
+}
+
+static unsigned countDigits(const UChar* src, unsigned length, unsigned start)
+{
+    unsigned index = start;
+    for (; index < length; ++index) {
+        if (!isASCIIDigit(src[index]))
+            break;
+    }
+    return index - start;
+}
+
+// Very strict integer parser. Do not allow leading or trailing whitespace unlike charactersToIntStrict().
+static bool toInt(const UChar* src, unsigned length, unsigned parseStart, unsigned parseLength, int& out)
+{
+    if (parseStart + parseLength > length || parseLength <= 0)
+        return false;
+    int value = 0;
+    const UChar* current = src + parseStart;
+    const UChar* end = current + parseLength;
+
+    // We don't need to handle negative numbers for ISO 8601.
+    for (; current < end; ++current) {
+        if (!isASCIIDigit(*current))
+            return false;
+        int digit = *current - '0';
+        if (value > (INT_MAX - digit) / 10) // Check for overflow.
+            return false;
+        value = value * 10 + digit;
+    }
+    out = value;
+    return true;
+}
+
+bool ISODateTime::parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    unsigned digitsLength = countDigits(src, length, start);
+    // Needs at least 4 digits according to the standard.
+    if (digitsLength < 4)
+        return false;
+    int year;
+    if (!toInt(src, length, start, digitsLength, year))
+        return false;
+    // No support for years before Gregorian calendar.
+    if (year < gregorianStartYear)
+        return false;
+    m_year = year;
+    end = start + digitsLength;
+    return true;
+}
+
+bool ISODateTime::addDay(int dayDiff)
+{
+    ASSERT(m_monthDay);
+
+    int day = m_monthDay + dayDiff;
+    if (day > maxDayOfMonth(m_year, m_month)) {
+        day = m_monthDay;
+        int year = m_year;
+        int month = m_month;
+        int maxDay = maxDayOfMonth(year, month);
+        for (; dayDiff > 0; --dayDiff) {
+            ++day;
+            if (day > maxDay) {
+                day = 1;
+                ++month;
+                if (month >= 12) { // month is 0-origin.
+                    month = 0;
+                    ++year;
+                    if (year < 0) // Check for overflow.
+                        return false;
+                }
+                maxDay = maxDayOfMonth(year, month);
+            }
+        }
+        m_year = year;
+        m_month = month;
+    } else if (day < 1) {
+        int month = m_month;
+        int year = m_year;
+        day = m_monthDay;
+        for (; dayDiff < 0; ++dayDiff) {
+            --day;
+            if (day < 1) {
+                --month;
+                if (month < 0) {
+                    month = 11;
+                    --year;
+                }
+                day = maxDayOfMonth(year, month);
+            }
+            if (year < gregorianStartYear
+                    || (year == gregorianStartYear && month < gregorianStartMonth)
+                    || (year == gregorianStartYear && month == gregorianStartMonth && day < gregorianStartDay))
+                return false;
+        }
+        m_year = year;
+        m_month = month;
+    }
+    m_monthDay = day;
+    return true;
+}
+
+bool ISODateTime::addMinute(int minute)
+{
+    int carry;
+    // min can be negative or greater than 59.
+    minute += m_minute;
+    if (minute > 59) {
+        carry = minute / 60;
+        minute = minute % 60;
+    } else if (m_minute < 0) {
+        carry = (59 - m_minute) / 60;
+        minute += carry * 60;
+        carry = -carry;
+        ASSERT(minute >= 0 && minute <= 59);
+    } else {
+        m_minute = minute;
+        return true;
+    }
+
+    int hour = m_hour + carry;
+    if (hour > 23) {
+        carry = hour / 24;
+        hour = hour % 24;
+    } else if (hour < 0) {
+        carry = (23 - hour) / 24;
+        hour += carry * 24;
+        carry = -carry;
+        ASSERT(hour >= 0 && hour <= 23);
+    } else {
+        m_minute = minute;
+        m_hour = hour;
+        return true;
+    }
+    if (!addDay(carry))
+        return false;
+    m_minute = minute;
+    m_hour = hour;
+    return true;
+}
+
+// Parses a timezone part, and adjust year, month, monthDay, hour, minute, second, millisecond.
+bool ISODateTime::parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    if (start >= length)
+        return false;
+    unsigned index = start;
+    if (src[index] == 'Z') {
+        end = index + 1;
+        return true;
+    }
+
+    bool minus;
+    if (src[index] == '+')
+        minus = false;
+    else if (src[index] == '-')
+        minus = true;
+    else
+        return false;
+    ++index;
+
+    int hour;
+    int minute;
+    if (!toInt(src, length, index, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    index += 2;
+
+    if (index >= length || src[index] != ':')
+        return false;
+    ++index;
+
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    if (minus) {
+        hour = -hour;
+        minute = -minute;
+    }
+
+    // Subtract the timezone offset.
+    if (!addMinute(-(hour * 60 + minute)))
+        return false;
+    end = index;
+    return true;
+}
+
+bool ISODateTime::parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+    if (index >= length || src[index] != '-')
+        return false;
+    ++index;
+
+    int month;
+    if (!toInt(src, length, index, 2, month) || month < 1 || month > 12)
+        return false;
+    --month;
+    // No support for months before Gregorian calendar.
+    if (m_year == gregorianStartYear && month < gregorianStartMonth)
+        return false;
+    m_month = month;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseMonth(src, length, start, index))
+        return false;
+    // '-' and 2-digits are needed.
+    if (index + 2 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+
+    int day;
+    if (!toInt(src, length, index, 2, day) || day < 1 || day > maxDayOfMonth(m_year, m_month))
+        return false;
+    // No support for dates before Gregorian calendar.
+    if (m_year == gregorianStartYear && m_month == gregorianStartMonth && day < gregorianStartDay)
+        return false;
+    m_monthDay = day;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseYear(src, length, start, index))
+        return false;
+
+    // 4 characters ('-' 'W' digit digit) are needed.
+    if (index + 3 >= length)
+        return false;
+    if (src[index] != '-')
+        return false;
+    ++index;
+    if (src[index] != 'W')
+        return false;
+    ++index;
+
+    int week;
+    if (!toInt(src, length, index, 2, week) || week < 1 || week > maxWeekNumberInYear())
+        return false;
+    // No support for years older than or equals to Gregorian calendar start year.
+    if (m_year <= gregorianStartYear)
+        return false;
+    m_week = week;
+    end = index + 2;
+    return true;
+}
+
+bool ISODateTime::parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    int hour;
+    if (!toInt(src, length, start, 2, hour) || hour < 0 || hour > 23)
+        return false;
+    unsigned index = start + 2;
+    if (index >= length)
+        return false;
+    if (src[index] != ':')
+        return false;
+    ++index;
+
+    int minute;
+    if (!toInt(src, length, index, 2, minute) || minute < 0 || minute > 59)
+        return false;
+    index += 2;
+
+    int second = 0;
+    int millisecond = 0;
+    // Optional second part.
+    // Do not return with false because the part is optional.
+    if (index + 2 < length && src[index] == ':') {
+        if (toInt(src, length, index + 1, 2, second) && second >= 0 && second <= 59) {
+            index += 3;
+
+            // Optional fractional second part.
+            if (index < length && src[index] == '.') {
+                unsigned digitsLength = countDigits(src, length, index + 1);
+                if (digitsLength >  0) {
+                    ++index;
+                    bool ok;
+                    if (digitsLength == 1) {
+                        ok = toInt(src, length, index, 1, millisecond);
+                        millisecond *= 100;
+                    } else if (digitsLength == 2) {
+                        ok = toInt(src, length, index, 2, millisecond);
+                        millisecond *= 10;
+                    } else // digitsLength >= 3
+                        ok = toInt(src, length, index, 3, millisecond);
+                    ASSERT(ok);
+                    index += digitsLength;
+                }
+            }
+        }
+    }
+    m_hour = hour;
+    m_minute = minute;
+    m_second = second;
+    m_millisecond = millisecond;
+    end = index;
+    return true;
+}
+
+bool ISODateTime::parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    return parseTime(src, length, index, end);
+}
+
+bool ISODateTime::parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end)
+{
+    ASSERT(src);
+    unsigned index;
+    if (!parseDate(src, length, start, index))
+        return false;
+    if (index >= length)
+        return false;
+    if (src[index] != 'T')
+        return false;
+    ++index;
+    if (!parseTime(src, length, index, index))
+        return false;
+    return parseTimeZone(src, length, index, end);
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/ISODateTime.h b/WebCore/html/ISODateTime.h
new file mode 100644
index 0000000..ee4cfb9
--- /dev/null
+++ b/WebCore/html/ISODateTime.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ISODateTime_h
+#define ISODateTime_h
+
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+// An ISODateTime instance represents one of the following date and time combinations:
+// * year-month
+// * year-month-day
+// * year-week
+// * hour-minute-second-millisecond
+// * year-month-day hour-minute-second-millisecond
+class ISODateTime {
+public:
+    ISODateTime()
+        : m_millisecond(0)
+        , m_second(0)
+        , m_minute(0)
+        , m_hour(0)
+        , m_monthDay(0)
+        , m_month(0)
+        , m_year(0)
+        , m_week(0)
+    {
+    }
+
+    int millisecond() const { return m_millisecond; }
+    int second() const { return m_second; }
+    int minute() const { return m_minute; }
+    int hour() const { return m_hour; }
+    int monthDay() const { return m_monthDay; }
+    int month() const { return m_month; }
+    int fullYear() const { return m_year; }
+    int week() const { return m_week; }
+
+    // The following six functions parse the input `src' whose length is
+    // `length', and updates some fields of this instance. The parsing starts at
+    // src[start] and examines characters before src[length].
+    // `src' `date' must be non-null. The `src' string doesn't need to be
+    // null-terminated.
+    // The functions return true if the parsing succeeds, and set `end' to the
+    // next index after the last consumed. Extra leading characters cause parse
+    // failures, and the trailing extra characters don't cause parse failures.
+
+    // Sets year and month.
+    bool parseMonth(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month and monthDay.
+    bool parseDate(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year and week.
+    bool parseWeek(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets hour, minute, second and millisecond.
+    bool parseTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond.
+    bool parseDateTimeLocal(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    // Sets year, month, monthDay, hour, minute, second and millisecond, and adjusts timezone.
+    bool parseDateTime(const UChar* src, unsigned length, unsigned start, unsigned& end);
+
+private:
+    // Returns the maximum week number in this ISODateTime's year.
+    // The result is either of 52 and 53.
+    int maxWeekNumberInYear() const;
+    bool parseYear(const UChar* src, unsigned length, unsigned start, unsigned& end);
+    bool addDay(int);
+    bool addMinute(int);
+    bool parseTimeZone(const UChar* src, unsigned length, unsigned start, unsigned& end);
+
+    // m_weekDay values
+    enum {
+        Sunday = 0,
+        Monday,
+        Tuesday,
+        Wednesday,
+        Thursday,
+        Friday,
+        Saturday,
+    };
+
+    int m_millisecond;  // 0 - 999
+    int m_second;
+    int m_minute;
+    int m_hour;
+    int m_monthDay;  // 1 - 31
+    int m_month;  // 0:January - 11:December
+    int m_year;  //  1582 -
+    int m_week;  // 1 - 53
+};
+
+
+} // namespace WebCore
+
+#endif // ISODateTime_h
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index 6b0a0b4..e7df225 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -26,6 +26,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "LocalizedStrings.h"
 #include "RegularExpression.h"
 #include <wtf/StdLibExtras.h>
 
@@ -43,6 +44,31 @@ ValidityState::ValidityState(HTMLFormControlElement* parent)
     ASSERT(parent);
 }
 
+String ValidityState::validationMessage()
+{
+    if (!control()->willValidate())
+        return String();
+
+    if (customError())
+        return m_customErrorMessage;
+    if (valueMissing())
+        return validationMessageValueMissingText();
+    if (typeMismatch())
+        return validationMessageTypeMismatchText();
+    if (patternMismatch())
+        return validationMessagePatternMismatchText();
+    if (tooLong())
+        return validationMessageTooLongText();
+    if (rangeUnderflow())
+        return validationMessageRangeUnderflowText();
+    if (rangeOverflow())
+        return validationMessageRangeOverflowText();
+    if (stepMismatch())
+        return validationMessageStepMismatchText();
+
+    return String();
+}
+
 bool ValidityState::typeMismatch()
 {
     if (!control()->hasTagName(inputTag))
@@ -74,6 +100,13 @@ bool ValidityState::typeMismatch()
 
         return false;
     }
+    case HTMLInputElement::DATE:
+    case HTMLInputElement::DATETIME:
+    case HTMLInputElement::DATETIMELOCAL:
+    case HTMLInputElement::MONTH:
+    case HTMLInputElement::TIME:
+    case HTMLInputElement::WEEK:
+        return !HTMLInputElement::formStringToISODateTime(input->inputType(), value, 0);
     default:
         return false;
     }
@@ -93,6 +126,13 @@ bool ValidityState::rangeOverflow()
     return static_cast<HTMLInputElement*>(control())->rangeOverflow();
 }
 
+bool ValidityState::stepMismatch()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->stepMismatch();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
diff --git a/WebCore/html/ValidityState.h b/WebCore/html/ValidityState.h
index 1dee306..7ae95d7 100644
--- a/WebCore/html/ValidityState.h
+++ b/WebCore/html/ValidityState.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
         HTMLFormControlElement* control() const { return m_control; }
 
+        String validationMessage();
         void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
 
         bool valueMissing() { return control()->valueMissing(); }
@@ -46,7 +47,7 @@ namespace WebCore {
         bool tooLong() { return control()->tooLong(); }
         bool rangeUnderflow();
         bool rangeOverflow();
-        bool stepMismatch() { return false; }
+        bool stepMismatch();
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
 
diff --git a/WebCore/html/canvas/CanvasByteArray.h b/WebCore/html/canvas/CanvasByteArray.h
deleted file mode 100644
index 69cadf7..0000000
--- a/WebCore/html/canvas/CanvasByteArray.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasByteArray_h
-#define CanvasByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasArrayBuffer;
-
-    class CanvasByteArray : public CanvasArray {
-    public:
-        virtual bool isByteArray() const { return true; }
-
-        static PassRefPtr<CanvasByteArray> create(unsigned length);
-        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
-        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        char* data() { return static_cast<char*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<signed char>::min())
-                value = std::numeric_limits<signed char>::min();
-            else if (value > std::numeric_limits<signed char>::max())
-                value = std::numeric_limits<signed char>::max();
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            storage[index] = static_cast<signed char>(value);
-        }
-        
-        bool get(unsigned index, signed char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-
-        signed char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            signed char* storage = static_cast<signed char*>(m_baseAddress);
-            return storage[index];
-        }
-    private:
-        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                        int offset,
-                        unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasByteArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.cpp b/WebCore/html/canvas/CanvasFloatArray.cpp
deleted file mode 100644
index 09561cb..0000000
--- a/WebCore/html/canvas/CanvasFloatArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasFloatArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
-    {
-        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(float)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(float))) > buffer->byteLength())
-                return NULL;
-        }
-        return adoptRef(new CanvasFloatArray(buffer, offset, length));
-    }
-    
-    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasFloatArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasFloatArray::sizeInBytes() const {
-        return length() * sizeof(float);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFloatArray.h b/WebCore/html/canvas/CanvasFloatArray.h
deleted file mode 100644
index d2dc4ff..0000000
--- a/WebCore/html/canvas/CanvasFloatArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasFloatArray_h
-#define CanvasFloatArray_h
-
-#include "CanvasArray.h"
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasFloatArray : public CanvasArray {
-    public:
-        virtual bool isFloatArray() const { return true; }
-
-        static PassRefPtr<CanvasFloatArray> create(unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
-        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        float* data() { return static_cast<float*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            float* storage = static_cast<float*>(m_baseAddress);
-            storage[index] = static_cast<float>(value);
-        }
-        
-        bool get(unsigned index, float& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        float item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            float* storage = static_cast<float*>(m_baseAddress);
-            float result = storage[index];
-            if (isnan(result)) {
-                // Clamp NaN to 0
-                result = 0;
-            }
-            return result;
-        }
-    private:
-        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasFloatArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.cpp b/WebCore/html/canvas/CanvasIntArray.cpp
deleted file mode 100644
index 4716d7b..0000000
--- a/WebCore/html/canvas/CanvasIntArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
-    {
-        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                      int offset,
-                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(int)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(int))) > buffer->byteLength())
-                return NULL;
-        }
-        
-        return adoptRef(new CanvasIntArray(buffer, offset, length));
-    }
-    
-    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasIntArray::sizeInBytes() const {
-        return length() * sizeof(int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasIntArray.h b/WebCore/html/canvas/CanvasIntArray.h
deleted file mode 100644
index 4977034..0000000
--- a/WebCore/html/canvas/CanvasIntArray.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasIntArray_h
-#define CanvasIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasIntArray : public CanvasArray {
-    public:
-        virtual bool isIntArray() const { return true; }
-
-        static PassRefPtr<CanvasIntArray> create(unsigned length);
-        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
-        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        int* data() { return static_cast<int*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<int>::min())
-                value = std::numeric_limits<int>::min();
-            else if (value > std::numeric_limits<int>::max())
-                value = std::numeric_limits<int>::max();
-            int* storage = static_cast<int*>(m_baseAddress);
-            storage[index] = static_cast<int>(value);
-        }
-        
-        bool get(unsigned index, int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            int* storage = static_cast<int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                       int offset,
-                       unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasIntArray_h
diff --git a/WebCore/html/canvas/CanvasObject.cpp b/WebCore/html/canvas/CanvasObject.cpp
index 8a71a45..6c7667b 100644
--- a/WebCore/html/canvas/CanvasObject.cpp
+++ b/WebCore/html/canvas/CanvasObject.cpp
@@ -28,12 +28,13 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasObject.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+CanvasObject::CanvasObject(WebGLRenderingContext* context)
     : m_object(0)
+    , m_shouldDeleteObject(true)
     , m_context(context)
 {
 }
@@ -44,24 +45,27 @@ CanvasObject::~CanvasObject()
         m_context->removeObject(this);
 }
 
-void CanvasObject::setObject(Platform3DObject object)
+void CanvasObject::setObject(Platform3DObject object, bool shouldDeleteObject)
 {
     if (object == m_object)
         return;
         
     deleteObject();
     m_object = object;
+    m_shouldDeleteObject = shouldDeleteObject;
 }
 
 void CanvasObject::deleteObject()
 {
     if (m_object) {
-        if (m_context) {
-            m_context->graphicsContext3D()->makeContextCurrent();
-            _deleteObject(m_object);
-        }
+        if (m_shouldDeleteObject)
+            if (m_context) {
+                m_context->graphicsContext3D()->makeContextCurrent();
+                _deleteObject(m_object);
+            }
         m_object = 0;
     }
+    m_shouldDeleteObject = true;
 }
 
 }
diff --git a/WebCore/html/canvas/CanvasObject.h b/WebCore/html/canvas/CanvasObject.h
index 748278d..b7b016a 100644
--- a/WebCore/html/canvas/CanvasObject.h
+++ b/WebCore/html/canvas/CanvasObject.h
@@ -33,14 +33,14 @@
 
 namespace WebCore {
 
-    class CanvasRenderingContext3D;
+    class WebGLRenderingContext;
     
     class CanvasObject : public RefCounted<CanvasObject> {
     public:
         virtual ~CanvasObject();
         
         Platform3DObject object() const { return m_object; }
-        void setObject(Platform3DObject);
+        void setObject(Platform3DObject, bool shouldDeleteObject = true);
         void deleteObject();
         
         void detachContext()
@@ -49,15 +49,22 @@ namespace WebCore {
             m_context = 0;
         }
 
-        CanvasRenderingContext3D* context() const { return m_context; }
+        WebGLRenderingContext* context() const { return m_context; }
 
     protected:
-        CanvasObject(CanvasRenderingContext3D*);
+        CanvasObject(WebGLRenderingContext*);
         virtual void _deleteObject(Platform3DObject) = 0;
     
     private:
         Platform3DObject m_object;
-        CanvasRenderingContext3D* m_context;
+        // The shouldDeleteObject flag indicates whether this wrapper
+        // owns the underlying resource and should delete it when the
+        // wrapper is unreferenced for the last time and deleted. It
+        // is only set to false for certain objects returned from get
+        // queries. FIXME: should consider canonicalizing all of these
+        // objects in the future.
+        bool m_shouldDeleteObject;
+        WebGLRenderingContext* m_context;
     };
     
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.idl b/WebCore/html/canvas/CanvasRenderbuffer.idl
deleted file mode 100644
index 5e47cc3..0000000
--- a/WebCore/html/canvas/CanvasRenderbuffer.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
-    };
-}
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 3341901..1ae9f75 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -355,6 +355,9 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(sx) | !isfinite(sy))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.scaleNonUniform(sx, sy);
     if (!newTransform.isInvertible()) {
@@ -375,6 +378,9 @@ void CanvasRenderingContext2D::rotate(float angleInRadians)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(angleInRadians))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.rotate(angleInRadians / piDouble * 180.0);
     if (!newTransform.isInvertible()) {
@@ -395,6 +401,9 @@ void CanvasRenderingContext2D::translate(float tx, float ty)
     if (!state().m_invertibleCTM)
         return;
 
+    if (!isfinite(tx) | !isfinite(ty))
+        return;
+
     TransformationMatrix newTransform = state().m_transform;
     newTransform.translate(tx, ty);
     if (!newTransform.isInvertible()) {
@@ -414,8 +423,7 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
     if (!state().m_invertibleCTM)
         return;
-    
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
+
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
@@ -438,7 +446,6 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     if (!c)
         return;
     
-    // HTML5 3.14.11.1 -- ignore any calls that pass non-finite numbers
     if (!isfinite(m11) | !isfinite(m21) | !isfinite(dx) | 
         !isfinite(m12) | !isfinite(m22) | !isfinite(dy))
         return;
@@ -817,7 +824,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, 1.0f);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
@@ -833,7 +840,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = 0; // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(colorWithOverrideAlpha(rgba, alpha)), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
@@ -847,7 +854,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
         return;
 
     RGBA32 rgba = makeRGBA32FromFloats(grayLevel, grayLevel, grayLevel, alpha);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
@@ -863,7 +870,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     RGBA32 rgba = makeRGBA32FromFloats(r, g, b, a); // default is transparent black
     if (!state().m_shadowColor.isEmpty())
         CSSParser::parseColor(rgba, state().m_shadowColor);
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
@@ -883,7 +890,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
 #else
-    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a));
+    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a), DeviceColorSpace);
 #endif
 }
 
@@ -906,7 +913,7 @@ void CanvasRenderingContext2D::applyShadow()
         CSSParser::parseColor(rgba, state().m_shadowColor);
     float width = state().m_shadowOffset.width();
     float height = state().m_shadowOffset.height();
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba));
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, Color(rgba), DeviceColorSpace);
 }
 
 static IntSize size(HTMLImageElement* image)
@@ -995,7 +1002,7 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, float x, float y)
@@ -1045,7 +1052,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
     if (!sourceCanvas->originClean())
         canvas()->setOriginTainted();
 
-    c->drawImage(buffer->image(), destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(buffer->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
     willDraw(destRect); // This call comes after drawImage, since the buffer we draw into may be our own, and we need to make sure it is dirty.
                         // FIXME: Arguably willDraw should become didDraw and occur after drawing calls and not before them to avoid problems like this.
 }
@@ -1139,7 +1146,7 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
 
     FloatRect destRect = FloatRect(dx, dy, dw, dh);
     willDraw(destRect);
-    c->drawImage(cachedImage->image(), destRect, FloatRect(sx, sy, sw, sh), op);
+    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, FloatRect(sx, sy, sw, sh), op);
 }
 
 void CanvasRenderingContext2D::setAlpha(float alpha)
@@ -1526,9 +1533,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
-            maskImageContext->setFillColor(Color::black);
+            maskImageContext->setFillColor(Color::black, DeviceColorSpace);
         else {
-            maskImageContext->setStrokeColor(Color::black);
+            maskImageContext->setStrokeColor(Color::black, DeviceColorSpace);
             maskImageContext->setStrokeThickness(c->strokeThickness());
         }
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
deleted file mode 100644
index 612b4c3..0000000
--- a/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ /dev/null
@@ -1,1441 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasRenderingContext3D.h"
-
-#include "CanvasActiveInfo.h"
-#include "CanvasBuffer.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasTexture.h"
-#include "CanvasShader.h"
-#include "HTMLCanvasElement.h"
-#include "RenderBox.h"
-#include "RenderLayer.h"
-
-namespace WebCore {
-
-PassOwnPtr<CanvasRenderingContext3D> CanvasRenderingContext3D::create(HTMLCanvasElement* canvas)
-{
-    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
-    if (!context)
-        return 0;
-        
-    return new CanvasRenderingContext3D(canvas, context.release());
-}
-
-CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
-    : CanvasRenderingContext(passedCanvas)
-    , m_context(context)
-    , m_needsUpdate(true)
-    , m_markedCanvasDirty(false)
-{
-    ASSERT(m_context);
-    m_context->reshape(canvas()->width(), canvas()->height());
-}
-
-CanvasRenderingContext3D::~CanvasRenderingContext3D()
-{
-    detachAndRemoveAllObjects();
-}
-
-void CanvasRenderingContext3D::markContextChanged()
-{
-#if USE(ACCELERATED_COMPOSITING)
-    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
-        canvas()->renderBox()->layer()->rendererContentChanged();
-    } else {
-#endif
-        if (!m_markedCanvasDirty) {
-            // Make sure the canvas's image buffer is allocated.
-            canvas()->buffer();
-            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
-            m_markedCanvasDirty = true;
-        }
-#if USE(ACCELERATED_COMPOSITING)
-    }
-#endif
-}
-
-void CanvasRenderingContext3D::beginPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_context->beginPaint(this);
-    }
-}
-
-void CanvasRenderingContext3D::endPaint()
-{
-    if (m_markedCanvasDirty) {
-        m_markedCanvasDirty = false;
-        m_context->endPaint();
-    }
-}
-
-void CanvasRenderingContext3D::reshape(int width, int height)
-{
-    if (m_needsUpdate) {
-#if USE(ACCELERATED_COMPOSITING)
-        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
-            canvas()->renderBox()->layer()->rendererContentChanged();
-#endif
-        m_needsUpdate = false;
-    }
-    
-    m_context->reshape(width, height);
-}
-
-int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
-{
-    int result = m_context->sizeInBytes(type);
-    if (result <= 0) {
-        ec = SYNTAX_ERR;
-    }
-    return result;
-}
-
-void CanvasRenderingContext3D::activeTexture(unsigned long texture)
-{
-    m_context->activeTexture(texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-    m_context->attachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
-{
-    if (!program)
-        return;
-    m_context->bindAttribLocation(program, index, name);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
-{
-    m_context->bindBuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
-{
-    m_context->bindFramebuffer(target, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
-{
-    m_context->bindRenderbuffer(target, renderbuffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
-{
-    m_context->bindTexture(target, texture);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
-{
-    m_context->blendColor(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquation( unsigned long mode )
-{
-    m_context->blendEquation(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
-{
-    m_context->blendEquationSeparate(modeRGB, modeAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
-{
-    m_context->blendFunc(sfactor, dfactor);
-    cleanupAfterGraphicsCall(false);
-}       
-
-void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
-{
-    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
-{
-    m_context->bufferData(target, size, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
-{
-    m_context->bufferData(target, data, usage);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
-{
-    m_context->bufferSubData(target, offset, data);
-    cleanupAfterGraphicsCall(false);
-}
-
-unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
-{
-    return m_context->checkFramebufferStatus(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clear(unsigned long mask)
-{
-    m_context->clear(mask);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
-{
-    if (isnan(r))
-        r = 0;
-    if (isnan(g))
-        g = 0;
-    if (isnan(b))
-        b = 0;
-    if (isnan(a))
-        a = 1;
-    m_context->clearColor(r, g, b, a);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearDepth(double depth)
-{
-    m_context->clearDepth(depth);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::clearStencil(long s)
-{
-    m_context->clearStencil(s);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
-{
-    m_context->colorMask(red, green, blue, alpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
-{
-    m_context->compileShader(shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
-{
-    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
-{
-    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-        
-PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
-{
-    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
-{
-    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
-{
-    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
-{
-    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
-    addObject(o.get());
-    return o;
-}
-
-PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
-{
-    // FIXME: Need to include GL_ constants for internal use
-    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
-    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
-    if (type == 0x8B30) // GL_FRAGMENT_SHADER
-        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
-        
-    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
-    addObject(o.get());
-    return o;
-}
-
-void CanvasRenderingContext3D::cullFace(unsigned long mode)
-{
-    m_context->cullFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return;
-    
-    buffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    if (!framebuffer)
-        return;
-    
-    framebuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-    
-    program->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    if (!renderbuffer)
-        return;
-    
-    renderbuffer->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
-{
-    if (!shader)
-        return;
-    
-    shader->deleteObject();
-}
-
-void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
-{
-    if (!texture)
-        return;
-    
-    texture->deleteObject();
-}
-
-void CanvasRenderingContext3D::depthFunc(unsigned long func)
-{
-    m_context->depthFunc(func);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthMask(bool flag)
-{
-    m_context->depthMask(flag);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
-{
-    m_context->depthRange(zNear, zFar);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
-{
-    if (!program || !shader)
-        return;
-
-    m_context->detachShader(program, shader);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::disable(unsigned long cap)
-{
-    m_context->disable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
-{
-    m_context->disableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-
-void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
-{
-    m_context->drawArrays(mode, first, count);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
-{
-    m_context->drawElements(mode, count, type, offset);
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::enable(unsigned long cap)
-{
-    m_context->enable(cap);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
-{
-    m_context->enableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::finish()
-{
-    m_context->finish();
-    cleanupAfterGraphicsCall(true);
-}
-
-
-void CanvasRenderingContext3D::flush()
-{
-    m_context->flush();
-    cleanupAfterGraphicsCall(true);
-}
-
-void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
-{
-    if (!buffer)
-        return;
-        
-    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
-{
-    if (!texture)
-        return;
-        
-    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::frontFace(unsigned long mode)
-{
-    m_context->frontFace(mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::generateMipmap(unsigned long target)
-{
-    m_context->generateMipmap(target);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveAttrib(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
-{
-    ActiveInfo info;
-    if (!program || program->context() != this || !m_context->getActiveUniform(program, index, info)) {
-        ec = INDEX_SIZE_ERR;
-        return 0;
-    }
-    return CanvasActiveInfo::create(info.name, info.type, info.size);
-}
-
-int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getAttribLocation(program, name);
-}
-
-bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
-{
-    bool result = m_context->getBoolean(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
-{
-    RefPtr<CanvasUnsignedByteArray> array = m_context->getBooleanv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getBufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getBufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-unsigned long CanvasRenderingContext3D::getError()
-{
-    return m_context->getError();
-}
-
-float CanvasRenderingContext3D::getFloat(unsigned long pname)
-{
-    float result = m_context->getFloat(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getFloatv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    int result = m_context->getFramebufferAttachmentParameteri(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getFramebufferAttachmentParameteriv(target, attachment, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getInteger(unsigned long pname)
-{
-    float result = m_context->getInteger(pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getIntegerv(pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
-{
-    int result = m_context->getProgrami(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getProgramiv(program, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
-{
-    String s = m_context->getProgramInfoLog(program);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getRenderbufferParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getRenderbufferParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
-{
-    int result = m_context->getShaderi(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getShaderiv(shader, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
-{
-    String s = m_context->getShaderInfoLog(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
-{
-    String s = m_context->getShaderSource(shader);
-    cleanupAfterGraphicsCall(false);
-    return s;
-}
-
-String CanvasRenderingContext3D::getString(unsigned long name)
-{
-    return m_context->getString(name);
-}
-
-float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
-{
-    float result = m_context->getTexParameterf(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getTexParameterfv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
-{
-    int result = m_context->getTexParameteri(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getTexParameteriv(target, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
-{
-    float result = m_context->getUniformf(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getUniformfv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
-{
-    long result = m_context->getUniformi(program, location);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
-{
-    RefPtr<CanvasIntArray> array = m_context->getUniformiv(program, location);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
-{
-    return m_context->getUniformLocation(program, name);
-}
-
-float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
-{
-    float result = m_context->getVertexAttribf(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasFloatArray> array = m_context->getVertexAttribfv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribi(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
-{
-    RefPtr<CanvasIntArray> array = m_context->getVertexAttribiv(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
-{
-    long result = m_context->getVertexAttribOffset(index, pname);
-    cleanupAfterGraphicsCall(false);
-    return result;
-}
-
-void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
-{
-    m_context->hint(target, mode);
-    cleanupAfterGraphicsCall(false);
-}
-
-bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
-{
-    if (!buffer)
-        return false;
-        
-    return m_context->isBuffer(buffer);
-}
-
-bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
-{
-    return m_context->isEnabled(cap);
-}
-
-bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
-{
-    return m_context->isFramebuffer(framebuffer);
-}
-
-bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
-{
-    return m_context->isProgram(program);
-}
-
-bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
-{
-    return m_context->isRenderbuffer(renderbuffer);
-}
-
-bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
-{
-    return m_context->isShader(shader);
-}
-
-bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
-{
-    return m_context->isTexture(texture);
-}
-
-void CanvasRenderingContext3D::lineWidth(double width)
-{
-    m_context->lineWidth((float) width);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
-{
-    if (!program)
-        return;
-        
-    m_context->linkProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
-{
-    m_context->pixelStorei(pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::polygonOffset(double factor, double units)
-{
-    m_context->polygonOffset((float) factor, (float) units);
-    cleanupAfterGraphicsCall(false);
-}
-
-PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
-{
-    RefPtr<CanvasArray> array = m_context->readPixels(x, y, width, height, format, type);
-    cleanupAfterGraphicsCall(false);
-    return array;
-}
-
-void CanvasRenderingContext3D::releaseShaderCompiler()
-{
-    m_context->releaseShaderCompiler();
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
-{
-    m_context->renderbufferStorage(target, internalformat, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
-{
-    m_context->sampleCoverage((float) value, invert);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
-{
-    m_context->scissor(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
-{
-    m_context->shaderSource(shader, string);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFunc(func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
-{
-    m_context->stencilFuncSeparate(face, func, ref, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMask(unsigned long mask)
-{
-    m_context->stencilMask(mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
-{
-    m_context->stencilMaskSeparate(face, mask);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOp(fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
-{
-    m_context->stencilOpSeparate(face, fail, zfail, zpass);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                                          unsigned width, unsigned height, unsigned border,
-                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, internalformat, width, height,
-                         border, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
-{
-    m_context->texParameterf(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
-{
-    m_context->texParameteri(target, pname, param);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height,
-                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLImageElement* image,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                                             unsigned width, unsigned height, HTMLVideoElement* video,
-                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
-{
-    // FIXME: For now we ignore any errors returned
-    ec = 0;
-    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1f(long location, float x)
-{
-    m_context->uniform1f(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1fv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1i(long location, int x)
-{
-    m_context->uniform1i(location, x);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v->data(), v->length());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    m_context->uniform1iv(location, v, size);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
-{
-    m_context->uniform2f(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2fv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
-{
-    m_context->uniform2i(location, x, y);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v->data(), v->length() / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 2
-    m_context->uniform2iv(location, v, size / 2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
-{
-    m_context->uniform3f(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3fv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
-{
-    m_context->uniform3i(location, x, y, z);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v->data(), v->length() / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 3
-    m_context->uniform3iv(location, v, size / 3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
-{
-    m_context->uniform4f(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4fv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
-{
-    m_context->uniform4i(location, x, y, z, w);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniform4iv(location, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 4
-    m_context->uniformMatrix2fv(location, transpose, v, size / 4);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 9
-    m_context->uniformMatrix3fv(location, transpose, v, size / 9);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
-{
-    // FIXME: we need to throw if no array passed in
-    if (!v)
-        return;
-        
-    // FIXME: length needs to be a multiple of 16
-    m_context->uniformMatrix4fv(location, transpose, v, size / 16);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
-{
-    m_context->useProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
-{
-    m_context->validateProgram(program);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
-{
-    m_context->vertexAttrib1f(indx, v0);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib1fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib1fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
-{
-    m_context->vertexAttrib2f(indx, v0, v1);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib2fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib2fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
-{
-    m_context->vertexAttrib3f(indx, v0, v1, v2);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib3fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib3fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
-{
-    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib4fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
-{
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib4fv(indx, v);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
-{
-    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
-{
-    if (isnan(x))
-        x = 0;
-    if (isnan(y))
-        y = 0;
-    if (isnan(width))
-        width = 100;
-    if (isnan(height))
-        height = 100;
-    m_context->viewport(x, y, width, height);
-    cleanupAfterGraphicsCall(false);
-}
-
-void CanvasRenderingContext3D::removeObject(CanvasObject* object)
-{
-    m_canvasObjects.remove(object);
-}
-
-void CanvasRenderingContext3D::addObject(CanvasObject* object)
-{
-    removeObject(object);
-    m_canvasObjects.add(object);
-}
-
-void CanvasRenderingContext3D::detachAndRemoveAllObjects()
-{
-    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
-    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
-        (*it)->detachContext();
-        
-    m_canvasObjects.clear();
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS)
-
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.h b/WebCore/html/canvas/CanvasRenderingContext3D.h
deleted file mode 100644
index 70d9b95..0000000
--- a/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasRenderingContext3D_h
-#define CanvasRenderingContext3D_h
-
-#include "CanvasRenderingContext.h"
-#include "ExceptionCode.h"
-#include "CanvasFloatArray.h"
-#include "CanvasIntArray.h"
-#include "CanvasUnsignedByteArray.h"
-#include "GraphicsContext3D.h"
-#include "PlatformString.h"
-
-namespace WebCore {
-
-class CanvasActiveInfo;
-class CanvasBuffer;
-class CanvasFramebuffer;
-class CanvasObject;
-class CanvasProgram;
-class CanvasRenderbuffer;
-class CanvasShader;
-class CanvasTexture;
-class HTMLImageElement;
-class HTMLVideoElement;
-class ImageData;
-class WebKitCSSMatrix;
-
-    class CanvasRenderingContext3D : public CanvasRenderingContext {
-    public:
-        static PassOwnPtr<CanvasRenderingContext3D> create(HTMLCanvasElement*);
-        virtual ~CanvasRenderingContext3D();
-
-        virtual bool is3d() const { return true; }
-
-        // Helper to return the size in bytes of OpenGL data types
-        // like GL_FLOAT, GL_INT, etc.
-        int sizeInBytes(int type, ExceptionCode& ec);
-
-        void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram*, CanvasShader*);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture*);
-        void blendColor(double red, double green, double blue, double alpha);
-        void blendEquation(unsigned long mode);
-        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
-        void blendFunc(unsigned long sfactor, unsigned long dfactor);
-        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
-
-        void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
-
-        unsigned long checkFramebufferStatus(unsigned long target);
-        void clear(unsigned long mask);
-        void clearColor(double red, double green, double blue, double alpha);
-        void clearDepth(double);
-        void clearStencil(long);
-        void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
-        
-        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
-        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
-        
-        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
-        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
-
-        PassRefPtr<CanvasBuffer> createBuffer();
-        PassRefPtr<CanvasFramebuffer> createFramebuffer();
-        PassRefPtr<CanvasProgram> createProgram();
-        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
-        PassRefPtr<CanvasShader> createShader(unsigned long type);
-        PassRefPtr<CanvasTexture> createTexture();
-
-        void cullFace(unsigned long mode);
-
-        void deleteBuffer(CanvasBuffer*);
-        void deleteFramebuffer(CanvasFramebuffer*);
-        void deleteProgram(CanvasProgram*);
-        void deleteRenderbuffer(CanvasRenderbuffer*);
-        void deleteShader(CanvasShader*);
-        void deleteTexture(CanvasTexture*);
-        
-        void depthFunc(unsigned long);
-        void depthMask(bool);
-        void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
-        void disable(unsigned long cap);
-        void disableVertexAttribArray(unsigned long index);
-        void drawArrays(unsigned long mode, long first, long count);
-        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
-
-        void enable(unsigned long cap);
-        void enableVertexAttribArray(unsigned long index);
-        void finish();
-        void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
-        void frontFace(unsigned long mode);
-        void generateMipmap(unsigned long target);
-
-        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
-        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
-
-        int  getAttribLocation(CanvasProgram*, const String& name);
-
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
-
-        unsigned long getError();
-
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
-
-        // TBD
-        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
-
-        String getShaderSource(CanvasShader*);
-        String getString(unsigned long name);
-
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        long getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        long getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-
-        long getVertexAttribOffset(unsigned long index, unsigned long pname);
-
-        void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
-        bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
-        void lineWidth(double);
-        void linkProgram(CanvasProgram*);
-        void pixelStorei(unsigned long pname, long param);
-        void polygonOffset(double factor, double units);
-        
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
-        
-        void releaseShaderCompiler();
-        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
-        void sampleCoverage(double value, bool invert);
-        void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String&);
-        void stencilFunc(unsigned long func, long ref, unsigned long mask);
-        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
-        void stencilMask(unsigned long);
-        void stencilMaskSeparate(unsigned long face, unsigned long mask);
-        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
-        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
-
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
-                        unsigned width, unsigned height, unsigned border,
-                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
-                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void texParameterf(unsigned target, unsigned pname, float param);
-        void texParameteri(unsigned target, unsigned pname, int param);
-
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height,
-                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLImageElement* image,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                           unsigned width, unsigned height, HTMLVideoElement* video,
-                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
-
-        void uniform1f(long location, float x);
-        void uniform1fv(long location, CanvasFloatArray* v);
-        void uniform1fv(long location, float* v, int size);
-        void uniform1i(long location, int x);
-        void uniform1iv(long location, CanvasIntArray* v);
-        void uniform1iv(long location, int* v, int size);
-        void uniform2f(long location, float x, float y);
-        void uniform2fv(long location, CanvasFloatArray* v);
-        void uniform2fv(long location, float* v, int size);
-        void uniform2i(long location, int x, int y);
-        void uniform2iv(long location, CanvasIntArray* v);
-        void uniform2iv(long location, int* v, int size);
-        void uniform3f(long location, float x, float y, float z);
-        void uniform3fv(long location, CanvasFloatArray* v);
-        void uniform3fv(long location, float* v, int size);
-        void uniform3i(long location, int x, int y, int z);
-        void uniform3iv(long location, CanvasIntArray* v);
-        void uniform3iv(long location, int* v, int size);
-        void uniform4f(long location, float x, float y, float z, float w);
-        void uniform4fv(long location, CanvasFloatArray* v);
-        void uniform4fv(long location, float* v, int size);
-        void uniform4i(long location, int x, int y, int z, int w);
-        void uniform4iv(long location, CanvasIntArray* v);
-        void uniform4iv(long location, int* v, int size);
-        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
-        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
-        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
-
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
-
-        void vertexAttrib1f(unsigned long indx, float x);
-        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib1fv(unsigned long indx, float* values, int size);
-        void vertexAttrib2f(unsigned long indx, float x, float y);
-        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib2fv(unsigned long indx, float* values, int size);
-        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
-        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib3fv(unsigned long indx, float* values, int size);
-        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
-        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
-        void vertexAttrib4fv(unsigned long indx, float* values, int size);
-        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
-                                 unsigned long stride, unsigned long offset);
-
-        void viewport(long x, long y, unsigned long width, unsigned long height);
-
-        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
-    
-        void reshape(int width, int height);
-
-        // Helpers for notification about paint events.
-        void beginPaint();
-        void endPaint();
-        
-        void removeObject(CanvasObject*);
-        
-    private:
-        friend class CanvasObject;
-
-        CanvasRenderingContext3D(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
-
-        void addObject(CanvasObject*);
-        void detachAndRemoveAllObjects();
-
-        void markContextChanged();
-        void cleanupAfterGraphicsCall(bool changed)
-        {
-            m_context->checkError();
-            if (changed)
-                markContextChanged();
-        }
-        
-        OwnPtr<GraphicsContext3D> m_context;
-        bool m_needsUpdate;
-        bool m_markedCanvasDirty;
-        // FIXME: I think this is broken -- it does not increment any
-        // reference counts, so may refer to destroyed objects.
-        HashSet<CanvasObject*> m_canvasObjects;
-    };
-
-} // namespace WebCore
-
-#endif
diff --git a/WebCore/html/canvas/CanvasShortArray.cpp b/WebCore/html/canvas/CanvasShortArray.cpp
deleted file mode 100644
index d0cf135..0000000
--- a/WebCore/html/canvas/CanvasShortArray.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
-    {
-        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                          int offset,
-                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(short)) != 0)
-            return NULL;
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(short))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasShortArray(buffer, offset, length));
-    }
-    
-    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasShortArray::sizeInBytes() const {
-        return length() * sizeof(short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShortArray.h b/WebCore/html/canvas/CanvasShortArray.h
deleted file mode 100644
index 1eeef0c..0000000
--- a/WebCore/html/canvas/CanvasShortArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasShortArray_h
-#define CanvasShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasShortArray : public CanvasArray {
-    public:
-        virtual bool isShortArray() const { return true; }
-
-        static PassRefPtr<CanvasShortArray> create(unsigned length);
-        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
-        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        short* data() { return static_cast<short*>(baseAddress()); }
-
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<short>::min())
-                value = std::numeric_limits<short>::min();
-            else if (value > std::numeric_limits<short>::max())
-                value = std::numeric_limits<short>::max();
-            short* storage = static_cast<short*>(m_baseAddress);
-            storage[index] = static_cast<short>(value);
-        }
-        
-        bool get(unsigned index, short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            short* storage = static_cast<short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasShortArray_h
diff --git a/WebCore/html/canvas/CanvasStyle.cpp b/WebCore/html/canvas/CanvasStyle.cpp
index 946cac7..5352473 100644
--- a/WebCore/html/canvas/CanvasStyle.cpp
+++ b/WebCore/html/canvas/CanvasStyle.cpp
@@ -114,33 +114,33 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
         case ColorString: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(c.rgb());
+                context->setStrokeColor(c.rgb(), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(color);
+                context->setStrokeColor(color, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(c.rgb(), m_alpha), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setStrokeColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setStrokeColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setStrokeColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -154,7 +154,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
             currentPen.setColor(clr);
             context->platformContext()->setPen(currentPen);
 #else
-            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
@@ -175,33 +175,33 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
         case ColorString: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setFillColor(c.rgb());
+                context->setFillColor(c.rgb(), DeviceColorSpace);
                 break;
             }
             RGBA32 rgba = 0; // default is transparent black
             if (CSSParser::parseColor(rgba, m_color))
-                context->setFillColor(rgba);
+                context->setFillColor(rgba, DeviceColorSpace);
             break;
         }
         case ColorStringWithAlpha: {
             Color c = Color(m_color);
             if (c.isValid()) {
-                context->setFillColor(colorWithOverrideAlpha(c.rgb(), m_alpha));
+                context->setFillColor(colorWithOverrideAlpha(c.rgb(), m_alpha), DeviceColorSpace);
                 break;
             }
             RGBA32 color = 0; // default is transparent black
             if (CSSParser::parseColor(color, m_color))
-                context->setFillColor(colorWithOverrideAlpha(color, m_alpha));
+                context->setFillColor(colorWithOverrideAlpha(color, m_alpha), DeviceColorSpace);
             break;
         }
         case GrayLevel:
             // We're only supporting 255 levels of gray here.  Since this isn't
             // even part of HTML5, I don't expect anyone will care.  If they do
             // we'll make a fancier Color abstraction.
-            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha));
+            context->setFillColor(Color(m_grayLevel, m_grayLevel, m_grayLevel, m_alpha), DeviceColorSpace);
             break;
         case RGBA:
-            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha));
+            context->setFillColor(Color(m_red, m_green, m_blue, m_alpha), DeviceColorSpace);
             break;
         case CMYKA: {
             // FIXME: Do this through platform-independent GraphicsContext API.
@@ -215,7 +215,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
             currentBrush.setColor(clr);
             context->platformContext()->setBrush(currentBrush);
 #else
-            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
+            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha), DeviceColorSpace);
 #endif
             break;
         }
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
deleted file mode 100644
index a75066c..0000000
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedByteArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                        int offset,
-                                                                        unsigned length)
-    {
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedByteArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
-        return length() * sizeof(unsigned char);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.h b/WebCore/html/canvas/CanvasUnsignedByteArray.h
deleted file mode 100644
index d8864e0..0000000
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedByteArray_h
-#define CanvasUnsignedByteArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedByteArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedByteArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned char>::min())
-                value = std::numeric_limits<unsigned char>::min();
-            else if (value > std::numeric_limits<unsigned char>::max())
-                value = std::numeric_limits<unsigned char>::max();
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            storage[index] = static_cast<unsigned char>(value);
-        }
-        
-        bool get(unsigned index, unsigned char& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned char item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedByteArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
deleted file mode 100644
index bd26343..0000000
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedIntArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                      int offset,
-                                                                      unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned int)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedIntArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
-        return length() * sizeof(unsigned int);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.h b/WebCore/html/canvas/CanvasUnsignedIntArray.h
deleted file mode 100644
index 10b8edf..0000000
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedIntArray_h
-#define CanvasUnsignedIntArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedIntArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedIntArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned int>::min())
-                value = std::numeric_limits<unsigned int>::min();
-            else if (value > std::numeric_limits<unsigned int>::max())
-                value = std::numeric_limits<unsigned int>::max();
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            storage[index] = static_cast<unsigned int>(value);
-        }
-        
-        bool get(unsigned index, unsigned int& result) const
-        {
-            if (index >= m_size)
-                return false;
-            result = item(index);
-            return true;
-        }
-        
-        unsigned int item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
deleted file mode 100644
index 45d827b..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#if ENABLE(3D_CANVAS)
-
-#include "CanvasArrayBuffer.h"
-#include "CanvasUnsignedShortArray.h"
-
-namespace WebCore {
-    
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
-    {
-        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
-        return create(buffer, 0, length);
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
-    {
-        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
-        for (unsigned i = 0; i < length; ++i)
-            a->set(i, array[i]);
-        return a;
-    }
-
-    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
-                                                                          int offset,
-                                                                          unsigned length)
-    {
-        // Make sure the offset results in valid alignment.
-        if ((offset % sizeof(unsigned short)) != 0) {
-            return NULL;
-        }
-
-        if (buffer) {
-            // Check to make sure we are talking about a valid region of
-            // the given CanvasArrayBuffer's storage.
-            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
-                return NULL;
-        }
-
-        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
-    }
-    
-    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                                         int offset,
-                                         unsigned length)
-        : CanvasArray(buffer, offset)
-        , m_size(length)
-    {
-    }
-    
-    unsigned CanvasUnsignedShortArray::length() const {
-        return m_size;
-    }
-        
-    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
-        return length() * sizeof(unsigned short);
-    }
-}
-
-#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.h b/WebCore/html/canvas/CanvasUnsignedShortArray.h
deleted file mode 100644
index 9e27566..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CanvasUnsignedShortArray_h
-#define CanvasUnsignedShortArray_h
-
-#include "CanvasArray.h"
-#include <limits>
-#include <wtf/MathExtras.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-    
-    class CanvasUnsignedShortArray : public CanvasArray {
-    public:
-        virtual bool isUnsignedShortArray() const { return true; }
-
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
-        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
-
-        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
-        
-        virtual unsigned length() const;
-        virtual unsigned sizeInBytes() const;
-
-        void set(unsigned index, double value)
-        {
-            if (index >= m_size)
-                return;
-            if (isnan(value)) // Clamp NaN to 0
-                value = 0;
-            if (value < std::numeric_limits<unsigned short>::min())
-                value = std::numeric_limits<unsigned short>::min();
-            else if (value > std::numeric_limits<unsigned short>::max())
-                value = std::numeric_limits<unsigned short>::max();
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            storage[index] = static_cast<unsigned short>(value);
-        }
-        
-        bool get(unsigned index, unsigned short& result) const
-        {
-            if (index >= m_size)
-                return false;
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            result = storage[index];
-            return true;
-        }
-        
-        unsigned short item(unsigned index) const
-        {
-            ASSERT(index < m_size);
-            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
-            return storage[index];
-        }
-
-    private:
-        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
-        unsigned m_size;
-    };
-    
-} // namespace WebCore
-
-#endif // CanvasUnsignedShortArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
deleted file mode 100644
index 99fc6a2..0000000
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.idl
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasUnsignedShortArray : CanvasArray {
-    };
-}
diff --git a/WebCore/html/canvas/CanvasActiveInfo.h b/WebCore/html/canvas/WebGLActiveInfo.h
index b04b0d0..4650ea1 100644
--- a/WebCore/html/canvas/CanvasActiveInfo.h
+++ b/WebCore/html/canvas/WebGLActiveInfo.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasActiveInfo_h
-#define CanvasActiveInfo_h
+#ifndef WebGLActiveInfo_h
+#define WebGLActiveInfo_h
 
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
@@ -32,18 +32,18 @@
 
 namespace WebCore {
 
-class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+class WebGLActiveInfo : public RefCounted<WebGLActiveInfo> {
 public:
-    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    static PassRefPtr<WebGLActiveInfo> create(const String& name, unsigned type, int size)
     {
-        return adoptRef(new CanvasActiveInfo(name, type, size));
+        return adoptRef(new WebGLActiveInfo(name, type, size));
     }
     String name() const { return m_name; }
     unsigned type() const { return m_type; }
     int size() const { return m_size; }
 
 private:
-    CanvasActiveInfo(const String& name, unsigned type, int size)
+    WebGLActiveInfo(const String& name, unsigned type, int size)
         : m_name(name)
         , m_type(type)
         , m_size(size)
@@ -59,4 +59,4 @@ private:
 
 }
 
-#endif // CanvasActiveInfo_h
+#endif // WebGLActiveInfo_h
diff --git a/WebCore/html/canvas/CanvasActiveInfo.idl b/WebCore/html/canvas/WebGLActiveInfo.idl
index 6ceae29..a3f79b8 100644
--- a/WebCore/html/canvas/CanvasActiveInfo.idl
+++ b/WebCore/html/canvas/WebGLActiveInfo.idl
@@ -27,7 +27,7 @@ module html {
 
     interface [
         Conditional=3D_CANVAS,
-    ] CanvasActiveInfo {
+    ] WebGLActiveInfo {
         readonly attribute int size;
         readonly attribute unsigned int type;
         readonly attribute DOMString name;
diff --git a/WebCore/html/canvas/CanvasArray.cpp b/WebCore/html/canvas/WebGLArray.cpp
index 6b5688a..c5a712d 100644
--- a/WebCore/html/canvas/CanvasArray.cpp
+++ b/WebCore/html/canvas/WebGLArray.cpp
@@ -27,26 +27,34 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArray.h"
-#include "CanvasArrayBuffer.h"
+#include "WebGLArray.h"
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
-    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
-                             unsigned offset)
-        : m_offset(offset)
+
+WebGLArray::WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                       unsigned byteOffset)
+        : m_byteOffset(byteOffset)
         , m_buffer(buffer)
-    {
-        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
-    }
+{
+    m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_byteOffset) : 0;
+}
 
-    CanvasArray::~CanvasArray()
-    {
-    }
+WebGLArray::~WebGLArray()
+{
+}
 
-    unsigned CanvasArray::alignedSizeInBytes() const {
-        // Assume we only need to round up to 4-byte boundaries for alignment.
-        return ((sizeInBytes() + 3) / 4) * 4;
+void WebGLArray::setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec)
+{
+    if (byteOffset + array->byteLength() > byteLength()) {
+        ec = INDEX_SIZE_ERR;
+        return;
     }
+
+    char* base = static_cast<char*>(baseAddress());
+    memcpy(base + byteOffset, array->baseAddress(), array->byteLength());
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArray.h b/WebCore/html/canvas/WebGLArray.h
index 8cedbbe..11065cc 100644
--- a/WebCore/html/canvas/CanvasArray.h
+++ b/WebCore/html/canvas/WebGLArray.h
@@ -23,53 +23,59 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasArray_h
-#define CanvasArray_h
+#ifndef WebGLArray_h
+#define WebGLArray_h
 
+#include "ExceptionCode.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include "CanvasArrayBuffer.h"
+#include "WebGLArrayBuffer.h"
 
 namespace WebCore {
-    class CanvasArray : public RefCounted<CanvasArray> {
-    public:
-        virtual bool isByteArray() const { return false; }
-        virtual bool isUnsignedByteArray() const { return false; }
-        virtual bool isShortArray() const { return false; }
-        virtual bool isUnsignedShortArray() const { return false; }
-        virtual bool isIntArray() const { return false; }
-        virtual bool isUnsignedIntArray() const { return false; }
-        virtual bool isFloatArray() const { return false; }
-        
-        PassRefPtr<CanvasArrayBuffer> buffer() {
-            return m_buffer;
-        }
-
-        void* baseAddress() {
-            return m_baseAddress;
-        }
-
-        unsigned offset() const {
-            return m_offset;
-        }
-
-        virtual unsigned length() const = 0;
-        virtual unsigned sizeInBytes() const = 0;
-        virtual unsigned alignedSizeInBytes() const;
-        virtual ~CanvasArray();
-
-    protected:
-        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
-
-        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
-        void* m_baseAddress;
-        unsigned m_offset;
-        
-    private:
-        RefPtr<CanvasArrayBuffer> m_buffer;
-    };
-    
+
+class WebGLArray : public RefCounted<WebGLArray> {
+  public:
+    virtual bool isByteArray() const { return false; }
+    virtual bool isUnsignedByteArray() const { return false; }
+    virtual bool isShortArray() const { return false; }
+    virtual bool isUnsignedShortArray() const { return false; }
+    virtual bool isIntArray() const { return false; }
+    virtual bool isUnsignedIntArray() const { return false; }
+    virtual bool isFloatArray() const { return false; }
+
+    PassRefPtr<WebGLArrayBuffer> buffer() {
+        return m_buffer;
+    }
+
+    void* baseAddress() {
+        return m_baseAddress;
+    }
+
+    unsigned byteOffset() const {
+        return m_byteOffset;
+    }
+
+    virtual unsigned length() const = 0;
+    virtual unsigned byteLength() const = 0;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length) = 0;
+
+    virtual ~WebGLArray();
+
+  protected:
+    WebGLArray(PassRefPtr<WebGLArrayBuffer> buffer, unsigned byteOffset);
+
+    void setImpl(WebGLArray* array, unsigned byteOffset, ExceptionCode& ec);
+
+    // This is the address of the WebGLArrayBuffer's storage, plus the byte offset.
+    void* m_baseAddress;
+
+    unsigned m_byteOffset;
+
+  private:
+    RefPtr<WebGLArrayBuffer> m_buffer;
+};
+
 } // namespace WebCore
 
-#endif // CanvasArray_h
+#endif // WebGLArray_h
diff --git a/WebCore/html/canvas/CanvasByteArray.idl b/WebCore/html/canvas/WebGLArray.idl
index ccf49ad..156ca5b 100644
--- a/WebCore/html/canvas/CanvasByteArray.idl
+++ b/WebCore/html/canvas/WebGLArray.idl
@@ -24,13 +24,12 @@
  */
 
 module html {
-    interface [
-        Conditional=3D_CANVAS,
-        HasNumericIndexGetter,
-        HasCustomIndexSetter,
-        GenerateNativeConverter,
-        GenerateCustomConstructor,
-        CustomToJS
-    ] CanvasByteArray : CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS] WebGLArray {
+        readonly attribute WebGLArrayBuffer buffer;
+        readonly attribute unsigned long byteOffset;
+        readonly attribute unsigned long byteLength;
+        readonly attribute unsigned long length;
+
+        WebGLArray slice(in unsigned long offset, in unsigned long length);
     };
 }
diff --git a/WebCore/html/canvas/CanvasBuffer.cpp b/WebCore/html/canvas/WebGLArrayBuffer.cpp
index 009f8ad..c565691 100644
--- a/WebCore/html/canvas/CanvasBuffer.cpp
+++ b/WebCore/html/canvas/WebGLArrayBuffer.cpp
@@ -27,25 +27,43 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasBuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
-    
-PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
+
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(unsigned sizeInBytes)
 {
-    return adoptRef(new CanvasBuffer(ctx));
+    return adoptRef(new WebGLArrayBuffer(sizeInBytes));
 }
 
-CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
-    : CanvasObject(ctx)
+PassRefPtr<WebGLArrayBuffer> WebGLArrayBuffer::create(WebGLArrayBuffer* other)
 {
-    setObject(context()->graphicsContext3D()->createBuffer());
+    RefPtr<WebGLArrayBuffer> buffer = adoptRef(new WebGLArrayBuffer(other->byteLength()));
+    memcpy(buffer->data(), other->data(), other->byteLength());
+    return buffer.release();
 }
 
-void CanvasBuffer::_deleteObject(Platform3DObject object)
-{
-    context()->graphicsContext3D()->deleteBuffer(object);
+WebGLArrayBuffer::WebGLArrayBuffer(unsigned sizeInBytes) {
+    m_sizeInBytes = sizeInBytes;
+    m_data = WTF::fastZeroedMalloc(sizeInBytes);
+}
+
+void* WebGLArrayBuffer::data() {
+    return m_data;
+}
+
+const void* WebGLArrayBuffer::data() const {
+    return m_data;
+}
+
+unsigned WebGLArrayBuffer::byteLength() const {
+    return m_sizeInBytes;
+}
+
+WebGLArrayBuffer::~WebGLArrayBuffer() {
+    WTF::fastFree(m_data);
 }
 
 }
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.h b/WebCore/html/canvas/WebGLArrayBuffer.h
index e3ff2b0..a076e16 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.h
+++ b/WebCore/html/canvas/WebGLArrayBuffer.h
@@ -23,29 +23,31 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasArrayBuffer_h
-#define CanvasArrayBuffer_h
+#ifndef WebGLArrayBuffer_h
+#define WebGLArrayBuffer_h
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
-    public:
-        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
-
-        void* data();
-        unsigned byteLength() const;
-
-        ~CanvasArrayBuffer();
-
-    private:
-        CanvasArrayBuffer(unsigned sizeInBytes);
-        unsigned m_sizeInBytes;
-        void* m_data;
-    };
-    
+
+class WebGLArrayBuffer : public RefCounted<WebGLArrayBuffer> {
+  public:
+    static PassRefPtr<WebGLArrayBuffer> create(unsigned sizeInBytes);
+    static PassRefPtr<WebGLArrayBuffer> create(WebGLArrayBuffer*);
+
+    void* data();
+    const void* data() const;
+    unsigned byteLength() const;
+
+    ~WebGLArrayBuffer();
+
+  private:
+    WebGLArrayBuffer(unsigned sizeInBytes);
+    unsigned m_sizeInBytes;
+    void* m_data;
+};
+
 } // namespace WebCore
 
-#endif // CanvasArrayBuffer_h
+#endif // WebGLArrayBuffer_h
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.idl b/WebCore/html/canvas/WebGLArrayBuffer.idl
index 5dc0f7f..ec4a67a 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.idl
+++ b/WebCore/html/canvas/WebGLArrayBuffer.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+    interface [Conditional=3D_CANVAS] WebGLArrayBuffer {
         readonly attribute int byteLength;
     };
 }
diff --git a/WebCore/html/canvas/WebGLBuffer.cpp b/WebCore/html/canvas/WebGLBuffer.cpp
new file mode 100644
index 0000000..cbad6a0
--- /dev/null
+++ b/WebCore/html/canvas/WebGLBuffer.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLBuffer.h"
+#include "WebGLRenderingContext.h"
+
+namespace WebCore {
+    
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
+{
+    return adoptRef(new WebGLBuffer(ctx));
+}
+
+PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLBuffer(ctx, obj));
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
+    : CanvasObject(ctx)
+    , m_elementArrayBufferByteLength(0)
+    , m_arrayBufferByteLength(0)
+    , m_elementArrayBufferCloned(false)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+}
+
+WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+{
+    setObject(obj, false);
+}
+
+void WebGLBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, int size)
+{
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = size;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = size;
+        return true;
+    }
+
+    return false;
+}
+
+bool WebGLBuffer::associateBufferData(unsigned long target, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_elementArrayBufferByteLength = array->byteLength();
+        m_elementArrayBuffer = array->buffer();
+        m_elementArrayBufferCloned = false;
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_arrayBufferByteLength = array->byteLength();
+        return true;
+    }
+    
+    return false;
+}
+
+bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, WebGLArray* array)
+{
+    if (!array)
+        return false;
+        
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        // We need to protect against integer overflow with these tests
+        if (offset < 0)
+            return false;
+            
+        unsigned long uoffset = static_cast<unsigned long>(offset);
+        if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
+            return false;
+            
+        // If we already have a buffer, we need to clone it and add the new data
+        if (m_elementArrayBuffer && !m_elementArrayBufferCloned) {
+            m_elementArrayBuffer = WebGLArrayBuffer::create(m_elementArrayBuffer.get());
+            m_elementArrayBufferCloned = true;
+        }
+            
+        memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());
+        return true;
+    }
+    
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        return array->byteLength() + offset <= m_arrayBufferByteLength;
+
+    return false;
+}
+
+unsigned WebGLBuffer::byteLength(unsigned long target) const
+{
+    return (target == GraphicsContext3D::ARRAY_BUFFER) ? m_arrayBufferByteLength : m_elementArrayBufferByteLength;
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLBuffer.h b/WebCore/html/canvas/WebGLBuffer.h
new file mode 100644
index 0000000..cb953c6
--- /dev/null
+++ b/WebCore/html/canvas/WebGLBuffer.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLBuffer_h
+#define WebGLBuffer_h
+
+#include "CanvasObject.h"
+#include "WebGLArrayBuffer.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class WebGLBuffer : public CanvasObject {
+    public:
+        virtual ~WebGLBuffer() { deleteObject(); }
+        
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
+        
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*, Platform3DObject);
+
+        bool associateBufferData(unsigned long target, int size);
+        bool associateBufferData(unsigned long target, WebGLArray* array);
+        bool associateBufferSubData(unsigned long target, long offset, WebGLArray* array);
+        
+        unsigned byteLength(unsigned long target) const;
+        const WebGLArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
+                        
+    protected:
+        WebGLBuffer(WebGLRenderingContext*);
+        WebGLBuffer(WebGLRenderingContext*, Platform3DObject obj);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    
+    private:
+        RefPtr<WebGLArrayBuffer> m_elementArrayBuffer;
+        unsigned m_elementArrayBufferByteLength;
+        unsigned m_arrayBufferByteLength;
+        bool m_elementArrayBufferCloned;
+    };
+    
+} // namespace WebCore
+
+#endif // WebGLBuffer_h
diff --git a/WebCore/html/canvas/CanvasShader.idl b/WebCore/html/canvas/WebGLBuffer.idl
index 7474c3a..30b7606 100644
--- a/WebCore/html/canvas/CanvasShader.idl
+++ b/WebCore/html/canvas/WebGLBuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasShader {
+    interface [Conditional=3D_CANVAS] WebGLBuffer {
     };
 }
diff --git a/WebCore/html/canvas/CanvasByteArray.cpp b/WebCore/html/canvas/WebGLByteArray.cpp
index 0f72ccf..1c2849b 100644
--- a/WebCore/html/canvas/CanvasByteArray.cpp
+++ b/WebCore/html/canvas/WebGLByteArray.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,49 +28,64 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasArrayBuffer.h"
-#include "CanvasByteArray.h"
+#include "WebGLArrayBuffer.h"
+#include "WebGLByteArray.h"
 
 namespace WebCore {
-    
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(unsigned length)
 {
-    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(signed char));
     return create(buffer, 0, length);
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(signed char* array, unsigned length)
 {
-    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    RefPtr<WebGLByteArray> a = WebGLByteArray::create(length);
     for (unsigned i = 0; i < length; ++i)
         a->set(i, array[i]);
     return a;
 }
 
-PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+PassRefPtr<WebGLByteArray> WebGLByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
 {
     if (buffer) {
         // Check to make sure we are talking about a valid region of
-        // the given CanvasArrayBuffer's storage.
-        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(signed char))) > buffer->byteLength())
             return NULL;
     }
-    
-    return adoptRef(new CanvasByteArray(buffer, offset, length));
+
+    return adoptRef(new WebGLByteArray(buffer, byteOffset, length));
 }
 
-CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
-    : CanvasArray(buffer, offset)
+WebGLByteArray::WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int offset, unsigned length)
+    : WebGLArray(buffer, offset)
     , m_size(length)
 {
 }
 
-unsigned CanvasByteArray::length() const {
+unsigned WebGLByteArray::length() const {
     return m_size;
 }
-    
-unsigned CanvasByteArray::sizeInBytes() const {
-    return length() * sizeof(signed char);
+
+unsigned WebGLByteArray::byteLength() const {
+    return m_size * sizeof(signed char);
+}
+
+PassRefPtr<WebGLArray> WebGLByteArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(signed char);
+    unsigned limitByte = startByte + length * sizeof(signed char);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLByteArray::set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(signed char), ec);
 }
 
 }
diff --git a/WebCore/html/canvas/WebGLByteArray.h b/WebCore/html/canvas/WebGLByteArray.h
new file mode 100644
index 0000000..c517c03
--- /dev/null
+++ b/WebCore/html/canvas/WebGLByteArray.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLByteArray_h
+#define WebGLByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLArrayBuffer;
+
+class WebGLByteArray : public WebGLArray {
+  public:
+    virtual bool isByteArray() const { return true; }
+
+    static PassRefPtr<WebGLByteArray> create(unsigned length);
+    static PassRefPtr<WebGLByteArray> create(signed char* array, unsigned length);
+    static PassRefPtr<WebGLByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    char* data() { return static_cast<char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<signed char>::min())
+            value = std::numeric_limits<signed char>::min();
+        else if (value > std::numeric_limits<signed char>::max())
+            value = std::numeric_limits<signed char>::max();
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        storage[index] = static_cast<signed char>(value);
+    }
+
+    bool get(unsigned index, signed char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    signed char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    signed char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        signed char* storage = static_cast<signed char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLByteArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                   int offset,
+                   unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLByteArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.idl b/WebCore/html/canvas/WebGLByteArray.idl
index 2c81b87..054a912 100644
--- a/WebCore/html/canvas/CanvasIntArray.idl
+++ b/WebCore/html/canvas/WebGLByteArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasIntArray : CanvasArray {
+    ] WebGLByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/WebGLFloatArray.cpp b/WebCore/html/canvas/WebGLFloatArray.cpp
new file mode 100644
index 0000000..6192898
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFloatArray.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLFloatArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(float));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(float* array, unsigned length)
+{
+    RefPtr<WebGLFloatArray> a = WebGLFloatArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLFloatArray> WebGLFloatArray::create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(float)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(float))) > buffer->byteLength())
+            return NULL;
+    }
+    return adoptRef(new WebGLFloatArray(buffer, byteOffset, length));
+}
+
+WebGLFloatArray::WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLFloatArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLFloatArray::byteLength() const {
+    return m_size * sizeof(float);
+}
+
+PassRefPtr<WebGLArray> WebGLFloatArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(float);
+    unsigned limitByte = startByte + length * sizeof(float);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLFloatArray::set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(float), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLFloatArray.h b/WebCore/html/canvas/WebGLFloatArray.h
new file mode 100644
index 0000000..4607962
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFloatArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLFloatArray_h
+#define WebGLFloatArray_h
+
+#include "WebGLArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLFloatArray : public WebGLArray {
+  public:
+    virtual bool isFloatArray() const { return true; }
+
+    static PassRefPtr<WebGLFloatArray> create(unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(float* array, unsigned length);
+    static PassRefPtr<WebGLFloatArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    float* data() { return static_cast<float*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        float* storage = static_cast<float*>(m_baseAddress);
+        storage[index] = static_cast<float>(value);
+    }
+
+    bool get(unsigned index, float& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    float get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    float item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        float* storage = static_cast<float*>(m_baseAddress);
+        float result = storage[index];
+        if (isnan(result)) {
+            // Clamp NaN to 0
+            result = 0;
+        }
+        return result;
+    }
+
+    void set(WebGLFloatArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLFloatArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLFloatArray_h
diff --git a/WebCore/html/canvas/CanvasShortArray.idl b/WebCore/html/canvas/WebGLFloatArray.idl
index 6d64e1c..83479b3 100644
--- a/WebCore/html/canvas/CanvasShortArray.idl
+++ b/WebCore/html/canvas/WebGLFloatArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasShortArray : CanvasArray {
+    ] WebGLFloatArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLFloatArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasFramebuffer.cpp b/WebCore/html/canvas/WebGLFramebuffer.cpp
index 9700354..7ade990 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.cpp
+++ b/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasFramebuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLFramebuffer> WebGLFramebuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasFramebuffer(ctx));
+    return adoptRef(new WebGLFramebuffer(ctx));
 }
 
-CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+WebGLFramebuffer::WebGLFramebuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createFramebuffer());
 }
 
-void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+void WebGLFramebuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteFramebuffer(object);
 }
diff --git a/WebCore/html/canvas/CanvasFramebuffer.h b/WebCore/html/canvas/WebGLFramebuffer.h
index ec3cb97..10b6772 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.h
+++ b/WebCore/html/canvas/WebGLFramebuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasFramebuffer_h
-#define CanvasFramebuffer_h
+#ifndef WebGLFramebuffer_h
+#define WebGLFramebuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasFramebuffer : public CanvasObject {
+    class WebGLFramebuffer : public CanvasObject {
     public:
-        virtual ~CanvasFramebuffer() { deleteObject(); }
+        virtual ~WebGLFramebuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLFramebuffer> create(WebGLRenderingContext*);
         
     protected:
-        CanvasFramebuffer(CanvasRenderingContext3D*);
+        WebGLFramebuffer(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasFramebuffer_h
+#endif // WebGLFramebuffer_h
diff --git a/WebCore/html/canvas/WebGLFramebuffer.idl b/WebCore/html/canvas/WebGLFramebuffer.idl
new file mode 100644
index 0000000..8c1d9fd
--- /dev/null
+++ b/WebCore/html/canvas/WebGLFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] WebGLFramebuffer {
+    };
+}
diff --git a/WebCore/html/canvas/WebGLGetInfo.cpp b/WebCore/html/canvas/WebGLGetInfo.cpp
new file mode 100644
index 0000000..96218e5
--- /dev/null
+++ b/WebCore/html/canvas/WebGLGetInfo.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLGetInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+WebGLGetInfo::WebGLGetInfo(bool value)
+    : m_type(kTypeBool)
+    , m_bool(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(float value)
+    : m_type(kTypeFloat)
+    , m_float(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(long value)
+    : m_type(kTypeLong)
+    , m_long(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo()
+    : m_type(kTypeNull)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(const String& value)
+    : m_type(kTypeString)
+    , m_string(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(unsigned long value)
+    : m_type(kTypeUnsignedLong)
+    , m_unsignedLong(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLBuffer> value)
+    : m_type(kTypeWebGLBuffer)
+    , m_webglBuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFloatArray> value)
+    : m_type(kTypeWebGLFloatArray)
+    , m_webglFloatArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value)
+    : m_type(kTypeWebGLFramebuffer)
+    , m_webglFramebuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLIntArray> value)
+    : m_type(kTypeWebGLIntArray)
+    , m_webglIntArray(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLProgram> value)
+    : m_type(kTypeWebGLProgram)
+    , m_webglProgram(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value)
+    : m_type(kTypeWebGLRenderbuffer)
+    , m_webglRenderbuffer(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLTexture> value)
+    : m_type(kTypeWebGLTexture)
+    , m_webglTexture(value)
+{
+}
+
+WebGLGetInfo::WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value)
+    : m_type(kTypeWebGLUnsignedByteArray)
+    , m_webglUnsignedByteArray(value)
+{
+}
+
+WebGLGetInfo::~WebGLGetInfo()
+{
+}
+
+WebGLGetInfo::Type WebGLGetInfo::getType() const
+{
+    return m_type;
+}
+
+bool WebGLGetInfo::getBool() const
+{
+    ASSERT(getType() == kTypeBool);
+    return m_bool;
+}
+
+float WebGLGetInfo::getFloat() const
+{
+    ASSERT(getType() == kTypeFloat);
+    return m_float;
+}
+
+long WebGLGetInfo::getLong() const
+{
+    ASSERT(getType() == kTypeLong);
+    return m_long;
+}
+
+const String& WebGLGetInfo::getString() const
+{
+    ASSERT(getType() == kTypeString);
+    return m_string;
+}
+
+unsigned long WebGLGetInfo::getUnsignedLong() const
+{
+    ASSERT(getType() == kTypeUnsignedLong);
+    return m_unsignedLong;
+}
+
+PassRefPtr<WebGLBuffer> WebGLGetInfo::getWebGLBuffer() const
+{
+    ASSERT(getType() == kTypeWebGLBuffer);
+    return m_webglBuffer;
+}
+
+PassRefPtr<WebGLFloatArray> WebGLGetInfo::getWebGLFloatArray() const
+{
+    ASSERT(getType() == kTypeWebGLFloatArray);
+    return m_webglFloatArray;
+}
+
+PassRefPtr<WebGLFramebuffer> WebGLGetInfo::getWebGLFramebuffer() const
+{
+    ASSERT(getType() == kTypeWebGLFramebuffer);
+    return m_webglFramebuffer;
+}
+
+PassRefPtr<WebGLIntArray> WebGLGetInfo::getWebGLIntArray() const
+{
+    ASSERT(getType() == kTypeWebGLIntArray);
+    return m_webglIntArray;
+}
+
+PassRefPtr<WebGLProgram> WebGLGetInfo::getWebGLProgram() const
+{
+    ASSERT(getType() == kTypeWebGLProgram);
+    return m_webglProgram;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLGetInfo::getWebGLRenderbuffer() const
+{
+    ASSERT(getType() == kTypeWebGLRenderbuffer);
+    return m_webglRenderbuffer;
+}
+
+PassRefPtr<WebGLTexture> WebGLGetInfo::getWebGLTexture() const
+{
+    ASSERT(getType() == kTypeWebGLTexture);
+    return m_webglTexture;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLGetInfo::getWebGLUnsignedByteArray() const
+{
+    ASSERT(getType() == kTypeWebGLUnsignedByteArray);
+    return m_webglUnsignedByteArray;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLGetInfo.h b/WebCore/html/canvas/WebGLGetInfo.h
new file mode 100644
index 0000000..8ac42c4
--- /dev/null
+++ b/WebCore/html/canvas/WebGLGetInfo.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebGLGetInfo_h
+#define WebGLGetInfo_h
+
+#include "wtf/PassRefPtr.h"
+#include "wtf/RefPtr.h"
+#include "PlatformString.h"
+
+#include "WebGLBuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLIntArray.h"
+// FIXME: implement WebGLObjectArray
+//#include "WebGLObjectArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+// A tagged union representing the result of get queries like
+// getParameter (encompassing getBooleanv, getIntegerv, getFloatv) and
+// similar variants. For reference counted types, increments and
+// decrements the reference count of the target object.
+
+class WebGLGetInfo {
+public:
+    enum Type {
+        kTypeBool,
+        kTypeFloat,
+        kTypeLong,
+        kTypeNull,
+        kTypeString,
+        kTypeUnsignedLong,
+        kTypeWebGLBuffer,
+        kTypeWebGLFloatArray,
+        kTypeWebGLFramebuffer,
+        kTypeWebGLIntArray,
+        kTypeWebGLObjectArray,
+        kTypeWebGLProgram,
+        kTypeWebGLRenderbuffer,
+        kTypeWebGLTexture,
+        kTypeWebGLUnsignedByteArray
+    };
+
+    WebGLGetInfo(bool value);
+    WebGLGetInfo(float value);
+    WebGLGetInfo(long value);
+    // Represents the NULL value and type
+    WebGLGetInfo();
+    WebGLGetInfo(const String& value);
+    WebGLGetInfo(unsigned long value);
+    WebGLGetInfo(PassRefPtr<WebGLBuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLFloatArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLFramebuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLIntArray> value);
+    // FIXME: implement WebGLObjectArray
+    // WebGLGetInfo(PassRefPtr<WebGLObjectArray> value);
+    WebGLGetInfo(PassRefPtr<WebGLProgram> value);
+    WebGLGetInfo(PassRefPtr<WebGLRenderbuffer> value);
+    WebGLGetInfo(PassRefPtr<WebGLTexture> value);
+    WebGLGetInfo(PassRefPtr<WebGLUnsignedByteArray> value);
+
+    virtual ~WebGLGetInfo();
+
+    Type getType() const;
+
+    bool getBool() const;
+    float getFloat() const;
+    long getLong() const;
+    const String& getString() const;
+    unsigned long getUnsignedLong() const;
+    PassRefPtr<WebGLBuffer> getWebGLBuffer() const;
+    PassRefPtr<WebGLFloatArray> getWebGLFloatArray() const;
+    PassRefPtr<WebGLFramebuffer> getWebGLFramebuffer() const;
+    PassRefPtr<WebGLIntArray> getWebGLIntArray() const;
+    // FIXME: implement WebGLObjectArray
+    // PassRefPtr<WebGLObjectArray> getWebGLObjectArray() const;
+    PassRefPtr<WebGLProgram> getWebGLProgram() const;
+    PassRefPtr<WebGLRenderbuffer> getWebGLRenderbuffer() const;
+    PassRefPtr<WebGLTexture> getWebGLTexture() const;
+    PassRefPtr<WebGLUnsignedByteArray> getWebGLUnsignedByteArray() const;
+
+private:
+    Type m_type;
+    bool m_bool;
+    float m_float;
+    long m_long;
+    String m_string;
+    unsigned long m_unsignedLong;
+    RefPtr<WebGLBuffer> m_webglBuffer;
+    RefPtr<WebGLFloatArray> m_webglFloatArray;
+    RefPtr<WebGLFramebuffer> m_webglFramebuffer;
+    RefPtr<WebGLIntArray> m_webglIntArray;
+    // FIXME: implement WebGLObjectArray
+    // RefPtr<WebGLObjectArray> m_webglObjectArray;
+    RefPtr<WebGLProgram> m_webglProgram;
+    RefPtr<WebGLRenderbuffer> m_webglRenderbuffer;
+    RefPtr<WebGLTexture> m_webglTexture;
+    RefPtr<WebGLUnsignedByteArray> m_webglUnsignedByteArray;
+};
+
+} // namespace WebCore
+
+#endif  // WebGLGetInfo_h
diff --git a/WebCore/html/canvas/WebGLIntArray.cpp b/WebCore/html/canvas/WebGLIntArray.cpp
new file mode 100644
index 0000000..4617010
--- /dev/null
+++ b/WebCore/html/canvas/WebGLIntArray.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(int* array, unsigned length)
+{
+    RefPtr<WebGLIntArray> a = WebGLIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLIntArray> WebGLIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                int byteOffset,
+                                                unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(int)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(int))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLIntArray(buffer, byteOffset, length));
+}
+
+WebGLIntArray::WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLIntArray::byteLength() const {
+    return m_size * sizeof(int);
+}
+
+PassRefPtr<WebGLArray> WebGLIntArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(int);
+    unsigned limitByte = startByte + length * sizeof(int);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLIntArray::set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLIntArray.h b/WebCore/html/canvas/WebGLIntArray.h
new file mode 100644
index 0000000..25108ac
--- /dev/null
+++ b/WebCore/html/canvas/WebGLIntArray.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLIntArray_h
+#define WebGLIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLIntArray : public WebGLArray {
+  public:
+    virtual bool isIntArray() const { return true; }
+
+    static PassRefPtr<WebGLIntArray> create(unsigned length);
+    static PassRefPtr<WebGLIntArray> create(int* array, unsigned length);
+    static PassRefPtr<WebGLIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    int* data() { return static_cast<int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<int>::min())
+            value = std::numeric_limits<int>::min();
+        else if (value > std::numeric_limits<int>::max())
+            value = std::numeric_limits<int>::max();
+        int* storage = static_cast<int*>(m_baseAddress);
+        storage[index] = static_cast<int>(value);
+    }
+
+    bool get(unsigned index, int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        int* storage = static_cast<int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLIntArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                  int byteOffset,
+                  unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/WebCore/html/canvas/WebGLIntArray.idl
index d46f708..3bc037c 100644
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.idl
+++ b/WebCore/html/canvas/WebGLIntArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasUnsignedByteArray : CanvasArray {
+    ] WebGLIntArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasProgram.cpp b/WebCore/html/canvas/WebGLProgram.cpp
index 83da270..c2606c1 100644
--- a/WebCore/html/canvas/CanvasProgram.cpp
+++ b/WebCore/html/canvas/WebGLProgram.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasProgram.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasProgram(ctx));
+    return adoptRef(new WebGLProgram(ctx));
 }
 
-CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createProgram());
 }
 
-void CanvasProgram::_deleteObject(Platform3DObject object)
+void WebGLProgram::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteProgram(object);
 }
diff --git a/WebCore/html/canvas/CanvasProgram.h b/WebCore/html/canvas/WebGLProgram.h
index af817c8..8804d39 100644
--- a/WebCore/html/canvas/CanvasProgram.h
+++ b/WebCore/html/canvas/WebGLProgram.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasProgram_h
-#define CanvasProgram_h
+#ifndef WebGLProgram_h
+#define WebGLProgram_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasProgram : public CanvasObject {
+    class WebGLProgram : public CanvasObject {
     public:
-        virtual ~CanvasProgram() { deleteObject(); }
+        virtual ~WebGLProgram() { deleteObject(); }
         
-        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLProgram> create(WebGLRenderingContext*);
         
     protected:
-        CanvasProgram(CanvasRenderingContext3D*);
+        WebGLProgram(WebGLRenderingContext*);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasProgram_h
+#endif // WebGLProgram_h
diff --git a/WebCore/html/canvas/CanvasBuffer.idl b/WebCore/html/canvas/WebGLProgram.idl
index 9bca42b..562fa3a 100644
--- a/WebCore/html/canvas/CanvasBuffer.idl
+++ b/WebCore/html/canvas/WebGLProgram.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasBuffer {
+    interface [Conditional=3D_CANVAS] WebGLProgram {
     };
 }
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.cpp b/WebCore/html/canvas/WebGLRenderbuffer.cpp
index 51054cd..286ad2e 100644
--- a/WebCore/html/canvas/CanvasRenderbuffer.cpp
+++ b/WebCore/html/canvas/WebGLRenderbuffer.cpp
@@ -27,23 +27,34 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasRenderbuffer.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasRenderbuffer(ctx));
+    return adoptRef(new WebGLRenderbuffer(ctx));
 }
 
-CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLRenderbuffer> WebGLRenderbuffer::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLRenderbuffer(ctx, obj));
+}
+
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createRenderbuffer());
 }
 
-void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+WebGLRenderbuffer::WebGLRenderbuffer(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+{
+    setObject(obj, false);
+}
+
+void WebGLRenderbuffer::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteRenderbuffer(object);
 }
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.h b/WebCore/html/canvas/WebGLRenderbuffer.h
index 3fb99e9..790fdcd 100644
--- a/WebCore/html/canvas/CanvasRenderbuffer.h
+++ b/WebCore/html/canvas/WebGLRenderbuffer.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasRenderbuffer_h
-#define CanvasRenderbuffer_h
+#ifndef WebGLRenderbuffer_h
+#define WebGLRenderbuffer_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,23 @@
 
 namespace WebCore {
     
-    class CanvasRenderbuffer : public CanvasObject {
+    class WebGLRenderbuffer : public CanvasObject {
     public:
-        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        virtual ~WebGLRenderbuffer() { deleteObject(); }
         
-        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*);
         
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLRenderbuffer> create(WebGLRenderingContext*, Platform3DObject renderbuffer);
+
     protected:
-        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        WebGLRenderbuffer(WebGLRenderingContext*);
+        WebGLRenderbuffer(WebGLRenderingContext*, Platform3DObject);
         
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasRenderbuffer_h
+#endif // WebGLRenderbuffer_h
diff --git a/WebCore/html/canvas/CanvasFramebuffer.idl b/WebCore/html/canvas/WebGLRenderbuffer.idl
index 0a9b668..2524433 100644
--- a/WebCore/html/canvas/CanvasFramebuffer.idl
+++ b/WebCore/html/canvas/WebGLRenderbuffer.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    interface [Conditional=3D_CANVAS] WebGLRenderbuffer {
     };
 }
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
new file mode 100644
index 0000000..7a7215d
--- /dev/null
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -0,0 +1,2424 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLRenderingContext.h"
+
+#include "WebGLActiveInfo.h"
+#include "WebGLBuffer.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLTexture.h"
+#include "WebGLShader.h"
+#include "WebGLUniformLocation.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+class WebGLStateRestorer {
+public:
+    WebGLStateRestorer(WebGLRenderingContext* context,
+                       bool changed)
+        : m_context(context)
+        , m_changed(changed)
+    {
+    }
+
+    ~WebGLStateRestorer()
+    {
+        m_context->cleanupAfterGraphicsCall(m_changed);
+    }
+
+private:
+    WebGLRenderingContext* m_context;
+    bool m_changed;
+};
+
+PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElement* canvas)
+{
+    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
+    if (!context)
+        return 0;
+        
+    return new WebGLRenderingContext(canvas, context.release());
+}
+
+WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+    : CanvasRenderingContext(passedCanvas)
+    , m_context(context)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+    , m_activeTextureUnit(0)
+{
+    ASSERT(m_context);
+    int numVertexAttribs = 0;
+    m_context->getIntegerv(GraphicsContext3D::MAX_VERTEX_ATTRIBS, &numVertexAttribs);
+    m_maxVertexAttribs = numVertexAttribs;
+    m_context->reshape(canvas()->width(), canvas()->height());
+}
+
+WebGLRenderingContext::~WebGLRenderingContext()
+{
+    detachAndRemoveAllObjects();
+}
+
+void WebGLRenderingContext::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
+        canvas()->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            canvas()->buffer();
+            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void WebGLRenderingContext::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context->beginPaint(this);
+    }
+}
+
+void WebGLRenderingContext::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context->endPaint();
+    }
+}
+
+void WebGLRenderingContext::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
+            canvas()->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context->reshape(width, height);
+}
+
+int WebGLRenderingContext::sizeInBytes(int type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    int result = m_context->sizeInBytes(type);
+    if (result <= 0)
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+
+    return result;
+}
+
+void WebGLRenderingContext::activeTexture(unsigned long texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if ((texture - GraphicsContext3D::TEXTURE0) > sizeof(m_textureUnits) / sizeof(TextureUnitState)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_activeTextureUnit = texture - GraphicsContext3D::TEXTURE0;
+    m_context->activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::attachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (target == GraphicsContext3D::ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+    else if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+        m_boundElementArrayBuffer = buffer;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::FRAMEBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_framebufferBinding = buffer;
+    m_context->bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderBuffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (renderBuffer && renderBuffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_renderbufferBinding = renderBuffer;
+    m_context->bindRenderbuffer(target, renderBuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::bindTexture(unsigned long target, WebGLTexture* texture, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    if (target == GraphicsContext3D::TEXTURE_2D)
+        m_textureUnits[m_activeTextureUnit].m_texture2DBinding = texture;
+    else if (target == GraphicsContext3D::TEXTURE_CUBE_MAP)
+        m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding = texture;
+    else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+    m_context->bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context->blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquation( unsigned long mode )
+{
+    m_context->blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context->blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context->blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void WebGLRenderingContext::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, size)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferData(target, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
+        if (!m_boundElementArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
+        if (!m_boundArrayBuffer->associateBufferSubData(target, offset, data)) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+    } else {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
+    }
+
+    m_context->bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long WebGLRenderingContext::checkFramebufferStatus(unsigned long target)
+{
+    return m_context->checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clear(unsigned long mask)
+{
+    m_context->clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context->clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearDepth(double depth)
+{
+    m_context->clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::clearStencil(long s)
+{
+    m_context->clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context->colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::compileShader(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLBuffer> WebGLRenderingContext::createBuffer()
+{
+    RefPtr<WebGLBuffer> o = WebGLBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<WebGLFramebuffer> WebGLRenderingContext::createFramebuffer()
+{
+    RefPtr<WebGLFramebuffer> o = WebGLFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLTexture> WebGLRenderingContext::createTexture()
+{
+    RefPtr<WebGLTexture> o = WebGLTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLProgram> WebGLRenderingContext::createProgram()
+{
+    RefPtr<WebGLProgram> o = WebGLProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLRenderbuffer> WebGLRenderingContext::createRenderbuffer()
+{
+    RefPtr<WebGLRenderbuffer> o = WebGLRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<WebGLShader> WebGLRenderingContext::createShader(unsigned long type, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (type != GraphicsContext3D::VERTEX_SHADER && type != GraphicsContext3D::FRAGMENT_SHADER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return 0;
+    }
+    
+    RefPtr<WebGLShader> o = WebGLShader::create(this, static_cast<GraphicsContext3D::WebGLEnumType>(type));
+    addObject(o.get());
+    return o;
+}
+
+void WebGLRenderingContext::cullFace(unsigned long mode)
+{
+    m_context->cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteProgram(WebGLProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void WebGLRenderingContext::deleteRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void WebGLRenderingContext::deleteShader(WebGLShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void WebGLRenderingContext::deleteTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void WebGLRenderingContext::depthFunc(unsigned long func)
+{
+    m_context->depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthMask(bool flag)
+{
+    m_context->depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::depthRange(double zNear, double zFar)
+{
+    m_context->depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::detachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this || !shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void WebGLRenderingContext::disable(unsigned long cap)
+{
+    m_context->disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::disableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index < m_vertexAttribState.size())
+        m_vertexAttribState[index].enabled = false;
+    
+    m_context->disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements)
+{
+    long lastIndex = -1;
+    if (!m_boundElementArrayBuffer)
+        return false;
+        
+    if (offset < 0)
+        return false;
+        
+    // The GL spec says that count must be "greater
+    
+    unsigned long uoffset = static_cast<unsigned long>(offset);
+    
+    if (type == GraphicsContext3D::UNSIGNED_SHORT) {
+        // For an unsigned short array, offset must be divisible by 2 for alignment reasons.
+        if (uoffset & 1)
+            return false;
+        
+        // Make uoffset an element offset.
+        uoffset /= 2;
+    
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
+        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+        if (uoffset > n || count > n - uoffset)
+            return false;
+            
+        const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+        while (n-- > 0) {
+            if (*p > lastIndex)
+                lastIndex = *p;
+            ++p;
+        }
+    }    
+        
+    // Then set the last index in the index array and make sure it is valid.
+    numElements = lastIndex + 1;
+    return numElements > 0;
+}
+
+bool WebGLRenderingContext::validateRenderingState(long numElements)
+{
+    // Look in each enabled vertex attrib and find the smallest buffer size
+    long smallestNumElements = LONG_MAX;
+    for (unsigned i = 0; i < m_vertexAttribState.size(); ++i) {
+        const VertexAttribState& state = m_vertexAttribState[i];
+        if (state.enabled && state.numElements < smallestNumElements)
+            smallestNumElements = state.numElements;
+    }
+    
+    if (smallestNumElements == LONG_MAX)
+        smallestNumElements = 0;
+    
+    return numElements <= smallestNumElements;
+}
+
+void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long count, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    if (first < 0 || count < 0 || !validateRenderingState(first + count)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    
+    m_context->drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    // Ensure we have a valid rendering state
+    long numElements;
+    
+    if (offset < 0 || !validateIndexArray(count, type, offset, numElements) || !validateRenderingState(numElements)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    
+    m_context->drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::enable(unsigned long cap)
+{
+    m_context->enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::enableVertexAttribArray(unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+        
+    m_vertexAttribState[index].enabled = true;
+    
+    m_context->enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::finish()
+{
+    m_context->finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void WebGLRenderingContext::flush()
+{
+    m_context->flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void WebGLRenderingContext::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (buffer && buffer->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }       
+    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (texture && texture->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::frontFace(unsigned long mode)
+{
+    m_context->frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::generateMipmap(unsigned long target)
+{
+    m_context->generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveAttrib(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveAttrib(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveUniform(WebGLProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    ActiveInfo info;
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    if (!m_context->getActiveUniform(program, index, info)) {
+        return 0;
+    }
+    return WebGLActiveInfo::create(info.name, info.type, info.size);
+}
+
+int WebGLRenderingContext::getAttribLocation(WebGLProgram* program, const String& name)
+{
+    return m_context->getAttribLocation(program, name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::ARRAY_BUFFER && target != GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::BUFFER_SIZE && pname != GraphicsContext3D::BUFFER_USAGE) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value;
+    m_context->getBufferParameteriv(target, pname, &value);
+    if (pname == GraphicsContext3D::BUFFER_SIZE)
+        return WebGLGetInfo(static_cast<long>(value));
+    else
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+unsigned long WebGLRenderingContext::getError()
+{
+    return m_context->getError();
+}
+
+WebGLGetInfo WebGLRenderingContext::getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::FRAMEBUFFER
+        || (attachment != GraphicsContext3D::COLOR_ATTACHMENT0
+            && attachment != GraphicsContext3D::DEPTH_ATTACHMENT
+            && attachment != GraphicsContext3D::STENCIL_ATTACHMENT)
+        || (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL
+            && pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    if (pname != GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME) {
+        WebGLStateRestorer(this, false);
+        int value;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, pname, &value);
+        if (pname == GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE)
+            return WebGLGetInfo(static_cast<unsigned long>(value));
+        else
+            return WebGLGetInfo(static_cast<long>(value));
+    } else {
+        WebGLStateRestorer(this, false);
+        int type = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE, &type);
+        int value = 0;
+        m_context->getFramebufferAttachmentParameteriv(target, attachment, GraphicsContext3D::FRAMEBUFFER_ATTACHMENT_OBJECT_NAME, &value);
+        // FIXME: should consider canonicalizing these objects
+        switch (type) {
+        case GraphicsContext3D::RENDERBUFFER: {
+            RefPtr<WebGLRenderbuffer> tmp = WebGLRenderbuffer::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(tmp));
+        }
+        case GraphicsContext3D::TEXTURE: {
+            RefPtr<WebGLTexture> tmp = WebGLTexture::create(this, value);
+            addObject(tmp.get());
+            return WebGLGetInfo(PassRefPtr<WebGLTexture>(tmp));
+        }
+        default:
+            // FIXME: raise exception?
+            return WebGLGetInfo();
+        }
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::ACTIVE_TEXTURE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::ALPHA_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundArrayBuffer));
+    case GraphicsContext3D::BLEND:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::BLEND_COLOR:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::BLEND_DST_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_DST_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_EQUATION_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_ALPHA:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLEND_SRC_RGB:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::BLUE_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        return getWebGLUnsignedByteArrayParameter(pname);
+    case GraphicsContext3D::COMPRESSED_TEXTURE_FORMATS:
+        // Defined as null in the spec
+        return WebGLGetInfo();
+    case GraphicsContext3D::CULL_FACE:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::CULL_FACE_MODE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::CURRENT_PROGRAM:
+        return WebGLGetInfo(PassRefPtr<WebGLProgram>(m_currentProgram));
+    case GraphicsContext3D::DEPTH_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::DEPTH_CLEAR_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::DEPTH_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::DEPTH_RANGE:
+        return getWebGLFloatArrayParameter(pname);
+    case GraphicsContext3D::DEPTH_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DEPTH_WRITEMASK:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::DITHER:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::ELEMENT_ARRAY_BUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_boundElementArrayBuffer));
+    case GraphicsContext3D::FRAMEBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLFramebuffer>(m_framebufferBinding));
+    case GraphicsContext3D::FRONT_FACE:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GENERATE_MIPMAP_HINT:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::GREEN_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::LINE_WIDTH:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_CUBE_MAP_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_FRAGMENT_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_RENDERBUFFER_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_TEXTURE_SIZE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VARYING_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_ATTRIBS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_TEXTURE_IMAGE_UNITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VERTEX_UNIFORM_VECTORS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::NUM_COMPRESSED_TEXTURE_FORMATS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::NUM_SHADER_BINARY_FORMATS:
+        // FIXME: should we always return 0 for this?
+        return getLongParameter(pname);
+    case GraphicsContext3D::PACK_ALIGNMENT:
+        return getLongParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FACTOR:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_FILL:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::POLYGON_OFFSET_UNITS:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::RED_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::RENDERBUFFER_BINDING:
+        return WebGLGetInfo(PassRefPtr<WebGLRenderbuffer>(m_renderbufferBinding));
+    case GraphicsContext3D::SAMPLE_BUFFERS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_INVERT:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::SAMPLE_COVERAGE_VALUE:
+        return getFloatParameter(pname);
+    case GraphicsContext3D::SAMPLES:
+        return getLongParameter(pname);
+    case GraphicsContext3D::SCISSOR_BOX:
+        return getWebGLIntArrayParameter(pname);
+    case GraphicsContext3D::SCISSOR_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BACK_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_CLEAR_VALUE:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_FUNC:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_FAIL:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_PASS_DEPTH_PASS:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_REF:
+        return getLongParameter(pname);
+    case GraphicsContext3D::STENCIL_TEST:
+        return getBooleanParameter(pname);
+    case GraphicsContext3D::STENCIL_VALUE_MASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::STENCIL_WRITEMASK:
+        return getUnsignedLongParameter(pname);
+    case GraphicsContext3D::SUBPIXEL_BITS:
+        return getLongParameter(pname);
+    case GraphicsContext3D::TEXTURE_BINDING_2D:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_texture2DBinding));
+    case GraphicsContext3D::TEXTURE_BINDING_CUBE_MAP:
+        return WebGLGetInfo(PassRefPtr<WebGLTexture>(m_textureUnits[m_activeTextureUnit].m_textureCubeMapBinding));
+    case GraphicsContext3D::UNPACK_ALIGNMENT:
+        // FIXME: should this be "long" in the spec?
+        return getIntParameter(pname);
+    case GraphicsContext3D::VIEWPORT:
+        return getWebGLIntArrayParameter(pname);
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::LINK_STATUS:
+    case GraphicsContext3D::VALIDATE_STATUS:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::ATTACHED_SHADERS:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTES:
+    case GraphicsContext3D::ACTIVE_ATTRIBUTE_MAX_LENGTH:
+    case GraphicsContext3D::ACTIVE_UNIFORMS:
+    case GraphicsContext3D::ACTIVE_UNIFORM_MAX_LENGTH:
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getProgramInfoLog(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getProgramInfoLog(program);
+}
+
+WebGLGetInfo WebGLRenderingContext::getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::RENDERBUFFER) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::RENDERBUFFER_WIDTH:
+    case GraphicsContext3D::RENDERBUFFER_HEIGHT:
+    case GraphicsContext3D::RENDERBUFFER_RED_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_GREEN_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_BLUE_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_ALPHA_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_DEPTH_SIZE:
+    case GraphicsContext3D::RENDERBUFFER_STENCIL_SIZE:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    case GraphicsContext3D::RENDERBUFFER_INTERNAL_FORMAT:
+        m_context->getRenderbufferParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getShaderParameter(WebGLShader* shader, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::DELETE_STATUS:
+    case GraphicsContext3D::COMPILE_STATUS:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::SHADER_TYPE:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    case GraphicsContext3D::INFO_LOG_LENGTH:
+    case GraphicsContext3D::SHADER_SOURCE_LENGTH:
+        m_context->getShaderiv(shader, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+String WebGLRenderingContext::getShaderInfoLog(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderInfoLog(shader);
+}
+
+String WebGLRenderingContext::getShaderSource(WebGLShader* shader, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return "";
+    }
+    WebGLStateRestorer(this, false);
+    return m_context->getShaderSource(shader);
+}
+
+String WebGLRenderingContext::getString(unsigned long name)
+{
+    WebGLStateRestorer(this, false);
+    return m_context->getString(name);
+}
+
+WebGLGetInfo WebGLRenderingContext::getTexParameter(unsigned long target, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (target != GraphicsContext3D::TEXTURE_2D
+        && target != GraphicsContext3D::TEXTURE_CUBE_MAP) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    WebGLStateRestorer(this, false);
+    int value = 0;
+    switch (pname) {
+    case GraphicsContext3D::TEXTURE_MAG_FILTER:
+    case GraphicsContext3D::TEXTURE_MIN_FILTER:
+    case GraphicsContext3D::TEXTURE_WRAP_S:
+    case GraphicsContext3D::TEXTURE_WRAP_T:
+        m_context->getTexParameteriv(target, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+}
+
+WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebGLUniformLocation* uniformLocation, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || uniformLocation->program() != program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return WebGLGetInfo();
+    }
+    long location = uniformLocation->location();
+    
+    WebGLStateRestorer(this, false);
+    // FIXME: make this more efficient using WebGLUniformLocation and caching types in it
+    int activeUniforms = 0;
+    m_context->getProgramiv(program, GraphicsContext3D::ACTIVE_UNIFORMS, &activeUniforms);
+    for (int i = 0; i < activeUniforms; i++) {
+        ActiveInfo info;
+        if (!m_context->getActiveUniform(program, i, info))
+            return WebGLGetInfo();
+        // Now need to look this up by name again to find its location
+        long loc = m_context->getUniformLocation(program, info.name);
+        if (loc == location) {
+            // Found it. Use the type in the ActiveInfo to determine the return type.
+            GraphicsContext3D::WebGLEnumType baseType;
+            unsigned length;
+            switch (info.type) {
+                case GraphicsContext3D::BOOL:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::BOOL_VEC2:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::BOOL_VEC3:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::BOOL_VEC4:
+                    baseType = GraphicsContext3D::BOOL;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::INT:
+                    baseType = GraphicsContext3D::INT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::INT_VEC2:
+                    baseType = GraphicsContext3D::INT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::INT_VEC3:
+                    baseType = GraphicsContext3D::INT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::INT_VEC4:
+                    baseType = GraphicsContext3D::INT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 1;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 2;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 3;
+                    break;
+                case GraphicsContext3D::FLOAT_VEC4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT2:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 4;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT3:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 9;
+                    break;
+                case GraphicsContext3D::FLOAT_MAT4:
+                    baseType = GraphicsContext3D::FLOAT;
+                    length = 16;
+                    break;
+                default:
+                    // Can't handle this type
+                    // FIXME: what to do about samplers?
+                    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+                    return WebGLGetInfo();
+            }
+            switch (baseType) {
+            case GraphicsContext3D::FLOAT: {
+                float value[16] = {0};
+                m_context->getUniformfv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(value[0]);
+                else
+                    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+            }
+            case GraphicsContext3D::INT: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<long>(value[0]));
+                else
+                    return WebGLGetInfo(WebGLIntArray::create(value, length));
+            }
+            case GraphicsContext3D::BOOL: {
+                int value[16] = {0};
+                m_context->getUniformiv(program, location, value);
+                if (length == 1)
+                    return WebGLGetInfo(static_cast<bool>(value[0]));
+                else {
+                    unsigned char boolValue[16] = {0};
+                    for (unsigned j = 0; j < length; j++)
+                        boolValue[j] = static_cast<bool>(value[j]);
+                    return WebGLGetInfo(WebGLUnsignedByteArray::create(boolValue, length));
+                }
+            }
+            default:
+                notImplemented();
+            }
+        }
+    }
+    // If we get here, something went wrong in our unfortunately complex logic above
+    m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    return WebGLGetInfo();
+}
+
+PassRefPtr<WebGLUniformLocation> WebGLRenderingContext::getUniformLocation(WebGLProgram* program, const String& name, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return 0;
+    }
+    WebGLStateRestorer(this, false);
+    return WebGLUniformLocation::create(program, m_context->getUniformLocation(program, name));
+}
+
+WebGLGetInfo WebGLRenderingContext::getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    WebGLStateRestorer(this, false);
+    switch (pname) {
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING: {
+        int name = 0;
+        m_context->getVertexAttribiv(index, pname, &name);
+        if (name == 0)
+            return WebGLGetInfo();
+        RefPtr<WebGLBuffer> tmp = WebGLBuffer::create(this, name);
+        addObject(tmp.get());
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(tmp));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_ENABLED:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_NORMALIZED: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_SIZE:
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<long>(value));
+    }
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE: {
+        int value = 0;
+        m_context->getVertexAttribiv(index, pname, &value);
+        return WebGLGetInfo(static_cast<unsigned long>(value));
+    }
+    case GraphicsContext3D::CURRENT_VERTEX_ATTRIB: {
+        float value[4] = {0};
+        m_context->getVertexAttribfv(index, pname, value);
+        return WebGLGetInfo(WebGLFloatArray::create(value, 4));
+    }
+    default: {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
+    }
+    }
+}
+
+long WebGLRenderingContext::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context->getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void WebGLRenderingContext::hint(unsigned long target, unsigned long mode)
+{
+    m_context->hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool WebGLRenderingContext::isBuffer(WebGLBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+
+    return m_context->isBuffer(buffer);
+}
+
+bool WebGLRenderingContext::isEnabled(unsigned long cap)
+{
+    return m_context->isEnabled(cap);
+}
+
+bool WebGLRenderingContext::isFramebuffer(WebGLFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+
+    return m_context->isFramebuffer(framebuffer);
+}
+
+bool WebGLRenderingContext::isProgram(WebGLProgram* program)
+{
+    if (!program)
+        return false;
+
+    return m_context->isProgram(program);
+}
+
+bool WebGLRenderingContext::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+
+    return m_context->isRenderbuffer(renderbuffer);
+}
+
+bool WebGLRenderingContext::isShader(WebGLShader* shader)
+{
+    if (!shader)
+        return false;
+
+    return m_context->isShader(shader);
+}
+
+bool WebGLRenderingContext::isTexture(WebGLTexture* texture)
+{
+    if (!texture)
+        return false;
+
+    return m_context->isTexture(texture);
+}
+
+void WebGLRenderingContext::lineWidth(double width)
+{
+    m_context->lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::pixelStorei(unsigned long pname, long param)
+{
+    m_context->pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::polygonOffset(double factor, double units)
+{
+    m_context->polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<WebGLArray> WebGLRenderingContext::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<WebGLArray> array = m_context->readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+void WebGLRenderingContext::releaseShaderCompiler()
+{
+    m_context->releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context->renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::sampleCoverage(double value, bool invert)
+{
+    m_context->sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context->scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::shaderSource(WebGLShader* shader, const String& string, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!shader || shader->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+    m_context->shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context->stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMask(unsigned long mask)
+{
+    m_context->stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context->stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context->stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    // FIXME: For now we ignore any errors returned
+    m_context->texImage2D(target, level, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context->texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context->texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLImageElement* image,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    if (!image) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, cachedImage->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!canvas) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    // FIXME: For now we ignore any errors returned
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, buffer->image(), flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLVideoElement* video,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1f(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1fv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform1i(location->location(), x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    m_context->uniform1iv(location->location(), v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2f(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2fv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform2i(location->location(), x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 2
+    m_context->uniform2iv(location->location(), v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3f(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3fv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform3i(location->location(), x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 3
+    m_context->uniform3iv(location->location(), v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4f(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4fv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    m_context->uniform4i(location->location(), x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniform4iv(location->location(), v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 4
+    m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 9
+    m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* v, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!location || location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // FIXME: length needs to be a multiple of 16
+    m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+        
+    m_currentProgram = program;
+    m_context->useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::validateProgram(WebGLProgram* program, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!program || program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
+        
+    m_context->validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context->vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context->vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context->vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, WebGLFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context->vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context->vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    
+    if (indx >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(indx + 1);
+
+    // Determine the number of elements the bound buffer can hold, given the offset, size, type and stride
+    long bytesPerElement = size * sizeInBytes(type, ec);
+    if (bytesPerElement <= 0)
+        return;
+    long validatedStride = bytesPerElement;
+    if (stride != 0) {
+        if ((long) stride < bytesPerElement) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+            return;
+        }
+        
+        validatedStride = stride;
+    }
+        
+    // Avoid off-by-one errors in numElements computation.
+    // For the last element, we will only touch the data for the
+    // element and nothing beyond it.
+    long bytesRemaining = m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset;
+    if (bytesRemaining < bytesPerElement)
+        m_vertexAttribState[indx].numElements = 0;
+    else
+        m_vertexAttribState[indx].numElements = 1 + (bytesRemaining - bytesPerElement) / validatedStride;
+
+    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context->viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void WebGLRenderingContext::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void WebGLRenderingContext::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void WebGLRenderingContext::detachAndRemoveAllObjects()
+{
+    HashSet<RefPtr<CanvasObject> >::iterator pend = m_canvasObjects.end();
+    for (HashSet<RefPtr<CanvasObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+WebGLGetInfo WebGLRenderingContext::getBooleanParameter(unsigned long pname)
+{
+    unsigned char value;
+    m_context->getBooleanv(pname, &value);
+    return WebGLGetInfo(static_cast<bool>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getFloatParameter(unsigned long pname)
+{
+    float value;
+    m_context->getFloatv(pname, &value);
+    return WebGLGetInfo(static_cast<float>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getIntParameter(unsigned long pname)
+{
+    return getLongParameter(pname);
+}
+
+WebGLGetInfo WebGLRenderingContext::getLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getUnsignedLongParameter(unsigned long pname)
+{
+    int value;
+    m_context->getIntegerv(pname, &value);
+    return WebGLGetInfo(static_cast<unsigned long>(value));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLFloatArrayParameter(unsigned long pname)
+{
+    float value[4] = {0};
+    m_context->getFloatv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::ALIASED_POINT_SIZE_RANGE:
+    case GraphicsContext3D::ALIASED_LINE_WIDTH_RANGE:
+    case GraphicsContext3D::DEPTH_RANGE:
+        length = 2;
+        break;
+    case GraphicsContext3D::BLEND_COLOR:
+    case GraphicsContext3D::COLOR_CLEAR_VALUE:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLFloatArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLIntArrayParameter(unsigned long pname)
+{
+    int value[4] = {0};
+    m_context->getIntegerv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::MAX_VIEWPORT_DIMS:
+        length = 2;
+        break;
+    case GraphicsContext3D::SCISSOR_BOX:
+    case GraphicsContext3D::VIEWPORT:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLIntArray::create(value, length));
+}
+
+WebGLGetInfo WebGLRenderingContext::getWebGLUnsignedByteArrayParameter(unsigned long pname)
+{
+    unsigned char value[4] = {0};
+    m_context->getBooleanv(pname, value);
+    unsigned length = 0;
+    switch (pname) {
+    case GraphicsContext3D::COLOR_WRITEMASK:
+        length = 4;
+        break;
+    default:
+        notImplemented();
+    }
+    return WebGLGetInfo(WebGLUnsignedByteArray::create(value, length));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
new file mode 100644
index 0000000..3335eba
--- /dev/null
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLRenderingContext_h
+#define WebGLRenderingContext_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "WebGLFloatArray.h"
+#include "WebGLGetInfo.h"
+#include "WebGLIntArray.h"
+#include "WebGLUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class WebGLActiveInfo;
+class WebGLBuffer;
+class WebGLFramebuffer;
+class CanvasObject;
+class WebGLProgram;
+class WebGLRenderbuffer;
+class WebGLShader;
+class WebGLTexture;
+class WebGLUniformLocation;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class WebGLRenderingContext : public CanvasRenderingContext {
+    public:
+        static PassOwnPtr<WebGLRenderingContext> create(HTMLCanvasElement*);
+        virtual ~WebGLRenderingContext();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture, ExceptionCode& ec);
+        void attachShader(WebGLProgram*, WebGLShader*, ExceptionCode& ec);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name, ExceptionCode& ec);
+        void bindBuffer(unsigned long target, WebGLBuffer*, ExceptionCode& ec);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*, ExceptionCode& ec);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*, ExceptionCode& ec);
+        void bindTexture(unsigned long target, WebGLTexture*, ExceptionCode& ec);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage, ExceptionCode&);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage, ExceptionCode&);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data, ExceptionCode&);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(WebGLShader*, ExceptionCode& ec);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<WebGLBuffer> createBuffer();
+        PassRefPtr<WebGLFramebuffer> createFramebuffer();
+        PassRefPtr<WebGLProgram> createProgram();
+        PassRefPtr<WebGLRenderbuffer> createRenderbuffer();
+        PassRefPtr<WebGLShader> createShader(unsigned long type, ExceptionCode&);
+        PassRefPtr<WebGLTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(WebGLBuffer*);
+        void deleteFramebuffer(WebGLFramebuffer*);
+        void deleteProgram(WebGLProgram*);
+        void deleteRenderbuffer(WebGLRenderbuffer*);
+        void deleteShader(WebGLShader*);
+        void deleteTexture(WebGLTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(WebGLProgram*, WebGLShader*, ExceptionCode&);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void drawArrays(unsigned long mode, long first, long count, ExceptionCode&);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset, ExceptionCode&);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index, ExceptionCode&);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*, ExceptionCode& ec);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level, ExceptionCode& ec);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, unsigned long index, ExceptionCode&);
+
+        int  getAttribLocation(WebGLProgram*, const String& name);
+
+        WebGLGetInfo getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        unsigned long getError();
+
+        WebGLGetInfo getFramebufferAttachmentParameter(unsigned long target, unsigned long attachment, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getParameter(unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getProgramParameter(WebGLProgram*, unsigned long pname, ExceptionCode&);
+
+        String getProgramInfoLog(WebGLProgram*, ExceptionCode& ec);
+
+        WebGLGetInfo getRenderbufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getShaderParameter(WebGLShader*, unsigned long pname, ExceptionCode& ec);
+
+        String getShaderInfoLog(WebGLShader*, ExceptionCode& ec);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(WebGLShader*, ExceptionCode&);
+        String getString(unsigned long name);
+
+        WebGLGetInfo getTexParameter(unsigned long target, unsigned long pname, ExceptionCode&);
+
+        WebGLGetInfo getUniform(WebGLProgram*, const WebGLUniformLocation*, ExceptionCode&);
+
+        PassRefPtr<WebGLUniformLocation> getUniformLocation(WebGLProgram*, const String&, ExceptionCode&);
+
+        WebGLGetInfo getVertexAttrib(unsigned long index, unsigned long pname, ExceptionCode&);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(WebGLBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
+        void lineWidth(double);
+        void linkProgram(WebGLProgram*, ExceptionCode&);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(WebGLShader*, const String&, ExceptionCode&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, WebGLArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLImageElement* image,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLVideoElement* video,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(const WebGLUniformLocation* location, float x, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform1i(const WebGLUniformLocation* location, int x, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform2f(const WebGLUniformLocation* location, float x, float y, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform2i(const WebGLUniformLocation* location, int x, int y, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform3f(const WebGLUniformLocation* location, float x, float y, float z, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform3i(const WebGLUniformLocation* location, int x, int y, int z, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniform4f(const WebGLUniformLocation* location, float x, float y, float z, float w, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, WebGLFloatArray* v, ExceptionCode&);
+        void uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode&);
+        void uniform4i(const WebGLUniformLocation* location, int x, int y, int z, int w, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, WebGLIntArray* v, ExceptionCode&);
+        void uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, WebGLFloatArray* value, ExceptionCode&);
+        void uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* value, int size, ExceptionCode&);
+
+        void useProgram(WebGLProgram*, ExceptionCode&);
+        void validateProgram(WebGLProgram*, ExceptionCode&);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, WebGLFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset, ExceptionCode&);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+
+        WebGLRenderingContext(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            if (changed)
+                markContextChanged();
+        }
+        
+        bool validateIndexArray(unsigned long count, unsigned long type, long offset, long& numElements);
+        bool validateRenderingState(long numElements);
+
+        OwnPtr<GraphicsContext3D> m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<RefPtr<CanvasObject> > m_canvasObjects;
+        
+        // List of bound VBO's. Used to maintain info about sizes for ARRAY_BUFFER and stored values for ELEMENT_ARRAY_BUFFER
+        RefPtr<WebGLBuffer> m_boundArrayBuffer;
+        RefPtr<WebGLBuffer> m_boundElementArrayBuffer;
+    
+        // Cached values for vertex attrib range checks
+        class VertexAttribState {
+        public:
+            VertexAttribState() : enabled(false), numElements(0) { }
+            bool enabled;
+            long numElements;
+        };
+        
+        Vector<VertexAttribState> m_vertexAttribState;
+        unsigned m_maxVertexAttribs;
+
+        RefPtr<WebGLProgram> m_currentProgram;
+        RefPtr<WebGLFramebuffer> m_framebufferBinding;
+        RefPtr<WebGLRenderbuffer> m_renderbufferBinding;
+        class TextureUnitState {
+        public:
+            RefPtr<WebGLTexture> m_texture2DBinding;
+            RefPtr<WebGLTexture> m_textureCubeMapBinding;
+        };
+        TextureUnitState m_textureUnits[32];
+        unsigned long m_activeTextureUnit;
+
+        // Helpers for getParameter and others
+        WebGLGetInfo getBooleanParameter(unsigned long pname);
+        WebGLGetInfo getFloatParameter(unsigned long pname);
+        WebGLGetInfo getIntParameter(unsigned long pname);
+        WebGLGetInfo getLongParameter(unsigned long pname);
+        WebGLGetInfo getUnsignedLongParameter(unsigned long pname);
+        WebGLGetInfo getWebGLFloatArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLIntArrayParameter(unsigned long pname);
+        WebGLGetInfo getWebGLUnsignedByteArrayParameter(unsigned long pname);
+
+        friend class WebGLStateRestorer;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.idl b/WebCore/html/canvas/WebGLRenderingContext.idl
index db0fff3..78de8c8 100644
--- a/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -30,7 +30,7 @@ module html {
         GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext3D : CanvasRenderingContext {
+    ] WebGLRenderingContext : CanvasRenderingContext {
 
         /* ClearBufferMask */
         const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
@@ -460,25 +460,26 @@ module html {
 
         long sizeInBytes(in unsigned long type) raises(DOMException);
 
-        void         activeTexture(in unsigned long texture);
-        void         attachShader(in CanvasProgram program, in CanvasShader shader);
-        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
-        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
-        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
-        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
-        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         activeTexture(in unsigned long texture) raises(DOMException);
+        void         attachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
+        void         bindAttribLocation(in WebGLProgram program, in unsigned long index, in DOMString name) raises(DOMException);
+        void         bindBuffer(in unsigned long target, in WebGLBuffer buffer) raises(DOMException);
+        void         bindFramebuffer(in unsigned long target, in WebGLFramebuffer framebuffer) raises(DOMException);
+        void         bindRenderbuffer(in unsigned long target, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         bindTexture(in unsigned long target, in WebGLTexture texture) raises(DOMException);
         void         blendColor(in double red, in double green, in double blue, in double alpha);
         void         blendEquation( in unsigned long mode );
         void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
         void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
         void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+
         // Supported forms:
         //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
-        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
-        [Custom] void bufferData();
+        //   void bufferData (in GLenum target, in WebGLArray data, in GLenum usage);
+        [Custom] void bufferData() raises(DOMException);
         // Supported forms:
-        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
-        [Custom] void bufferSubData();
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in WebGLArray data);
+        [Custom] void bufferSubData() raises(DOMException);
 
         unsigned long checkFramebufferStatus(in unsigned long target);
         void         clear(in unsigned long mask);
@@ -486,7 +487,7 @@ module html {
         void         clearDepth(in double depth);
         void         clearStencil(in long s);
         void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
-        void         compileShader(in CanvasShader shader);
+        void         compileShader(in WebGLShader shader) raises(DOMException);
         
         //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
         //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
@@ -494,119 +495,108 @@ module html {
         void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
         void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
 
-        CanvasBuffer createBuffer();
-        CanvasFramebuffer createFramebuffer();
-        CanvasProgram createProgram();
-        CanvasRenderbuffer createRenderbuffer();
-        CanvasShader createShader(in unsigned long type);
-        CanvasTexture createTexture();
+        WebGLBuffer createBuffer();
+        WebGLFramebuffer createFramebuffer();
+        WebGLProgram createProgram();
+        WebGLRenderbuffer createRenderbuffer();
+        WebGLShader createShader(in unsigned long type) raises(DOMException);
+        WebGLTexture createTexture();
 
         void         cullFace(in unsigned long mode);
 
-        void         deleteBuffer(in CanvasBuffer buffer);
-        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
-        void         deleteProgram(in CanvasProgram program);
-        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        void         deleteShader(in CanvasShader shader);
-        void         deleteTexture(in CanvasTexture texture);
+        void         deleteBuffer(in WebGLBuffer buffer);
+        void         deleteFramebuffer(in WebGLFramebuffer framebuffer);
+        void         deleteProgram(in WebGLProgram program);
+        void         deleteRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        void         deleteShader(in WebGLShader shader);
+        void         deleteTexture(in WebGLTexture texture);
 
         void         depthFunc(in unsigned long func);
         void         depthMask(in boolean flag);
         // FIXME: this differs from the current WebGL spec (depthRangef)
         void         depthRange(in double zNear, in double zFar);
-        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         detachShader(in WebGLProgram program, in WebGLShader shader) raises(DOMException);
         void         disable(in unsigned long cap);
-        void         disableVertexAttribArray(in unsigned long index);
-        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
-        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+        void         disableVertexAttribArray(in unsigned long index) raises(DOMException);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count) raises(DOMException);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset) raises(DOMException);
 
         void         enable(in unsigned long cap);
-        void         enableVertexAttribArray(in unsigned long index);
+        void         enableVertexAttribArray(in unsigned long index) raises(DOMException);
         void         finish();
         void         flush();
-        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
-        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in WebGLRenderbuffer renderbuffer) raises(DOMException);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in WebGLTexture texture, in long level) raises(DOMException);
         void         frontFace(in unsigned long mode);
         void         generateMipmap(in unsigned long target);
         
-        // FIXME: these need to be added per the WebGL spec
-        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveAttrib(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
-        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+        WebGLActiveInfo getActiveUniform(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
 
-        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+        // WebGLShaderArray glGetAttachedShaders(GLuint program);
 
-        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+        int          getAttribLocation(in WebGLProgram program, in DOMString name);
 
-        boolean getBoolean(in unsigned long pname);
-        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
-        long getBufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+        // any getBufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getBufferParameter();
 
         unsigned long getError();
 
-        float getFloat(in unsigned long pname);
-        CanvasFloatArray getFloatv(in unsigned long pname);
-        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
-        long getInteger(in unsigned long pname);
-        CanvasIntArray getIntegerv(in unsigned long pname);
-        long getProgrami(in CanvasProgram program, in unsigned long pname);
-        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
-        DOMString getProgramInfoLog(in CanvasProgram program);
-        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
-        long getShaderi(in CanvasShader shader, in unsigned long pname);
-        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
-
-        DOMString    getShaderInfoLog(in CanvasShader shader);
+        // any getFramebufferAttachmentParameter(in unsigned long target, in unsigned long attachment, in unsigned long pname) raises(DOMException);
+        [Custom] void getFramebufferAttachmentParameter();
+        // any getParameter(in unsigned long pname) raises(DOMException);
+        [Custom] void getParameter();
+        // any getProgramParameter(in WebGLProgram program, in unsigned long pname) raises(DOMException);
+        [Custom] void getProgramParameter();
+        DOMString getProgramInfoLog(in WebGLProgram program) raises(DOMException);
+        // any getRenderbufferParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getRenderbufferParameter();
+        // any getShaderParameter(in WebGLShader shader, in unsigned long pname) raises(DOMException);
+        [Custom] void getShaderParameter() raises(DOMException);
+
+        DOMString    getShaderInfoLog(in WebGLShader shader) raises(DOMException);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getShaderSource(in WebGLShader shader) raises(DOMException);
         DOMString    getString(in unsigned long name);
 
-        float getTexParameterf(in unsigned long target, in unsigned long pname);
-        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
-        long getTexParameteri(in unsigned long target, in unsigned long pname);
-        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+        // any getTexParameter(in unsigned long target, in unsigned long pname) raises(DOMException);
+        [Custom] void getTexParameter();
 
-        float getUniformf(in CanvasProgram program, in long location);
-        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
-        long getUniformi(in CanvasProgram program, in long location);
-        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
-        
-        long getUniformLocation(in CanvasProgram program, in DOMString name);
+        // any getUniform(in WebGLProgram program, in WebGLUniformLocation location) raises(DOMException);
+        [Custom] void getUniform();
 
-        float getVertexAttribf(in unsigned long index, in unsigned long pname);
-        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
-        long getVertexAttribi(in unsigned long index, in unsigned long pname);
-        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+        WebGLUniformLocation getUniformLocation(in WebGLProgram program, in DOMString name) raises(DOMException);
+
+        // any getVertexAttrib(in unsigned long index, in unsigned long pname) raises(DOMException);
+        [Custom] void getVertexAttrib();
 
         long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
 
         void         hint(in unsigned long target, in unsigned long mode);
-        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isBuffer(in WebGLBuffer buffer);
         boolean      isEnabled(in unsigned long cap);
-        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
-        boolean      isProgram(in CanvasProgram program);
-        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
-        boolean      isShader(in CanvasShader shader);
-        boolean      isTexture(in CanvasTexture texture);
+        boolean      isFramebuffer(in WebGLFramebuffer framebuffer);
+        boolean      isProgram(in WebGLProgram program);
+        boolean      isRenderbuffer(in WebGLRenderbuffer renderbuffer);
+        boolean      isShader(in WebGLShader shader);
+        boolean      isTexture(in WebGLTexture texture);
         void         lineWidth(in double width);
-        void         linkProgram(in CanvasProgram program);
+        void         linkProgram(in WebGLProgram program) raises(DOMException);
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
-        
-        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
+
+        WebGLArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
         void         sampleCoverage(in double value, in boolean invert);
         void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
-        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         shaderSource(in WebGLShader shader, in DOMString string) raises(DOMException);
         void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
         void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
         void         stencilMask(in unsigned long mask);
@@ -619,7 +609,7 @@ module html {
 
         // Supported forms:
         //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
-        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
+        //                   in GLint border, in GLenum format, in GLenum type, in WebGLArray pixels);
         //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
         //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
         //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
@@ -633,7 +623,7 @@ module html {
         // Supported forms:
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
         //                      in GLsizei width, in GLsizei height, 
-        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
+        //                      in GLenum format, in GLenum type, in WebGLArray pixels);
         //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
         //                      in GLsizei width, in GLsizei height, 
         //                      in GLenum format, in GLenum type, in ImageData pixels);
@@ -648,40 +638,40 @@ module html {
         //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
         [Custom] void texSubImage2D();
 
-        void uniform1f(in long location, in float x);
-        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
-        void uniform1i(in long location, in long x);
-        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
-        void uniform2f(in long location, in float x, in float y);
-        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
-        void uniform2i(in long location, in long x, in long y);
-        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
-        void uniform3f(in long location, in float x, in float y, in float z);
-        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
-        void uniform3i(in long location, in long x, in long y, in long z);
-        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
-        void uniform4f(in long location, in float x, in float y, in float z, in float w);
-        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
-        void uniform4i(in long location, in long x, in long y, in long z, in long w);
-        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
-
-        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
-        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
-
-        void         useProgram(in CanvasProgram program);
-        void         validateProgram(in CanvasProgram program);
+        void uniform1f(in WebGLUniformLocation location, in float x) raises(DOMException);
+        [Custom] void uniform1fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform1i(in WebGLUniformLocation location, in long x) raises(DOMException);
+        [Custom] void uniform1iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform2f(in WebGLUniformLocation location, in float x, in float y) raises(DOMException);
+        [Custom] void uniform2fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform2i(in WebGLUniformLocation location, in long x, in long y) raises(DOMException);
+        [Custom] void uniform2iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform3f(in WebGLUniformLocation location, in float x, in float y, in float z) raises(DOMException);
+        [Custom] void uniform3fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform3i(in WebGLUniformLocation location, in long x, in long y, in long z) raises(DOMException);
+        [Custom] void uniform3iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+        void uniform4f(in WebGLUniformLocation location, in float x, in float y, in float z, in float w) raises(DOMException);
+        [Custom] void uniform4fv(in WebGLUniformLocation location, in WebGLFloatArray v) raises(DOMException);
+        void uniform4i(in WebGLUniformLocation location, in long x, in long y, in long z, in long w) raises(DOMException);
+        [Custom] void uniform4iv(in WebGLUniformLocation location, in WebGLIntArray v) raises(DOMException);
+
+        [Custom] void uniformMatrix2fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix3fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+        [Custom] void uniformMatrix4fv(in WebGLUniformLocation location, in boolean transpose, in WebGLFloatArray array) raises(DOMException);
+
+        void         useProgram(in WebGLProgram program) raises(DOMException);
+        void         validateProgram(in WebGLProgram program) raises(DOMException);
 
         void         vertexAttrib1f(in unsigned long indx, in float x);
-        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
-        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
-        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
-        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in WebGLFloatArray values);
         void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
-                                         in long stride, in unsigned long offset);
+                                         in long stride, in unsigned long offset) raises(DOMException);
 
         void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
     };
diff --git a/WebCore/html/canvas/CanvasShader.cpp b/WebCore/html/canvas/WebGLShader.cpp
index 7f134fa..a353b15 100644
--- a/WebCore/html/canvas/CanvasShader.cpp
+++ b/WebCore/html/canvas/WebGLShader.cpp
@@ -27,23 +27,23 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasShader.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLShader.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
 {
-    return adoptRef(new CanvasShader(ctx, type));
+    return adoptRef(new WebGLShader(ctx, type));
 }
 
-CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
     : CanvasObject(ctx)
 {
     setObject(context()->graphicsContext3D()->createShader(type));
 }
 
-void CanvasShader::_deleteObject(Platform3DObject object)
+void WebGLShader::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteShader(object);
 }
diff --git a/WebCore/html/canvas/CanvasShader.h b/WebCore/html/canvas/WebGLShader.h
index bb7980e..1ef912c 100644
--- a/WebCore/html/canvas/CanvasShader.h
+++ b/WebCore/html/canvas/WebGLShader.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasShader_h
-#define CanvasShader_h
+#ifndef WebGLShader_h
+#define WebGLShader_h
 
 #include "CanvasObject.h"
 
@@ -33,18 +33,18 @@
 
 namespace WebCore {
     
-    class CanvasShader : public CanvasObject {
+    class WebGLShader : public CanvasObject {
     public:
-        virtual ~CanvasShader() { deleteObject(); }
+        virtual ~WebGLShader() { deleteObject(); }
         
-        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
         
     private:
-        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        WebGLShader(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
         virtual void _deleteObject(Platform3DObject);
     };
     
 } // namespace WebCore
 
-#endif // CanvasShader_h
+#endif // WebGLShader_h
diff --git a/WebCore/html/canvas/CanvasProgram.idl b/WebCore/html/canvas/WebGLShader.idl
index 46daaf2..45e7f54 100644
--- a/WebCore/html/canvas/CanvasProgram.idl
+++ b/WebCore/html/canvas/WebGLShader.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasProgram {
+    interface [Conditional=3D_CANVAS] WebGLShader {
     };
 }
diff --git a/WebCore/html/canvas/WebGLShortArray.cpp b/WebCore/html/canvas/WebGLShortArray.cpp
new file mode 100644
index 0000000..f96a290
--- /dev/null
+++ b/WebCore/html/canvas/WebGLShortArray.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(short* array, unsigned length)
+{
+    RefPtr<WebGLShortArray> a = WebGLShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLShortArray> WebGLShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                    int byteOffset,
+                                                    unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(short)) != 0)
+        return NULL;
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(short))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLShortArray(buffer, byteOffset, length));
+}
+
+WebGLShortArray::WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLShortArray::byteLength() const {
+    return m_size * sizeof(short);
+}
+
+PassRefPtr<WebGLArray> WebGLShortArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(short);
+    unsigned limitByte = startByte + length * sizeof(short);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLShortArray::set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLShortArray.h b/WebCore/html/canvas/WebGLShortArray.h
new file mode 100644
index 0000000..70c66ca
--- /dev/null
+++ b/WebCore/html/canvas/WebGLShortArray.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLShortArray_h
+#define WebGLShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLShortArray : public WebGLArray {
+  public:
+    virtual bool isShortArray() const { return true; }
+
+    static PassRefPtr<WebGLShortArray> create(unsigned length);
+    static PassRefPtr<WebGLShortArray> create(short* array, unsigned length);
+    static PassRefPtr<WebGLShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    short* data() { return static_cast<short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<short>::min())
+            value = std::numeric_limits<short>::min();
+        else if (value > std::numeric_limits<short>::max())
+            value = std::numeric_limits<short>::max();
+        short* storage = static_cast<short*>(m_baseAddress);
+        storage[index] = static_cast<short>(value);
+    }
+
+    bool get(unsigned index, short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        short* storage = static_cast<short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLShortArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLShortArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.idl b/WebCore/html/canvas/WebGLShortArray.idl
index bb236b9..bd8380f 100644
--- a/WebCore/html/canvas/CanvasFloatArray.idl
+++ b/WebCore/html/canvas/WebGLShortArray.idl
@@ -31,6 +31,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasFloatArray : CanvasArray {
+    ] WebGLShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/CanvasTexture.cpp b/WebCore/html/canvas/WebGLTexture.cpp
index 624c275..ae09b48 100644
--- a/WebCore/html/canvas/CanvasTexture.cpp
+++ b/WebCore/html/canvas/WebGLTexture.cpp
@@ -27,24 +27,36 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "CanvasTexture.h"
-#include "CanvasRenderingContext3D.h"
+#include "WebGLTexture.h"
+#include "WebGLRenderingContext.h"
 
 namespace WebCore {
     
-PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx)
 {
-    return adoptRef(new CanvasTexture(ctx));
+    return adoptRef(new WebGLTexture(ctx));
 }
 
-CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+PassRefPtr<WebGLTexture> WebGLTexture::create(WebGLRenderingContext* ctx, Platform3DObject obj)
+{
+    return adoptRef(new WebGLTexture(ctx, obj));
+}
+
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
     , cubeMapRWrapModeInitialized(false)
 {
     setObject(context()->graphicsContext3D()->createTexture());
 }
 
-void CanvasTexture::_deleteObject(Platform3DObject object)
+WebGLTexture::WebGLTexture(WebGLRenderingContext* ctx, Platform3DObject obj)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(obj, false);
+}
+
+void WebGLTexture::_deleteObject(Platform3DObject object)
 {
     context()->graphicsContext3D()->deleteTexture(object);
 }
diff --git a/WebCore/html/canvas/CanvasTexture.h b/WebCore/html/canvas/WebGLTexture.h
index 32a669a..c64dd41 100644
--- a/WebCore/html/canvas/CanvasTexture.h
+++ b/WebCore/html/canvas/WebGLTexture.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasTexture_h
-#define CanvasTexture_h
+#ifndef WebGLTexture_h
+#define WebGLTexture_h
 
 #include "CanvasObject.h"
 
@@ -33,12 +33,16 @@
 
 namespace WebCore {
     
-    class CanvasTexture : public CanvasObject {
+    class WebGLTexture : public CanvasObject {
     public:
-        virtual ~CanvasTexture() { deleteObject(); }
+        virtual ~WebGLTexture() { deleteObject(); }
         
-        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*);
     
+        // For querying previously created objects via e.g. getFramebufferAttachmentParameter
+        // FIXME: should consider canonicalizing these objects
+        static PassRefPtr<WebGLTexture> create(WebGLRenderingContext*, Platform3DObject);
+
         bool isCubeMapRWrapModeInitialized() {
             return cubeMapRWrapModeInitialized;
         }
@@ -48,7 +52,8 @@ namespace WebCore {
         }
 
     protected:
-        CanvasTexture(CanvasRenderingContext3D*);
+        WebGLTexture(WebGLRenderingContext*);
+        WebGLTexture(WebGLRenderingContext*, Platform3DObject);
 
         virtual void _deleteObject(Platform3DObject);
 
@@ -58,4 +63,4 @@ namespace WebCore {
     
 } // namespace WebCore
 
-#endif // CanvasTexture_h
+#endif // WebGLTexture_h
diff --git a/WebCore/html/canvas/CanvasTexture.idl b/WebCore/html/canvas/WebGLTexture.idl
index 77eedd7..da7e066 100644
--- a/WebCore/html/canvas/CanvasTexture.idl
+++ b/WebCore/html/canvas/WebGLTexture.idl
@@ -24,6 +24,6 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasTexture {
+    interface [Conditional=3D_CANVAS] WebGLTexture {
     };
 }
diff --git a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/WebCore/html/canvas/WebGLUniformLocation.cpp
index 8442b87..2157470 100644
--- a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
+++ b/WebCore/html/canvas/WebGLUniformLocation.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,24 +28,21 @@
 
 #if ENABLE(3D_CANVAS)
 
-#include "JSCanvasIntArray.h"
-
-#include "CanvasIntArray.h"
-
-using namespace JSC;
+#include "WebGLUniformLocation.h"
 
 namespace WebCore {
-
-void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+    
+PassRefPtr<WebGLUniformLocation> WebGLUniformLocation::create(WebGLProgram* program, long location)
 {
-    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+    return adoptRef(new WebGLUniformLocation(program, location));
 }
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+WebGLUniformLocation::WebGLUniformLocation(WebGLProgram* program, long location)
+    : m_program(program)
+    , m_location(location)
 {
-    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
 }
 
-} // namespace WebCore
+}
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasBuffer.h b/WebCore/html/canvas/WebGLUniformLocation.h
index 8fdab82..f9f7a11 100644
--- a/WebCore/html/canvas/CanvasBuffer.h
+++ b/WebCore/html/canvas/WebGLUniformLocation.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,28 +24,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef CanvasBuffer_h
-#define CanvasBuffer_h
+#ifndef WebGLUniformLocation_h
+#define WebGLUniformLocation_h
 
 #include "CanvasObject.h"
+#include "WebGLProgram.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
-    
-    class CanvasBuffer : public CanvasObject {
-    public:
-        virtual ~CanvasBuffer() { deleteObject(); }
-        
-        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
-        
-    protected:
-        CanvasBuffer(CanvasRenderingContext3D*);
-        
-        virtual void _deleteObject(Platform3DObject o);
-    };
-    
+
+class WebGLUniformLocation : public RefCounted<WebGLUniformLocation> {
+public:
+    virtual ~WebGLUniformLocation() { }
+
+    static PassRefPtr<WebGLUniformLocation> create(WebGLProgram* program, long location);
+
+    WebGLProgram* program() const { return m_program.get(); }
+
+    long location() const { return m_location; }
+
+protected:
+    WebGLUniformLocation(WebGLProgram* program, long location);
+
+private:
+    RefPtr<WebGLProgram> m_program;
+    long m_location;
+};
+
 } // namespace WebCore
 
-#endif // CanvasBuffer_h
+#endif // WebGLUniformLocation_h
diff --git a/WebCore/html/canvas/WebGLUniformLocation.idl b/WebCore/html/canvas/WebGLUniformLocation.idl
new file mode 100644
index 0000000..b080241
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUniformLocation.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] WebGLUniformLocation {
+    };
+}
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.cpp b/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
new file mode 100644
index 0000000..3fd1b50
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedByteArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(unsigned char* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedByteArray> a = WebGLUnsignedByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedByteArray> WebGLUnsignedByteArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                  int byteOffset,
+                                                                  unsigned length)
+{
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned char))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedByteArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedByteArray::WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedByteArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedByteArray::byteLength() const {
+    return m_size * sizeof(unsigned char);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedByteArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned char);
+    unsigned limitByte = startByte + length * sizeof(unsigned char);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedByteArray::set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned char), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.h b/WebCore/html/canvas/WebGLUnsignedByteArray.h
new file mode 100644
index 0000000..6909de5
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedByteArray_h
+#define WebGLUnsignedByteArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedByteArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedByteArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(unsigned char* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedByteArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned char>::min())
+            value = std::numeric_limits<unsigned char>::min();
+        else if (value > std::numeric_limits<unsigned char>::max())
+            value = std::numeric_limits<unsigned char>::max();
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        storage[index] = static_cast<unsigned char>(value);
+    }
+
+    bool get(unsigned index, unsigned char& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned char get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned char item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedByteArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedByteArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedByteArray_h
diff --git a/WebCore/html/canvas/WebGLUnsignedByteArray.idl b/WebCore/html/canvas/WebGLUnsignedByteArray.idl
new file mode 100644
index 0000000..57aa4ff
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedByteArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] WebGLUnsignedByteArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedByteArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/WebCore/html/canvas/WebGLUnsignedIntArray.cpp b/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
new file mode 100644
index 0000000..97910f9
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedIntArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned int));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(unsigned int* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedIntArray> a = WebGLUnsignedIntArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedIntArray> WebGLUnsignedIntArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                int byteOffset,
+                                                                unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(unsigned int)) != 0) {
+        return NULL;
+    }
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned int))) > buffer->byteLength())
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedIntArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedIntArray::WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedIntArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedIntArray::byteLength() const {
+    return m_size * sizeof(unsigned int);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedIntArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned int);
+    unsigned limitByte = startByte + length * sizeof(unsigned int);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedIntArray::set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned int), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedIntArray.h b/WebCore/html/canvas/WebGLUnsignedIntArray.h
new file mode 100644
index 0000000..b0d9b65
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedIntArray_h
+#define WebGLUnsignedIntArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedIntArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedIntArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(unsigned int* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedIntArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned int>::min())
+            value = std::numeric_limits<unsigned int>::min();
+        else if (value > std::numeric_limits<unsigned int>::max())
+            value = std::numeric_limits<unsigned int>::max();
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        storage[index] = static_cast<unsigned int>(value);
+    }
+
+    bool get(unsigned index, unsigned int& result) const
+    {
+        if (index >= m_size)
+            return false;
+        result = item(index);
+        return true;
+    }
+
+    unsigned int get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned int item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedIntArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedIntArray(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/WebCore/html/canvas/WebGLUnsignedIntArray.idl
index 3ab60d6..8697e70 100644
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.idl
+++ b/WebCore/html/canvas/WebGLUnsignedIntArray.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +32,11 @@ module html {
         GenerateNativeConverter,
         GenerateCustomConstructor,
         CustomToJS
-    ] CanvasUnsignedIntArray : CanvasArray {
+    ] WebGLUnsignedIntArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedIntArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
     };
 }
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.cpp b/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
new file mode 100644
index 0000000..86fae8c
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "WebGLArrayBuffer.h"
+#include "WebGLUnsignedShortArray.h"
+
+namespace WebCore {
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned length)
+{
+    RefPtr<WebGLArrayBuffer> buffer = WebGLArrayBuffer::create(length * sizeof(unsigned short));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(unsigned short* array, unsigned length)
+{
+    RefPtr<WebGLUnsignedShortArray> a = WebGLUnsignedShortArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<WebGLUnsignedShortArray> WebGLUnsignedShortArray::create(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                                    int byteOffset,
+                                                                    unsigned length)
+{
+    // Make sure the offset results in valid alignment.
+    if ((byteOffset % sizeof(unsigned short)) != 0) {
+        return NULL;
+    }
+
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given WebGLArrayBuffer's storage.
+        if ((byteOffset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+            return NULL;
+    }
+
+    return adoptRef(new WebGLUnsignedShortArray(buffer, byteOffset, length));
+}
+
+WebGLUnsignedShortArray::WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer,
+                                                 int byteOffset,
+                                                 unsigned length)
+        : WebGLArray(buffer, byteOffset)
+        , m_size(length)
+{
+}
+
+unsigned WebGLUnsignedShortArray::length() const {
+    return m_size;
+}
+
+unsigned WebGLUnsignedShortArray::byteLength() const {
+    return m_size * sizeof(unsigned short);
+}
+
+PassRefPtr<WebGLArray> WebGLUnsignedShortArray::slice(unsigned offset, unsigned length) {
+    // Check to make sure the specified region is within the bounds of
+    // the WebGLArrayBuffer.
+    unsigned startByte = m_byteOffset + offset * sizeof(unsigned short);
+    unsigned limitByte = startByte + length * sizeof(unsigned short);
+    unsigned bufferLength = buffer()->byteLength();
+    if (startByte >= bufferLength || limitByte > bufferLength)
+        return 0;
+    return create(buffer(), startByte, length);
+}
+
+void WebGLUnsignedShortArray::set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec) {
+    setImpl(array, offset * sizeof(unsigned short), ec);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.h b/WebCore/html/canvas/WebGLUnsignedShortArray.h
new file mode 100644
index 0000000..3bad1b6
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebGLUnsignedShortArray_h
+#define WebGLUnsignedShortArray_h
+
+#include "WebGLArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class WebGLUnsignedShortArray : public WebGLArray {
+  public:
+    virtual bool isUnsignedShortArray() const { return true; }
+
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(unsigned short* array, unsigned length);
+    static PassRefPtr<WebGLUnsignedShortArray> create(PassRefPtr<WebGLArrayBuffer> buffer, int byteOffset, unsigned length);
+
+    unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+
+    virtual unsigned length() const;
+    virtual unsigned byteLength() const;
+    virtual PassRefPtr<WebGLArray> slice(unsigned offset, unsigned length);
+
+    void set(unsigned index, double value)
+    {
+        if (index >= m_size)
+            return;
+        if (isnan(value)) // Clamp NaN to 0
+            value = 0;
+        if (value < std::numeric_limits<unsigned short>::min())
+            value = std::numeric_limits<unsigned short>::min();
+        else if (value > std::numeric_limits<unsigned short>::max())
+            value = std::numeric_limits<unsigned short>::max();
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        storage[index] = static_cast<unsigned short>(value);
+    }
+
+    bool get(unsigned index, unsigned short& result) const
+    {
+        if (index >= m_size)
+            return false;
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        result = storage[index];
+        return true;
+    }
+
+    unsigned short get(unsigned index) const
+    {
+        return item(index);
+    }
+
+    unsigned short item(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+        return storage[index];
+    }
+
+    void set(WebGLUnsignedShortArray* array, unsigned offset, ExceptionCode& ec);
+
+  private:
+    WebGLUnsignedShortArray(PassRefPtr<WebGLArrayBuffer> buffer,int byteOffset,unsigned length);
+    unsigned m_size;
+};
+
+} // namespace WebCore
+
+#endif // WebGLUnsignedShortArray_h
diff --git a/WebCore/html/canvas/WebGLUnsignedShortArray.idl b/WebCore/html/canvas/WebGLUnsignedShortArray.idl
new file mode 100644
index 0000000..d546444
--- /dev/null
+++ b/WebCore/html/canvas/WebGLUnsignedShortArray.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] WebGLUnsignedShortArray : WebGLArray {
+        long get(in unsigned long index);
+        // void set(in unsigned long index, in long value);
+        // void set(in WebGLUnsignedShortArray array, [Optional] in unsigned long offset);
+        // void set(in sequence<long> array, [Optional] in unsigned long offset);
+        [Custom] void set();
+    };
+}
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index eb8d49a..fe32da7 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -34,7 +34,6 @@
 #include "InspectorFrontend.h"
 #include "ScriptCallStack.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
 
@@ -75,7 +74,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
 
 #if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
-        m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+        m_wrappedArguments[i] = ScriptObject::quarantineValue(callStack->state(), lastCaller.argumentAt(i));
 #endif
 }
 
diff --git a/WebCore/inspector/InjectedScriptHost.cpp b/WebCore/inspector/InjectedScriptHost.cpp
new file mode 100644
index 0000000..f326f52
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#if ENABLE(INSPECTOR)
+
+
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorClient.h"
+#include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
+#include "InspectorResource.h"
+#include "Pasteboard.h"
+#include "ScriptArray.h"
+#include "ScriptFunctionCall.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+using namespace JSC;
+#endif
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
+
+#include "markup.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InjectedScriptHost::InjectedScriptHost(InspectorController* inspectorController)
+    : m_inspectorController(inspectorController)
+{
+}
+
+InjectedScriptHost::~InjectedScriptHost()
+{
+}
+
+void InjectedScriptHost::copyText(const String& text)
+{
+    Pasteboard::generalPasteboard()->writePlainText(text);
+}
+
+Node* InjectedScriptHost::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+ScriptValue InjectedScriptHost::wrapObject(const ScriptValue& object, const String& objectGroup)
+{
+    if (m_inspectorController)
+        return m_inspectorController->wrapObject(object, objectGroup);
+    return ScriptValue();
+}
+
+ScriptValue InjectedScriptHost::unwrapObject(const String& objectId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->unwrapObject(objectId);
+    return ScriptValue();
+}
+
+long InjectedScriptHost::pushNodePathToFrontend(Node* node, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InjectedScriptHost::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+long InjectedScriptHost::pushNodeByPathToFrontend(const String& path)
+{
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent)
+        return 0;
+
+    Node* node = domAgent->nodeForPath(path);
+    if (!node)
+        return 0;
+
+    return domAgent->pushNodePathToFrontend(node);
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+JavaScriptCallFrame* InjectedScriptHost::currentCallFrame() const
+{
+    return JavaScriptDebugServer::shared().currentCallFrame();
+}
+#endif
+
+#if ENABLE(DATABASE)
+Database* InjectedScriptHost::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
+void InjectedScriptHost::selectDatabase(Database* database)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InjectedScriptHost::selectDOMStorage(Storage* storage)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDOMStorage(storage);
+}
+#endif
+
+void InjectedScriptHost::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
+InspectorDOMAgent* InjectedScriptHost::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InjectedScriptHost::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InjectedScriptHost.h b/WebCore/inspector/InjectedScriptHost.h
new file mode 100644
index 0000000..aa2fd76
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedScriptHost_h
+#define InjectedScriptHost_h
+
+#include "Console.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Database;
+class InspectorDOMAgent;
+class InspectorFrontend;
+class JavaScriptCallFrame;
+class Node;
+class Storage;
+
+class InjectedScriptHost : public RefCounted<InjectedScriptHost>
+{
+public:
+    static PassRefPtr<InjectedScriptHost> create(InspectorController* inspectorController)
+    {
+        return adoptRef(new InjectedScriptHost(inspectorController));
+    }
+
+    ~InjectedScriptHost();
+
+    InspectorController* inspectorController() { return m_inspectorController; }
+    void disconnectController() { m_inspectorController = 0; }
+
+    void copyText(const String& text);
+    Node* nodeForId(long nodeId);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    long pushNodePathToFrontend(Node* node, bool selectInUI);
+
+    void addNodesToSearchResult(const String& nodeIds);
+    long pushNodeByPathToFrontend(const String& path);
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    JavaScriptCallFrame* currentCallFrame() const;
+#endif
+#if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
+    void selectDatabase(Database* database);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+#endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+
+private:
+    InjectedScriptHost(InspectorController* inspectorController);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
+
+    InspectorController* m_inspectorController;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InjectedScriptHost_h)
diff --git a/WebCore/inspector/InjectedScriptHost.idl b/WebCore/inspector/InjectedScriptHost.idl
new file mode 100644
index 0000000..be627ec
--- /dev/null
+++ b/WebCore/inspector/InjectedScriptHost.idl
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InjectedScriptHost {
+        [Custom] DOMWindow inspectedWindow();
+        [Custom] DOMObject wrapCallback(in DOMObject callback);
+        void copyText(in DOMString text);
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
+        [Custom] DOMObject unwrapObject(in long objectId);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
+
+        void addNodesToSearchResult(in DOMString nodeIds);
+        long pushNodeByPathToFrontend(in DOMString path);
+
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        [Custom] DOMObject currentCallFrame();
+#endif
+
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] DOMObject databaseForId(in long databaseId);
+        [Custom] void selectDatabase(in DOMObject database);
+#endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+#endif
+
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+    };
+}
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 83a9719..11f58c7 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -68,9 +68,8 @@ using namespace std;
 
 namespace WebCore {
 
-InspectorBackend::InspectorBackend(InspectorController* inspectorController, InspectorClient* client)
+InspectorBackend::InspectorBackend(InspectorController* inspectorController)
     : m_inspectorController(inspectorController)
-    , m_client(client)
 {
 }
 
@@ -78,117 +77,22 @@ InspectorBackend::~InspectorBackend()
 {
 }
 
-void InspectorBackend::hideDOMNodeHighlight()
-{
-    if (m_inspectorController)
-        m_inspectorController->hideHighlight();
-}
-
-String InspectorBackend::localizedStringsURL()
-{
-    return m_client->localizedStringsURL();
-}
-
-String InspectorBackend::hiddenPanels()
-{
-    return m_client->hiddenPanels();
-}
-
-void InspectorBackend::windowUnloading()
-{
-    if (m_inspectorController)
-        m_inspectorController->close();
-}
-
-bool InspectorBackend::isWindowVisible()
-{
-    if (m_inspectorController)
-        return m_inspectorController->windowVisible();
-    return false;
-}
-
-void InspectorBackend::addResourceSourceToFrame(long identifier, Node* frame)
-{
-    if (!m_inspectorController)
-        return;
-    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
-    if (resource) {
-        String sourceString = resource->sourceString();
-        if (!sourceString.isEmpty())
-            addSourceToFrame(resource->mimeType(), sourceString, frame);
-    }
-}
-
-bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
-{
-    ASSERT_ARG(frameNode, frameNode);
-
-    if (!frameNode)
-        return false;
-
-    if (!frameNode->attached()) {
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    ASSERT(frameNode->isElementNode());
-    if (!frameNode->isElementNode())
-        return false;
-
-    Element* element = static_cast<Element*>(frameNode);
-    ASSERT(element->isFrameOwnerElement());
-    if (!element->isFrameOwnerElement())
-        return false;
-
-    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(element);
-    ASSERT(frameOwner->contentFrame());
-    if (!frameOwner->contentFrame())
-        return false;
-
-    FrameLoader* loader = frameOwner->contentFrame()->loader();
-
-    loader->setResponseMIMEType(mimeType);
-    loader->begin();
-    loader->write(source);
-    loader->end();
-
-    return true;
-}
-
 void InspectorBackend::clearMessages(bool clearUI)
 {
     if (m_inspectorController)
         m_inspectorController->clearConsoleMessages(clearUI);
 }
 
-void InspectorBackend::toggleNodeSearch()
-{
-    if (m_inspectorController)
-        m_inspectorController->toggleSearchForNodeInPage();
-}
-
-void InspectorBackend::attach()
-{
-    if (m_inspectorController)
-        m_inspectorController->attachWindow();
-}
-
-void InspectorBackend::detach()
-{
-    if (m_inspectorController)
-        m_inspectorController->detachWindow();
-}
-
-void InspectorBackend::setAttachedWindowHeight(unsigned height)
+void InspectorBackend::storeLastActivePanel(const String& panelName)
 {
     if (m_inspectorController)
-        m_inspectorController->setAttachedWindowHeight(height);
+        m_inspectorController->storeLastActivePanel(panelName);
 }
 
-void InspectorBackend::storeLastActivePanel(const String& panelName)
+void InspectorBackend::toggleNodeSearch()
 {
     if (m_inspectorController)
-        m_inspectorController->storeLastActivePanel(panelName);
+        m_inspectorController->toggleSearchForNodeInPage();
 }
 
 bool InspectorBackend::searchingForNode()
@@ -198,10 +102,11 @@ bool InspectorBackend::searchingForNode()
     return false;
 }
 
-void InspectorBackend::loaded()
+bool InspectorBackend::resourceTrackingEnabled() const
 {
     if (m_inspectorController)
-        m_inspectorController->scriptObjectReady();
+        return m_inspectorController->resourceTrackingEnabled();
+    return false;
 }
 
 void InspectorBackend::enableResourceTracking(bool always)
@@ -216,48 +121,6 @@ void InspectorBackend::disableResourceTracking(bool always)
         m_inspectorController->disableResourceTracking(always);
 }
 
-bool InspectorBackend::resourceTrackingEnabled() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->resourceTrackingEnabled();
-    return false;
-}
-
-void InspectorBackend::moveWindowBy(float x, float y) const
-{
-    if (m_inspectorController)
-        m_inspectorController->moveWindowBy(x, y);
-}
-
-void InspectorBackend::closeWindow()
-{
-    if (m_inspectorController)
-        m_inspectorController->closeWindow();
-}
-
-const String& InspectorBackend::platform() const
-{
-#if PLATFORM(MAC)
-#ifdef BUILDING_ON_TIGER
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-tiger"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("mac-leopard"));
-#endif
-#elif PLATFORM(WIN_OS)
-    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
-#elif PLATFORM(QT)
-    DEFINE_STATIC_LOCAL(const String, platform, ("qt"));
-#elif PLATFORM(GTK)
-    DEFINE_STATIC_LOCAL(const String, platform, ("gtk"));
-#elif PLATFORM(WX)
-    DEFINE_STATIC_LOCAL(const String, platform, ("wx"));
-#else
-    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
-#endif
-
-    return platform;
-}
-
 void InspectorBackend::startTimelineProfiler()
 {
     if (m_inspectorController)
@@ -270,135 +133,127 @@ void InspectorBackend::stopTimelineProfiler()
         m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineProfilerEnabled() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->timelineProfilerEnabled();
-    return false;
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorBackend::startProfiling()
+bool InspectorBackend::debuggerEnabled() const
 {
     if (m_inspectorController)
-        m_inspectorController->startUserInitiatedProfiling();
+        return m_inspectorController->debuggerEnabled();
+    return false;
 }
 
-void InspectorBackend::stopProfiling()
+void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->stopUserInitiatedProfiling();
+        m_inspectorController->enableDebuggerFromFrontend(always);
 }
 
-void InspectorBackend::enableProfiler(bool always)
+void InspectorBackend::disableDebugger(bool always)
 {
     if (m_inspectorController)
-        m_inspectorController->enableProfiler(always);
+        m_inspectorController->disableDebugger(always);
 }
 
-void InspectorBackend::disableProfiler(bool always)
+void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
-    if (m_inspectorController)
-        m_inspectorController->disableProfiler(always);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
-bool InspectorBackend::profilerEnabled()
+void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
-    if (m_inspectorController)
-        return m_inspectorController->profilerEnabled();
-    return false;
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
-void InspectorBackend::getProfileHeaders(long callId)
+void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfileHeaders(callId);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
 }
 
-void InspectorBackend::getProfile(long callId, unsigned uid)
+void InspectorBackend::pauseInDebugger()
 {
-    if (m_inspectorController)
-        m_inspectorController->getProfile(callId, uid);
+    JavaScriptDebugServer::shared().pauseProgram();
 }
 
-void InspectorBackend::enableDebugger(bool always)
+void InspectorBackend::resumeDebugger()
 {
     if (m_inspectorController)
-        m_inspectorController->enableDebuggerFromFrontend(always);
+        m_inspectorController->resumeDebugger();
 }
 
-void InspectorBackend::disableDebugger(bool always)
+void InspectorBackend::stepOverStatementInDebugger()
 {
-    if (m_inspectorController)
-        m_inspectorController->disableDebugger(always);
+    JavaScriptDebugServer::shared().stepOverStatement();
 }
 
-bool InspectorBackend::debuggerEnabled() const
+void InspectorBackend::stepIntoStatementInDebugger()
 {
-    if (m_inspectorController)
-        return m_inspectorController->debuggerEnabled();
-    return false;
+    JavaScriptDebugServer::shared().stepIntoStatement();
 }
 
-JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
+void InspectorBackend::stepOutOfFunctionInDebugger()
 {
-    return JavaScriptDebugServer::shared().currentCallFrame();
+    JavaScriptDebugServer::shared().stepOutOfFunction();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+bool InspectorBackend::pauseOnExceptions()
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+    return JavaScriptDebugServer::shared().pauseOnExceptions();
 }
 
-void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+void InspectorBackend::setPauseOnExceptions(bool pause)
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
+    JavaScriptDebugServer::shared().setPauseOnExceptions(pause);
 }
 
-void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
+bool InspectorBackend::profilerEnabled()
 {
-    intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
+    if (m_inspectorController)
+        return m_inspectorController->profilerEnabled();
+    return false;
 }
 
-bool InspectorBackend::pauseOnExceptions()
+void InspectorBackend::enableProfiler(bool always)
 {
-    return JavaScriptDebugServer::shared().pauseOnExceptions();
+    if (m_inspectorController)
+        m_inspectorController->enableProfiler(always);
 }
 
-void InspectorBackend::setPauseOnExceptions(bool pause)
+void InspectorBackend::disableProfiler(bool always)
 {
-    JavaScriptDebugServer::shared().setPauseOnExceptions(pause);
+    if (m_inspectorController)
+        m_inspectorController->disableProfiler(always);
 }
 
-void InspectorBackend::pauseInDebugger()
+void InspectorBackend::startProfiling()
 {
-    JavaScriptDebugServer::shared().pauseProgram();
+    if (m_inspectorController)
+        m_inspectorController->startUserInitiatedProfiling();
 }
 
-void InspectorBackend::resumeDebugger()
+void InspectorBackend::stopProfiling()
 {
     if (m_inspectorController)
-        m_inspectorController->resumeDebugger();
+        m_inspectorController->stopUserInitiatedProfiling();
 }
 
-void InspectorBackend::stepOverStatementInDebugger()
+void InspectorBackend::getProfileHeaders(long callId)
 {
-    JavaScriptDebugServer::shared().stepOverStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
 }
 
-void InspectorBackend::stepIntoStatementInDebugger()
+void InspectorBackend::getProfile(long callId, unsigned uid)
 {
-    JavaScriptDebugServer::shared().stepIntoStatement();
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
 }
 
-void InspectorBackend::stepOutOfFunctionInDebugger()
+JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
 {
-    JavaScriptDebugServer::shared().stepOutOfFunction();
+    return JavaScriptDebugServer::shared().currentCallFrame();
 }
-
 #endif
 
 void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
@@ -411,7 +266,7 @@ void InspectorBackend::dispatchOnInjectedScript(long callId, const String& metho
     function.appendArgument(methodName);
     function.appendArgument(arguments);
     if (async)
-        function.appendArgument(static_cast<int>(callId));
+        function.appendArgument(callId);
     bool hadException = false;
     ScriptValue result = function.call(hadException);
     if (async)
@@ -490,45 +345,30 @@ void InspectorBackend::removeNode(long callId, long nodeId)
     frontend->didRemoveNode(callId, nodeId);
 }
 
-void InspectorBackend::getCookies(long callId, const String& domain)
-{
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->getCookies(callId, domain);
-}
-
-void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
-{
-    if (!m_inspectorController)
-        return;
-    m_inspectorController->deleteCookie(cookieName, domain);
-}
-
-void InspectorBackend::highlight(long nodeId)
+void InspectorBackend::highlightDOMNode(long nodeId)
 {
     if (Node* node = nodeForId(nodeId))
         m_inspectorController->highlight(node);
 }
 
-Node* InspectorBackend::nodeForId(long nodeId)
+void InspectorBackend::hideDOMNodeHighlight()
 {
-    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
-        return domAgent->nodeForId(nodeId);
-    return 0;
+    if (m_inspectorController)
+        m_inspectorController->hideHighlight();
 }
 
-ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
+void InspectorBackend::getCookies(long callId)
 {
-    if (m_inspectorController)
-        return m_inspectorController->wrapObject(object, objectGroup);
-    return ScriptValue();
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId);
 }
 
-ScriptValue InspectorBackend::unwrapObject(const String& objectId)
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
 {
-    if (m_inspectorController)
-        return m_inspectorController->unwrapObject(objectId);
-    return ScriptValue();
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName, domain);
 }
 
 void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
@@ -537,38 +377,13 @@ void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
         m_inspectorController->releaseWrapperObjectGroup(objectGroup);
 }
 
-long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
-{
-    InspectorFrontend* frontend = inspectorFrontend();
-    InspectorDOMAgent* domAgent = inspectorDOMAgent();
-    if (!domAgent || !frontend)
-        return 0;
-    long id = domAgent->pushNodePathToFrontend(node);
-    if (selectInUI)
-        frontend->updateFocusedNode(id);
-    return id;
-}
-
-void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
-{
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->addNodesToSearchResult(nodeIds);
-}
-
-#if ENABLE(DATABASE)
-Database* InspectorBackend::databaseForId(long databaseId)
-{
-    if (m_inspectorController)
-        return m_inspectorController->databaseForId(databaseId);
-    return 0;
-}
-
-void InspectorBackend::selectDatabase(Database* database)
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
     if (m_inspectorController)
-        m_inspectorController->selectDatabase(database);
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
 }
 
+#if ENABLE(DATABASE)
 void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 {
     if (InspectorFrontend* frontend = inspectorFrontend()) {
@@ -586,12 +401,6 @@ void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
 #endif
 
 #if ENABLE(DOM_STORAGE)
-void InspectorBackend::selectDOMStorage(Storage* storage)
-{
-    if (m_inspectorController)
-        m_inspectorController->selectDOMStorage(storage);
-}
-
 void InspectorBackend::getDOMStorageEntries(long callId, long storageId)
 {
     if (m_inspectorController)
@@ -611,18 +420,6 @@ void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const S
 }
 #endif
 
-void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
-{
-    if (m_inspectorController)
-        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
-}
-
-void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
-{
-    if (InspectorFrontend* frontend = inspectorFrontend())
-        frontend->didDispatchOnInjectedScript(callId, result, isException);
-}
-
 InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
 {
     if (!m_inspectorController)
@@ -637,6 +434,13 @@ InspectorFrontend* InspectorBackend::inspectorFrontend()
     return m_inspectorController->m_frontend.get();
 }
 
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index 9d75e2f..d6e89fa 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -39,8 +39,8 @@ namespace WebCore {
 
 class CachedResource;
 class Database;
-class InspectorClient;
 class InspectorDOMAgent;
+class InspectorFrontend;
 class JavaScriptCallFrame;
 class Node;
 class Storage;
@@ -48,87 +48,59 @@ class Storage;
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
 public:
-    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController, InspectorClient* client)
+    static PassRefPtr<InspectorBackend> create(InspectorController* inspectorController)
     {
-        return adoptRef(new InspectorBackend(inspectorController, client));
+        return adoptRef(new InspectorBackend(inspectorController));
     }
 
     ~InspectorBackend();
 
     InspectorController* inspectorController() { return m_inspectorController; }
-    
     void disconnectController() { m_inspectorController = 0; }
 
-    void hideDOMNodeHighlight();
-
-    String localizedStringsURL();
-    String hiddenPanels();
-
-    void windowUnloading();
-
-    bool isWindowVisible();
-
-    void addResourceSourceToFrame(long identifier, Node* frame);
-    bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
-
     void clearMessages(bool clearUI);
-
-    void toggleNodeSearch();
-
-    void attach();
-    void detach();
-
-    void setAttachedWindowHeight(unsigned height);
-
     void storeLastActivePanel(const String& panelName);
 
+    void toggleNodeSearch();
     bool searchingForNode();
 
-    void loaded();
-
     void enableResourceTracking(bool always);
     void disableResourceTracking(bool always);
     bool resourceTrackingEnabled() const;
 
-    void moveWindowBy(float x, float y) const;
-    void closeWindow();
-
-    const String& platform() const;
-
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    void startProfiling();
-    void stopProfiling();
-
-    void enableProfiler(bool always);
-    void disableProfiler(bool always);
-    bool profilerEnabled();
-
-    void getProfileHeaders(long callId);
-    void getProfile(long callId, unsigned uid);
-
+    bool debuggerEnabled() const;
     void enableDebugger(bool always);
     void disableDebugger(bool always);
-    bool debuggerEnabled() const;
-
-    JavaScriptCallFrame* currentCallFrame() const;
 
     void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
-    bool pauseOnExceptions();
-    void setPauseOnExceptions(bool pause);
-
     void pauseInDebugger();
     void resumeDebugger();
 
+    bool pauseOnExceptions();
+    void setPauseOnExceptions(bool pause);
+
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
+
+    bool profilerEnabled();
+    void enableProfiler(bool always);
+    void disableProfiler(bool always);
+
+    void startProfiling();
+    void stopProfiling();
+
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+
+    JavaScriptCallFrame* currentCallFrame() const;
 #endif
 
     void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
@@ -139,39 +111,33 @@ public:
     void getEventListenersForNode(long callId, long nodeId);
     void copyNode(long nodeId);
     void removeNode(long callId, long nodeId);
+    void highlightDOMNode(long nodeId);
+    void hideDOMNodeHighlight();
 
-    void getCookies(long callId, const String& domain);
+    void getCookies(long callId);
     void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
-    void highlight(long nodeId);
-    Node* nodeForId(long nodeId);
-    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
-    ScriptValue unwrapObject(const String& objectId);
     void releaseWrapperObjectGroup(const String& objectGroup);
-    long pushNodePathToFrontend(Node* node, bool selectInUI);
-    void addNodesToSearchResult(const String& nodeIds);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
 #if ENABLE(DATABASE)
-    Database* databaseForId(long databaseId);
-    void selectDatabase(Database* database);
     void getDatabaseTableNames(long callId, long databaseId);
 #endif
+
 #if ENABLE(DOM_STORAGE)
-    void selectDOMStorage(Storage* storage);
     void getDOMStorageEntries(long callId, long storageId);
     void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
     void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
-    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
-    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
-    InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorBackend(InspectorController* inspectorController);
     InspectorDOMAgent* inspectorDOMAgent();
     InspectorFrontend* inspectorFrontend();
+    Node* nodeForId(long nodeId);
 
     InspectorController* m_inspectorController;
-    InspectorClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index 7a00c6a..61c76d6 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -34,43 +34,18 @@ module core {
     interface [
         GenerateConstructor
     ] InspectorBackend {
-        void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in long nodeId);
-        void loaded();
-        void windowUnloading();
-        void attach();
-        void detach();
-
-        void closeWindow();
         void clearMessages(in boolean clearUI);
-        void toggleNodeSearch();
+        void storeLastActivePanel(in DOMString panelName);
 
-        boolean isWindowVisible();
+        void toggleNodeSearch();
         boolean searchingForNode();
 
-        void addResourceSourceToFrame(in long identifier, in Node frame);
-        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
-        [Custom] void search(in Node node, in DOMString query);
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        void getDatabaseTableNames(in long callId, in long databaseId);
-#endif
-
-        [Custom] DOMObject setting(in DOMString key);
-        [Custom] void setSetting(in DOMString key, in DOMObject  value);
-        [Custom] DOMWindow inspectedWindow();
-        DOMString localizedStringsURL();
-        DOMString hiddenPanels();
-        DOMString platform();
-        void startTimelineProfiler();
-        void stopTimelineProfiler();
-        boolean timelineProfilerEnabled();
-        [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
-        void setAttachedWindowHeight(in unsigned long height);
-        [Custom] DOMObject wrapCallback(in DOMObject callback);
         boolean resourceTrackingEnabled();
         void enableResourceTracking(in boolean always);
         void disableResourceTracking(in boolean always);
-        void storeLastActivePanel(in DOMString panelName);
+
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
 
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         boolean debuggerEnabled();
@@ -88,8 +63,6 @@ module core {
         void stepIntoStatementInDebugger();
         void stepOutOfFunctionInDebugger();
 
-        [Custom] DOMObject currentCallFrame();
-
         boolean pauseOnExceptions();
         void setPauseOnExceptions(in boolean pauseOnExceptions);
 
@@ -111,29 +84,23 @@ module core {
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
         void removeNode(in long callId, in long nodeId);
+        void highlightDOMNode(in long nodeId);
+        void hideDOMNodeHighlight();
 
-        void getCookies(in long callId, in DOMString domain);
+        void getCookies(in long callId);
         void deleteCookie(in DOMString cookieName, in DOMString domain);
 
-        // Called from InjectedScript.
-        // TODO: extract into a separate IDL.
-        [Custom] DOMObject nodeForId(in long nodeId);
-        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
-        [Custom] DOMObject unwrapObject(in long objectId);
         void releaseWrapperObjectGroup(in DOMString objectGroup);
-        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
-        void addNodesToSearchResult(in DOMString nodeIds);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
+
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] void selectDatabase(in DOMObject database);
-        [Custom] DOMObject databaseForId(in long databaseId);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-        [Custom] void selectDOMStorage(in DOMObject storage);
         void getDOMStorageEntries(in long callId, in long storageId);
         void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
         void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
 #endif
-        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
-        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
 }
diff --git a/WebCore/inspector/InspectorClient.h b/WebCore/inspector/InspectorClient.h
index f96662a..e448cd2 100644
--- a/WebCore/inspector/InspectorClient.h
+++ b/WebCore/inspector/InspectorClient.h
@@ -59,9 +59,8 @@ public:
 
     virtual void inspectedURLChanged(const String& newURL) = 0;
 
-    virtual void populateSetting(const String& key, InspectorController::Setting&) = 0;
-    virtual void storeSetting(const String& key, const InspectorController::Setting&) = 0;
-    virtual void removeSetting(const String& key) = 0;
+    virtual void populateSetting(const String& key, String* value) = 0;
+    virtual void storeSetting(const String& key, const String& value) = 0;
 
     virtual void inspectorWindowObjectCleared() = 0;
 };
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index a6628cd..fd319a4 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
@@ -53,8 +53,10 @@
 #include "HTMLFrameOwnerElement.h"
 #include "HitTestResult.h"
 #include "InspectorBackend.h"
+#include "InjectedScriptHost.h"
 #include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorFrontendHost.h"
 #include "InspectorDatabaseResource.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
@@ -62,6 +64,7 @@
 #include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
+#include "ProgressTracker.h"
 #include "Range.h"
 #include "RenderInline.h"
 #include "ResourceRequest.h"
@@ -69,7 +72,6 @@
 #include "ScriptCallStack.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -119,7 +121,6 @@ static const float minimumAttachedHeight = 250.0f;
 static const float maximumAttachedHeightRatio = 0.75f;
 
 static unsigned s_inspectorControllerCount;
-static HashMap<String, InspectorController::Setting*>* s_settingCache;
 
 InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
@@ -128,13 +129,14 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_scriptState(0)
     , m_windowVisible(false)
     , m_showAfterVisible(CurrentPanel)
-    , m_nextIdentifier(-2)
     , m_groupLevel(0)
     , m_searchingForNode(false)
     , m_previousMessage(0)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
-    , m_inspectorBackend(InspectorBackend::create(this, client))
+    , m_inspectorBackend(InspectorBackend::create(this))
+    , m_inspectorFrontendHost(InspectorFrontendHost::create(this, client))
+    , m_injectedScriptHost(InjectedScriptHost::create(this))
     , m_lastBoundObjectId(1)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
@@ -165,24 +167,22 @@ InspectorController::~InspectorController()
     ASSERT(s_inspectorControllerCount);
     --s_inspectorControllerCount;
 
-    if (!s_inspectorControllerCount && s_settingCache) {
-        deleteAllValues(*s_settingCache);
-        delete s_settingCache;
-        s_settingCache = 0;
-    }
-    
     releaseDOMAgent();
 
     m_inspectorBackend->disconnectController();
+    m_inspectorFrontendHost->disconnectController();
+    m_injectedScriptHost->disconnectController();
 }
 
 void InspectorController::inspectedPageDestroyed()
 {
     close();
 
-    if (m_scriptState)
-        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
-
+    if (m_scriptState) {
+        ScriptGlobalObject::remove(m_scriptState, "InspectorBackend");
+        ScriptGlobalObject::remove(m_scriptState, "InspectorFrontendHost");
+        ScriptGlobalObject::remove(m_scriptState, "InjectedScriptHost");
+    }
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -197,46 +197,22 @@ bool InspectorController::enabled() const
     return m_inspectedPage->settings()->developerExtrasEnabled();
 }
 
-const InspectorController::Setting& InspectorController::setting(const String& key) const
+String InspectorController::setting(const String& key) const
 {
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        return *cachedSetting;
-
-    Setting* newSetting = new Setting;
-    s_settingCache->set(key, newSetting);
-
-    m_client->populateSetting(key, *newSetting);
+    Settings::iterator it = m_settings.find(key);
+    if (it != m_settings.end())
+        return it->second;
 
-    return *newSetting;
+    String value;
+    m_client->populateSetting(key, &value);
+    m_settings.set(key, value);
+    return value;
 }
 
-void InspectorController::setSetting(const String& key, const Setting& setting)
+void InspectorController::setSetting(const String& key, const String& value)
 {
-    if (setting.type() == Setting::NoType) {
-        if (s_settingCache) {
-            Setting* cachedSetting = s_settingCache->get(key);
-            if (cachedSetting) {
-                s_settingCache->remove(key);
-                delete cachedSetting;
-            }
-        }
-
-        m_client->removeSetting(key);
-        return;
-    }
-
-    if (!s_settingCache)
-        s_settingCache = new HashMap<String, Setting*>;
-
-    if (Setting* cachedSetting = s_settingCache->get(key))
-        *cachedSetting = setting;
-    else
-        s_settingCache->set(key, new Setting(setting));
-
-    m_client->storeSetting(key, setting);
+    m_settings.set(key, value);
+    m_client->storeSetting(key, value);
 }
 
 // Trying to inspect something in a frame with JavaScript disabled would later lead to
@@ -315,15 +291,9 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
         setAttachedWindow(attached);
         populateScriptObjects();
 
-        // Console panel is implemented as a 'fast view', so there should be
-        // real panel opened along with it.
-        bool showConsole = m_showAfterVisible == ConsolePanel;
-        if (m_showAfterVisible == CurrentPanel || showConsole) {
-          Setting lastActivePanelSetting = setting(lastActivePanelSettingName);
-          if (lastActivePanelSetting.type() == Setting::StringType)
-              m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting.string());
-          else
-              m_showAfterVisible = ElementsPanel;
+        if (m_showAfterVisible == CurrentPanel) {
+          String lastActivePanelSetting = setting(lastActivePanelSettingName);
+          m_showAfterVisible = specialPanelForJSName(lastActivePanelSetting);
         }
 
         if (m_nodeToFocus)
@@ -333,8 +303,6 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
             enableDebugger();
 #endif
         showPanel(m_showAfterVisible);
-        if (showConsole)
-            showPanel(ConsolePanel);
     } else {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         // If the window is being closed with the debugger enabled,
@@ -345,7 +313,10 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
         if (debuggerWasEnabled)
             m_attachDebuggerWhenShown = true;
 #endif
+        if (m_searchingForNode)
+            toggleSearchForNodeInPage();
         resetScriptObjects();
+        stopTimelineProfiler();
     }
     m_showAfterVisible = CurrentPanel;
 }
@@ -414,6 +385,12 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageType, LogMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
+void InspectorController::markTimeline(const String& message)
+{
+    if (timelineAgent())
+        timelineAgent()->didMarkTimeline(message);
+}
+
 static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight)
 {
     return roundf(max(minimumAttachedHeight, min<float>(preferredHeight, totalWindowHeight * maximumAttachedHeightRatio)));
@@ -428,8 +405,10 @@ void InspectorController::attachWindow()
 
     m_client->attachWindow();
 
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
+    String attachedHeight = setting(inspectorAttachedHeightName);
+    bool success = true;
+    int height = attachedHeight.toInt(&success);
+    unsigned preferredHeight = success ? height : defaultAttachedHeight;
 
     // We need to constrain the window height here in case the user has resized the inspected page's window so that
     // the user's preferred height would be too big to display.
@@ -459,14 +438,14 @@ void InspectorController::setAttachedWindowHeight(unsigned height)
     unsigned totalHeight = m_page->mainFrame()->view()->visibleHeight() + m_inspectedPage->mainFrame()->view()->visibleHeight();
     unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
     
-    setSetting(inspectorAttachedHeightName, Setting(attachedHeight));
+    setSetting(inspectorAttachedHeightName, String::number(attachedHeight));
     
     m_client->setAttachedWindowHeight(attachedHeight);
 }
 
 void InspectorController::storeLastActivePanel(const String& panelName)
 {
-    setSetting(lastActivePanelSettingName, Setting(panelName));
+    setSetting(lastActivePanelSettingName, panelName);
 }
 
 void InspectorController::toggleSearchForNodeInPage()
@@ -517,8 +496,10 @@ void InspectorController::windowScriptObjectAvailable()
 
     // Grant the inspector the ability to script the inspected page.
     m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
-    m_scriptState = scriptStateFromPage(m_page);
-    ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
+    m_scriptState = scriptStateFromPage(debuggerWorld(), m_page);
+    ScriptGlobalObject::set(m_scriptState, "InspectorBackend", m_inspectorBackend.get());
+    ScriptGlobalObject::set(m_scriptState, "InspectorFrontendHost", m_inspectorFrontendHost.get());
+    ScriptGlobalObject::set(m_scriptState, "InjectedScriptHost", m_injectedScriptHost.get());
 }
 
 void InspectorController::scriptObjectReady()
@@ -536,11 +517,11 @@ void InspectorController::scriptObjectReady()
     setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
-    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
+    String debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled == "true")
         enableDebugger();
-    Setting profilerEnabled = setting(profilerEnabledSettingName);
-    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
+    String profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled == "true")
         enableProfiler();
 #endif
 
@@ -611,14 +592,17 @@ void InspectorController::close()
 #endif
     closeWindow();
 
-    m_frontend.set(0);
     m_injectedScriptObj = ScriptObject();
     releaseDOMAgent();
+    m_frontend.set(0);
     m_timelineAgent = 0;
     m_scriptState = 0;
-    if (m_page)
-        m_page->setParentInspectorController(0);
-    m_page = 0;
+    if (m_page) {
+        if (!m_page->mainFrame() || !m_page->mainFrame()->loader() || !m_page->mainFrame()->loader()->isLoading()) {
+            m_page->setParentInspectorController(0);
+            m_page = 0;
+        }
+    }
 }
 
 void InspectorController::showWindow()
@@ -629,8 +613,10 @@ void InspectorController::showWindow()
 
     m_client->showWindow();
 
-    Setting attachedHeight = setting(inspectorAttachedHeightName);
-    unsigned preferredHeight = attachedHeight.type() == Setting::IntegerType ? attachedHeight.integerValue() : defaultAttachedHeight;
+    String attachedHeight = setting(inspectorAttachedHeightName);
+    bool success = true;
+    int height = attachedHeight.toInt(&success);
+    unsigned preferredHeight = success ? height : defaultAttachedHeight;
 
     // This call might not go through (if the window starts out detached), but if the window is initially created attached,
     // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
@@ -648,7 +634,7 @@ void InspectorController::releaseDOMAgent()
     // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
     // no references to the DOM agent from the DOM tree.
     if (m_domAgent)
-        m_domAgent->setDocument(0);
+        m_domAgent->reset();
     m_domAgent = 0;
 }
 
@@ -661,12 +647,8 @@ void InspectorController::populateScriptObjects()
     m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
         it->second->createScriptObject(m_frontend.get());
-        KURL resourceURL = it->second->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
@@ -715,7 +697,7 @@ void InspectorController::resetScriptObjects()
         m_timelineAgent->reset();
 
     m_frontend->reset();
-    m_domAgent->setDocument(0);
+    m_domAgent->reset();
     m_objectGroups.clear();
     m_idToWrappedObject.clear();
 }
@@ -761,6 +743,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         // resetScriptObjects should be called before database and DOM storage
         // resources are cleared so that it has a chance to unbind them.
         resetScriptObjects();
+
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -840,7 +823,7 @@ void InspectorController::removeResource(InspectorResource* resource)
     }
 }
 
-InspectorResource* InspectorController::getTrackedResource(long long identifier)
+InspectorResource* InspectorController::getTrackedResource(unsigned long identifier)
 {
     if (!enabled())
         return 0;
@@ -870,7 +853,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_inspectedPage->progress()->createUniqueIdentifier() , loader, cachedResource);
 
     if (isMainResource) {
         m_mainResource = resource;
@@ -938,8 +921,12 @@ bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KUR
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
 }
 
-void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorController::willSendRequest(unsigned long identifier, const ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
+    bool isMainResource = (m_mainResource && m_mainResource->identifier() == identifier);
+    if (m_timelineAgent)
+        m_timelineAgent->willSendResourceRequest(identifier, isMainResource, request);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -955,8 +942,11 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->createScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
+void InspectorController::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didReceiveResourceResponse(identifier, response);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -968,7 +958,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
+void InspectorController::didReceiveContentLength(unsigned long identifier, int lengthReceived)
 {
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
@@ -980,8 +970,11 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
+void InspectorController::didFinishLoading(unsigned long identifier)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, false);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -992,16 +985,15 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (windowVisible()) {
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
-        KURL resourceURL = resource->frame()->document()->url();
-        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
-            m_frontend->addCookieDomain(resourceURL.host());
-    }
 }
 
-void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
+void InspectorController::didFailLoading(unsigned long identifier, const ResourceError& /*error*/)
 {
+    if (m_timelineAgent)
+        m_timelineAgent->didFinishLoadingResource(identifier, true);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1055,7 +1047,7 @@ void InspectorController::enableResourceTracking(bool always, bool reload)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+        setSetting(resourceTrackingEnabledSettingName, "true");
 
     if (m_resourceTrackingEnabled)
         return;
@@ -1075,7 +1067,7 @@ void InspectorController::disableResourceTracking(bool always)
         return;
 
     if (always)
-        setSetting(resourceTrackingEnabledSettingName, Setting(false));
+        setSetting(resourceTrackingEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
     m_resourceTrackingEnabled = false;
@@ -1089,8 +1081,8 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         return;
     m_resourceTrackingSettingsLoaded = true;
 
-    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
-    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+    String resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking == "true")
         m_resourceTrackingEnabled = true;
 }
 
@@ -1120,14 +1112,6 @@ void InspectorController::stopTimelineProfiler()
         m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineProfilerEnabled() const
-{
-    if (!enabled())
-        return false;
-
-    return m_timelineAgent;
-}
-
 #if ENABLE(DATABASE)
 void InspectorController::selectDatabase(Database* database)
 {
@@ -1165,42 +1149,44 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 }
 #endif
 
-void InspectorController::getCookies(long callId, const String& host)
+void InspectorController::getCookies(long callId)
 {
     if (!m_frontend)
         return;
-    
+
     // If we can get raw cookies.
     ListHashSet<Cookie> rawCookiesList;
-    
+
     // If we can't get raw cookies - fall back to String representation
     String stringCookiesList;
-    
+
     // Return value to getRawCookies should be the same for every call because
     // the return value is platform/network backend specific, and the call will
     // always return the same true/false value.
     bool rawCookiesImplemented = false;
-    
+
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         Document* document = it->second->frame()->document();
-        if (document->url().host() == host) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
-            
-            if (!rawCookiesImplemented)
-                // FIXME: We need duplication checking for the String representation of cookies.
-                stringCookiesList += document->cookie();
-            else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
+        Vector<Cookie> docCookiesList;
+        rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+
+        if (!rawCookiesImplemented) {
+            // FIXME: We need duplication checking for the String representation of cookies.
+            ExceptionCode ec = 0;
+            stringCookiesList += document->cookie(ec);
+            // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+            // because "document" is the document of the main frame of the page.
+            ASSERT(!ec);
+        } else {
+            int cookiesSize = docCookiesList.size();
+            for (int i = 0; i < cookiesSize; i++) {
+                if (!rawCookiesList.contains(docCookiesList[i]))
+                    rawCookiesList.add(docCookiesList[i]);
             }
         }
     }
-    
+
     if (!rawCookiesImplemented)
         m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
     else
@@ -1412,6 +1398,7 @@ ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profil
     ScriptObject header = m_frontend->newScriptObject();
     header.set("title", profile.title());
     header.set("uid", profile.uid());
+    header.set("typeId", UString(CPUProfileType));
     return header;
 }
 
@@ -1481,7 +1468,7 @@ void InspectorController::toggleRecordButton(bool isProfiling)
 void InspectorController::enableProfiler(bool always, bool skipRecompile)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(true));
+        setSetting(profilerEnabledSettingName, "true");
 
     if (m_profilerEnabled)
         return;
@@ -1498,7 +1485,7 @@ void InspectorController::enableProfiler(bool always, bool skipRecompile)
 void InspectorController::disableProfiler(bool always)
 {
     if (always)
-        setSetting(profilerEnabledSettingName, Setting(false));
+        setSetting(profilerEnabledSettingName, "false");
 
     if (!m_profilerEnabled)
         return;
@@ -1514,7 +1501,7 @@ void InspectorController::disableProfiler(bool always)
 void InspectorController::enableDebuggerFromFrontend(bool always)
 {
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(true));
+        setSetting(debuggerEnabledSettingName, "true");
 
     ASSERT(m_inspectedPage);
 
@@ -1547,7 +1534,7 @@ void InspectorController::disableDebugger(bool always)
         return;
 
     if (always)
-        setSetting(debuggerEnabledSettingName, Setting(false));
+        setSetting(debuggerEnabledSettingName, "false");
 
     ASSERT(m_inspectedPage);
 
@@ -1603,11 +1590,11 @@ void InspectorController::evaluateForTestInFrontend(long callId, const String& s
 
 void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
 {
-    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptState* scriptState = scriptStateFromPage(debuggerWorld(), m_inspectedPage);
     ScriptObject window;
     ScriptGlobalObject::get(scriptState, "window", window);
     ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
-    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(callId);
     function.appendArgument(jsonResult);
     function.call();
 }
@@ -1639,7 +1626,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
 
         context.addPath(quadPath);
         context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor);
+        context.setStrokeColor(outlineColor, DeviceColorSpace);
         context.strokePath();
 
         context.restore();
@@ -1647,7 +1634,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
     
     // Now do the fill
     context.addPath(quadPath);
-    context.setFillColor(fillColor);
+    context.setFillColor(fillColor, DeviceColorSpace);
     context.fillPath();
 }
 
@@ -1798,10 +1785,14 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ResourcesPanel;
     else if (panelName == "scripts")
         return ScriptsPanel;
+    else if (panelName == "timeline")
+        return TimelinePanel;
     else if (panelName == "profiles")
         return ProfilesPanel;
     else if (panelName == "storage" || panelName == "databases")
         return StoragePanel;
+    else if (panelName == "console")
+        return ConsolePanel;
     else
         return ElementsPanel;
 }
@@ -1861,5 +1852,5 @@ void InspectorController::deleteCookie(const String& cookieName, const String& d
 }
 
 } // namespace WebCore
-
+    
 #endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index 382d887..bb4e1f3 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -62,16 +62,18 @@ class Document;
 class DocumentLoader;
 class GraphicsContext;
 class HitTestResult;
+class InjectedScriptHost;
 class InspectorBackend;
 class InspectorClient;
 class InspectorDOMAgent;
 class InspectorFrontend;
+class InspectorFrontendHost;
 class InspectorTimelineAgent;
 class JavaScriptCallFrame;
 class KURL;
 class Node;
 class Page;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
@@ -91,7 +93,7 @@ class InspectorController
 #endif
                                                     {
 public:
-    typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
+    typedef HashMap<unsigned long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
@@ -101,70 +103,19 @@ public:
         CurrentPanel,
         ConsolePanel,
         ElementsPanel,
-        ProfilesPanel,
         ResourcesPanel,
         ScriptsPanel,
+        TimelinePanel,
+        ProfilesPanel,
         StoragePanel
     } SpecialPanels;
 
-    struct Setting {
-        enum Type {
-            NoType, StringType, StringVectorType, DoubleType, IntegerType, BooleanType
-        };
-
-        Setting()
-            : m_type(NoType)
-        {
-        }
-
-        explicit Setting(bool value)
-            : m_type(BooleanType)
-        {
-            m_simpleContent.m_boolean = value;
-        }
-
-        explicit Setting(unsigned value)
-            : m_type(IntegerType)
-        {
-            m_simpleContent.m_integer = value;
-        }
-
-        explicit Setting(const String& value)
-            : m_type(StringType)
-        {
-            m_string = value;
-        }
-
-        Type type() const { return m_type; }
-
-        String string() const { ASSERT(m_type == StringType); return m_string; }
-        const Vector<String>& stringVector() const { ASSERT(m_type == StringVectorType); return m_stringVector; }
-        double doubleValue() const { ASSERT(m_type == DoubleType); return m_simpleContent.m_double; }
-        long integerValue() const { ASSERT(m_type == IntegerType); return m_simpleContent.m_integer; }
-        bool booleanValue() const { ASSERT(m_type == BooleanType); return m_simpleContent.m_boolean; }
-
-        void set(const String& value) { m_type = StringType; m_string = value; }
-        void set(const Vector<String>& value) { m_type = StringVectorType; m_stringVector = value; }
-        void set(double value) { m_type = DoubleType; m_simpleContent.m_double = value; }
-        void set(long value) { m_type = IntegerType; m_simpleContent.m_integer = value; }
-        void set(bool value) { m_type = BooleanType; m_simpleContent.m_boolean = value; }
-
-    private:
-        Type m_type;
-
-        String m_string;
-        Vector<String> m_stringVector;
-
-        union {
-            double m_double;
-            long m_integer;
-            bool m_boolean;
-        } m_simpleContent;
-    };
     InspectorController(Page*, InspectorClient*);
     ~InspectorController();
 
     InspectorBackend* inspectorBackend() { return m_inspectorBackend.get(); }
+    InspectorFrontendHost* inspectorFrontendHost() { return m_inspectorFrontendHost.get(); }
+    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
 
     void inspectedPageDestroyed();
     void pageDestroyed() { m_page = 0; }
@@ -173,8 +124,8 @@ public:
 
     Page* inspectedPage() const { return m_inspectedPage; }
 
-    const Setting& setting(const String& key) const;
-    void setSetting(const String& key, const Setting&);
+    String setting(const String& key) const;
+    void setSetting(const String& key, const String& value);
 
     void inspect(Node*);
     void highlight(Node*);
@@ -215,11 +166,11 @@ public:
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
 
     void identifierForInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    void willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-    void didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
-    void didFinishLoading(DocumentLoader*, unsigned long identifier);
-    void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
+    void willSendRequest(unsigned long identifier, const ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(unsigned long identifier, const ResourceResponse&);
+    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didFinishLoading(unsigned long identifier);
+    void didFailLoading(unsigned long identifier, const ResourceError&);
     void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
@@ -230,13 +181,12 @@ public:
 
     void startTimelineProfiler();
     void stopTimelineProfiler();
-    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
     void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
     void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
                                                         
-    void getCookies(long callId, const String& url);
+    void getCookies(long callId);
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
@@ -261,6 +211,8 @@ public:
     void startGroup(MessageSource source, ScriptCallStack* callFrame);
     void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
 
+    void markTimeline(const String& message); 
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
@@ -292,6 +244,8 @@ public:
 
 private:
     friend class InspectorBackend;
+    friend class InspectorFrontendHost;
+    friend class InjectedScriptHost;
     // Following are used from InspectorBackend and internally.
     void scriptObjectReady();
     void moveWindowBy(float x, float y) const;
@@ -341,7 +295,7 @@ private:
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
-    InspectorResource* getTrackedResource(long long identifier);
+    InspectorResource* getTrackedResource(unsigned long identifier);
 
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
@@ -378,7 +332,6 @@ private:
     ScriptState* m_scriptState;
     bool m_windowVisible;
     SpecialPanels m_showAfterVisible;
-    long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
@@ -386,10 +339,15 @@ private:
     bool m_resourceTrackingEnabled;
     bool m_resourceTrackingSettingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
+    RefPtr<InspectorFrontendHost> m_inspectorFrontendHost;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
     HashMap<String, ScriptValue> m_idToWrappedObject;
     ObjectGroupsMap m_objectGroups;
-
     long m_lastBoundObjectId;
+
+    typedef HashMap<String, String> Settings;
+    mutable Settings m_settings;
+
     Vector<pair<long, String> > m_pendingEvaluateTestCommands;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
diff --git a/WebCore/inspector/InspectorDOMAgent.cpp b/WebCore/inspector/InspectorDOMAgent.cpp
index f6c2d46..1aaf309 100644
--- a/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/WebCore/inspector/InspectorDOMAgent.cpp
@@ -68,13 +68,11 @@ InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
 
 InspectorDOMAgent::~InspectorDOMAgent()
 {
-    setDocument(0);
+    reset();
 }
 
-void InspectorDOMAgent::setDocument(Document* doc)
+void InspectorDOMAgent::reset()
 {
-    if (doc == mainFrameDocument())
-        return;
     discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
@@ -82,13 +80,21 @@ void InspectorDOMAgent::setDocument(Document* doc)
         stopListening((*it).get());
 
     ASSERT(!m_documents.size());
+}
+
+void InspectorDOMAgent::setDocument(Document* doc)
+{
+    if (doc == mainFrameDocument())
+        return;
+
+    reset();
 
     if (doc) {
         startListening(doc);
-        if (doc->documentElement()) {
+        if (doc->documentElement())
             pushDocumentToFrontend();
-        }
-    }
+    } else
+        m_frontend->setDocument(ScriptObject());
 }
 
 void InspectorDOMAgent::releaseDanglingNodes()
@@ -193,8 +199,9 @@ void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
             // Re-add frame owner element together with its new children.
             long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
             m_frontend->childNodeRemoved(parentId, frameOwnerId);
-            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
             ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            Node* previousSibling = innerPreviousSibling(node);
+            long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
             m_frontend->childNodeInserted(parentId, prevId, value);
             // Invalidate children requested flag for the element.
             m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
@@ -238,11 +245,14 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 }
 
-void InspectorDOMAgent::pushDocumentToFrontend()
+bool InspectorDOMAgent::pushDocumentToFrontend()
 {
     Document* document = mainFrameDocument();
+    if (!document)
+        return false;
     if (!m_documentNodeToIdMap.contains(document))
         m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
+    return true;
 }
 
 void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
@@ -278,6 +288,35 @@ Node* InspectorDOMAgent::nodeForId(long id)
     return 0;
 }
 
+Node* InspectorDOMAgent::nodeForPath(const String& path)
+{
+    // The path is of form "1,HTML,2,BODY,1,DIV"
+    Node* node = mainFrameDocument();
+    if (!node)
+        return 0;
+
+    Vector<String> pathTokens;
+    path.split(",", false, pathTokens);
+    for (size_t i = 0; i < pathTokens.size() - 1; i += 2) {
+        bool success = true;
+        unsigned childNumber = pathTokens[i].toUInt(&success);
+        if (!success)
+            return 0;
+        if (childNumber >= innerChildNodeCount(node))
+            return 0;
+
+        Node* child = innerFirstChild(node);
+        String childName = pathTokens[i + 1];
+        for (size_t j = 0; child && j < childNumber; ++j)
+            child = innerNextSibling(child);
+
+        if (!child || child->nodeName() != childName)
+            return 0;
+        node = child;
+    }
+    return node;
+}
+
 void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
 {
     pushChildNodesToFrontend(nodeId);
@@ -289,7 +328,8 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
     ASSERT(nodeToPush);  // Invalid input
 
     // If we are sending information to the client that is currently being created. Send root node first.
-    pushDocumentToFrontend();
+    if (!pushDocumentToFrontend())
+        return 0;
 
     // Return id in case the node is known.
     long result = m_documentNodeToIdMap.get(nodeToPush);
@@ -380,8 +420,8 @@ void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
     // Get the list of event types this Node is concerned with
     Vector<AtomicString> eventTypes;
     const EventListenerMap& listenerMap = d->eventListenerMap;
-    HashMap<AtomicString, EventListenerVector>::const_iterator end = listenerMap.end();
-    for (HashMap<AtomicString, EventListenerVector>::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
+    EventListenerMap::const_iterator end = listenerMap.end();
+    for (EventListenerMap::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
         eventTypes.append(iter->first);
 
     // Quick break if no useful listeners
@@ -465,7 +505,7 @@ ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeTo
             break;
     }
 
-    value.set("id", static_cast<int>(id));
+    value.set("id", id);
     value.set("nodeType", node->nodeType());
     value.set("nodeName", nodeName);
     value.set("localName", localName);
@@ -532,7 +572,7 @@ ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEven
     value.set("type", eventType);
     value.set("useCapture", registeredEventListener.useCapture);
     value.set("isAttribute", eventListener->isAttribute());
-    value.set("nodeId", static_cast<long long>(pushNodePathToFrontend(node)));
+    value.set("nodeId", pushNodePathToFrontend(node));
     value.set("listener", getEventListenerHandlerBody(node->document(), m_frontend->scriptState(), eventListener.get()));
     return value;
 }
@@ -569,9 +609,9 @@ Node* InspectorDOMAgent::innerPreviousSibling(Node* node)
     return node;
 }
 
-int InspectorDOMAgent::innerChildNodeCount(Node* node)
+unsigned InspectorDOMAgent::innerChildNodeCount(Node* node)
 {
-    int count = 0;
+    unsigned count = 0;
     Node* child = innerFirstChild(node);
     while (child) {
         count++;
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index 3f736f7..4579548 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -83,6 +83,8 @@ namespace WebCore {
         InspectorDOMAgent(InspectorFrontend* frontend);
         ~InspectorDOMAgent();
 
+        void reset();
+
         virtual bool operator==(const EventListener& other);
 
         // Methods called from the frontend.
@@ -97,6 +99,7 @@ namespace WebCore {
         void releaseDanglingNodes();
 
         Node* nodeForId(long nodeId);
+        Node* nodeForPath(const String& path);
         long pushNodePathToFrontend(Node* node);
 
    private:
@@ -109,7 +112,7 @@ namespace WebCore {
         long bind(Node* node, NodeToIdMap* nodesMap);
         void unbind(Node* node, NodeToIdMap* nodesMap);
 
-        void pushDocumentToFrontend();
+        bool pushDocumentToFrontend();
         void pushChildNodesToFrontend(long nodeId);
 
         ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
@@ -123,7 +126,7 @@ namespace WebCore {
         Node* innerFirstChild(Node* node);
         Node* innerNextSibling(Node* node);
         Node* innerPreviousSibling(Node* node);
-        int innerChildNodeCount(Node* node);
+        unsigned innerChildNodeCount(Node* node);
         Node* innerParentNode(Node* node);
         bool isWhitespace(Node* node);
 
diff --git a/WebCore/inspector/InspectorDatabaseResource.cpp b/WebCore/inspector/InspectorDatabaseResource.cpp
index c2dc5c6..cec0e28 100644
--- a/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -37,7 +37,6 @@
 #include "Frame.h"
 #include "InspectorFrontend.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 
 namespace WebCore {
 
@@ -59,9 +58,6 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
         return;
 
     ScriptObject jsonObject = frontend->newScriptObject();
-    ScriptObject database;
-    if (!getQuarantinedScriptObject(m_database.get(), database))
-        return;
     jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index 2c422ac..70f4868 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -38,7 +38,6 @@
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "ScriptState.h"
 #include "ScriptString.h"
 #include <wtf/OwnPtr.h>
@@ -80,24 +79,26 @@ void InspectorFrontend::didCommitLoad()
 
 void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addConsoleMessage"));
-    function->appendArgument(messageObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addConsoleMessage");
+    function.appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
-            function->appendArgument(frames[i]);
+            function.appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
+            function.appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
-        function->appendArgument(message);
-    function->call();
+        function.appendArgument(message);
+    function.call();
 }
 
 void InspectorFrontend::updateConsoleMessageRepeatCount(const int count)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateConsoleMessageRepeatCount"));
-    function->appendArgument(count);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateConsoleMessageRepeatCount");
+    function.appendArgument(count);
+    function.call();
 }
 
 void InspectorFrontend::clearConsoleMessages()
@@ -105,52 +106,50 @@ void InspectorFrontend::clearConsoleMessages()
     callSimpleFunction("clearConsoleMessages");
 }
 
-bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
+bool InspectorFrontend::addResource(unsigned long identifier, const ScriptObject& resourceObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addResource");
+    function.appendArgument(identifier);
+    function.appendArgument(resourceObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
-bool InspectorFrontend::updateResource(long long identifier, const ScriptObject& resourceObj)
+bool InspectorFrontend::updateResource(unsigned long identifier, const ScriptObject& resourceObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
-    function->appendArgument(identifier);
-    function->appendArgument(resourceObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateResource");
+    function.appendArgument(identifier);
+    function.appendArgument(resourceObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
-void InspectorFrontend::removeResource(long long identifier)
+void InspectorFrontend::removeResource(unsigned long identifier)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
-    function->appendArgument(identifier);
-    function->call();
-}
-
-void InspectorFrontend::addCookieDomain(String domain)
-{
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
-    function->appendArgument(domain);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("removeResource");
+    function.appendArgument(identifier);
+    function.call();
 }
 
-void InspectorFrontend::updateFocusedNode(long long nodeId)
+void InspectorFrontend::updateFocusedNode(long nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateFocusedNode");
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::setAttachedWindow(bool attached)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
-    function->appendArgument(attached);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setAttachedWindow");
+    function.appendArgument(attached);
+    function.call();
 }
 
 void InspectorFrontend::showPanel(int panel)
@@ -158,20 +157,23 @@ void InspectorFrontend::showPanel(int panel)
     const char* showFunctionName;
     switch (panel) {
         case InspectorController::ConsolePanel:
-            showFunctionName = "showConsole";
+            showFunctionName = "showConsolePanel";
             break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
-        case InspectorController::ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
         case InspectorController::ResourcesPanel:
             showFunctionName = "showResourcesPanel";
             break;
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
+        case InspectorController::TimelinePanel:
+            showFunctionName = "showTimelinePanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
         case InspectorController::StoragePanel:
             showFunctionName = "showStoragePanel";
             break;
@@ -216,9 +218,10 @@ void InspectorFrontend::timelineProfilerWasStopped()
 
 void InspectorFrontend::addRecordToTimeline(const ScriptObject& record)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addRecordToTimeline"));
-    function->appendArgument(record);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addRecordToTimeline");
+    function.appendArgument(record);
+    function.call();
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -249,60 +252,67 @@ void InspectorFrontend::profilerWasDisabled()
 
 void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
-    function->appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("parsedScriptSource");
+    function.appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
+    function.appendArgument(source.provider()->url());
+    function.appendArgument(JSC::UString(source.data(), source.length()));
+    function.appendArgument(source.firstLine());
+    function.call();
 }
 
 void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
-    function->appendArgument(source.provider()->url());
-    function->appendArgument(JSC::UString(source.data(), source.length()));
-    function->appendArgument(source.firstLine());
-    function->appendArgument(errorLine);
-    function->appendArgument(errorMessage);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("failedToParseScriptSource");
+    function.appendArgument(source.provider()->url());
+    function.appendArgument(JSC::UString(source.data(), source.length()));
+    function.appendArgument(source.firstLine());
+    function.appendArgument(errorLine);
+    function.appendArgument(errorMessage);
+    function.call();
 }
 
 void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
-    function->appendArgument(profile);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addProfileHeader");
+    function.appendArgument(profile);
+    function.call();
 }
 
 void InspectorFrontend::setRecordingProfile(bool isProfiling)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
-    function->appendArgument(isProfiling);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setRecordingProfile");
+    function.appendArgument(isProfiling);
+    function.call();
 }
 
 void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
-    function->appendArgument(callId);
-    function->appendArgument(headers);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfileHeaders");
+    function.appendArgument(callId);
+    function.appendArgument(headers);
+    function.call();
 }
 
 void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
-    function->appendArgument(callId);
-    function->appendArgument(profile);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetProfile");
+    function.appendArgument(callId);
+    function.appendArgument(profile);
+    function.call();
 }
 
 void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
-    function->appendArgument(callFrames);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("pausedScript");
+    function.appendArgument(callFrames);
+    function.call();
 }
 
 void InspectorFrontend::resumedScript()
@@ -313,203 +323,233 @@ void InspectorFrontend::resumedScript()
 
 void InspectorFrontend::setDocument(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setDocument");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
-    function->appendArgument(root);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setDetachedRoot");
+    function.appendArgument(root);
+    function.call();
 }
 
 void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setChildNodes"));
-    function->appendArgument(parentId);
-    function->appendArgument(nodes);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("setChildNodes");
+    function.appendArgument(parentId);
+    function.appendArgument(nodes);
+    function.call();
 }
 
 void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(newValue);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeCountUpdated");
+    function.appendArgument(id);
+    function.appendArgument(newValue);
+    function.call();
 }
 
 void InspectorFrontend::childNodeInserted(int parentId, int prevId, const ScriptObject& node)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeInserted"));
-    function->appendArgument(parentId);
-    function->appendArgument(prevId);
-    function->appendArgument(node);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeInserted");
+    function.appendArgument(parentId);
+    function.appendArgument(prevId);
+    function.appendArgument(node);
+    function.call();
 }
 
 void InspectorFrontend::childNodeRemoved(int parentId, int id)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeRemoved"));
-    function->appendArgument(parentId);
-    function->appendArgument(id);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("childNodeRemoved");
+    function.appendArgument(parentId);
+    function.appendArgument(id);
+    function.call();
 }
 
 void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("attributesUpdated"));
-    function->appendArgument(id);
-    function->appendArgument(attributes);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("attributesUpdated");
+    function.appendArgument(id);
+    function.appendArgument(attributes);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveNode(int callId, int nodeId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.call();
 }
 
 void InspectorFrontend::didGetChildNodes(int callId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
-    function->appendArgument(callId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetChildNodes");
+    function.appendArgument(callId);
+    function.call();
 }
 
 void InspectorFrontend::didApplyDomChange(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didApplyDomChange"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didApplyDomChange");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetEventListenersForNode"));
-    function->appendArgument(callId);
-    function->appendArgument(nodeId);
-    function->appendArgument(listenersArray);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetEventListenersForNode");
+    function.appendArgument(callId);
+    function.appendArgument(nodeId);
+    function.appendArgument(listenersArray);
+    function.call();
 }
 
 void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
-    function->appendArgument(callId);
-    function->appendArgument(cookies);
-    function->appendArgument(cookiesString);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetCookies");
+    function.appendArgument(callId);
+    function.appendArgument(cookies);
+    function.appendArgument(cookiesString);
+    function.call();
 }
 
 void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
-    function->appendArgument(callId);
-    function->appendArgument(result);
-    function->appendArgument(isException);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didDispatchOnInjectedScript");
+    function.appendArgument(callId);
+    function.appendArgument(result);
+    function.appendArgument(isException);
+    function.call();
 }
 
 #if ENABLE(DATABASE)
 bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addDatabase");
+    function.appendArgument(dbObject);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDatabase(int databaseId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
-    function->appendArgument(databaseId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("selectDatabase");
+    function.appendArgument(databaseId);
+    function.call();
 }
 void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
-    function->appendArgument(callId);
-    function->appendArgument(tableNames);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDatabaseTableNames");
+    function.appendArgument(callId);
+    function.appendArgument(tableNames);
+    function.call();
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
 bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addDOMStorage");
+    function.appendArgument(domStorageObj);
     bool hadException = false;
-    function->call(hadException);
+    function.call(hadException);
     return !hadException;
 }
 
 void InspectorFrontend::selectDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("selectDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 
 void InspectorFrontend::didGetDOMStorageEntries(int callId, const ScriptArray& entries)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDOMStorageEntries"));
-    function->appendArgument(callId);
-    function->appendArgument(entries);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didGetDOMStorageEntries");
+    function.appendArgument(callId);
+    function.appendArgument(entries);
+    function.call();
 }
 
 void InspectorFrontend::didSetDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didSetDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didSetDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::didRemoveDOMStorageItem(int callId, bool success)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveDOMStorageItem"));
-    function->appendArgument(callId);
-    function->appendArgument(success);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("didRemoveDOMStorageItem");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.call();
 }
 
 void InspectorFrontend::updateDOMStorage(int storageId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateDOMStorage"));
-    function->appendArgument(storageId);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("updateDOMStorage");
+    function.appendArgument(storageId);
+    function.call();
 }
 #endif
 
 void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
-    function->appendArgument(nodeIds);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("addNodesToSearchResult");
+    function.appendArgument(nodeIds);
+    function.call();
 }
 
-void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+void InspectorFrontend::contextMenuItemSelected(int itemId)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
-    function->appendArgument(callId);
-    function->appendArgument(script);
-    function->call();
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    function.appendArgument("contextMenuItemSelected");
+    function.appendArgument(itemId);
+    function.call();
+}
+
+void InspectorFrontend::contextMenuCleared()
+{
+    callSimpleFunction("contextMenuCleared");
 }
 
-PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
 {
-    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
-    function->appendArgument(functionName);
-    return function;
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch"); 
+    function.appendArgument("evaluateForTestInFrontend");
+    function.appendArgument(callId);
+    function.appendArgument(script);
+    function.call();
 }
 
 void InspectorFrontend::callSimpleFunction(const String& functionName)
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index 3cb9b8c..03dac14 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -67,13 +67,11 @@ namespace WebCore {
         void updateConsoleMessageRepeatCount(const int count);
         void clearConsoleMessages();
 
-        bool addResource(long long identifier, const ScriptObject& resourceObj);
-        bool updateResource(long long identifier, const ScriptObject& resourceObj);
-        void removeResource(long long identifier);
+        bool addResource(unsigned long identifier, const ScriptObject& resourceObj);
+        bool updateResource(unsigned long identifier, const ScriptObject& resourceObj);
+        void removeResource(unsigned long identifier);
 
-        void addCookieDomain(String);
-
-        void updateFocusedNode(long long nodeId);
+        void updateFocusedNode(long nodeId);
         void setAttachedWindow(bool attached);
         void showPanel(int panel);
         void populateInterface();
@@ -134,11 +132,13 @@ namespace WebCore {
 
         void addNodesToSearchResult(const String& nodeIds);
 
+        void contextMenuItemSelected(int itemId);
+        void contextMenuCleared();
+
         ScriptState* scriptState() const { return m_scriptState; }
 
         void evaluateForTestInFrontend(int callId, const String& script);
     private:
-        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
         InspectorController* m_inspectorController;
         ScriptState* m_scriptState;
diff --git a/WebCore/inspector/InspectorFrontendHost.cpp b/WebCore/inspector/InspectorFrontendHost.cpp
new file mode 100644
index 0000000..2b83942
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendHost.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ContextMenu.h"
+#include "ContextMenuItem.h"
+#include "ContextMenuController.h"
+#include "ContextMenuSelectionHandler.h"
+#include "Element.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HitTestResult.h"
+#include "HTMLFrameOwnerElement.h"
+#include "InspectorClient.h"
+#include "InspectorFrontend.h"
+#include "InspectorResource.h"
+#include "Page.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+InspectorFrontendHost::InspectorFrontendHost(InspectorController* inspectorController, InspectorClient* client)
+    : m_inspectorController(inspectorController)
+    , m_client(client)
+    , m_menuSelectionHandler(MenuSelectionHandler::create(this))
+{
+}
+
+InspectorFrontendHost::~InspectorFrontendHost()
+{
+    m_menuSelectionHandler->disconnect();
+}
+
+void InspectorFrontendHost::loaded()
+{
+    if (m_inspectorController)
+        m_inspectorController->scriptObjectReady();
+}
+
+void InspectorFrontendHost::attach()
+{
+    if (m_inspectorController)
+        m_inspectorController->attachWindow();
+}
+
+void InspectorFrontendHost::detach()
+{
+    if (m_inspectorController)
+        m_inspectorController->detachWindow();
+}
+
+void InspectorFrontendHost::closeWindow()
+{
+    if (m_inspectorController)
+        m_inspectorController->closeWindow();
+}
+
+void InspectorFrontendHost::windowUnloading()
+{
+    if (m_inspectorController)
+        m_inspectorController->close();
+}
+
+void InspectorFrontendHost::setAttachedWindowHeight(unsigned height)
+{
+    if (m_inspectorController)
+        m_inspectorController->setAttachedWindowHeight(height);
+}
+
+void InspectorFrontendHost::moveWindowBy(float x, float y) const
+{
+    if (m_inspectorController)
+        m_inspectorController->moveWindowBy(x, y);
+}
+
+String InspectorFrontendHost::localizedStringsURL()
+{
+    return m_client->localizedStringsURL();
+}
+
+String InspectorFrontendHost::hiddenPanels()
+{
+    return m_client->hiddenPanels();
+}
+
+const String& InspectorFrontendHost::platform() const
+{
+#if PLATFORM(MAC)
+#ifdef BUILDING_ON_TIGER
+    DEFINE_STATIC_LOCAL(const String, platform, ("mac-tiger"));
+#else
+    DEFINE_STATIC_LOCAL(const String, platform, ("mac-leopard"));
+#endif
+#elif PLATFORM(WIN_OS)
+    DEFINE_STATIC_LOCAL(const String, platform, ("windows"));
+#else
+    DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
+#endif
+    return platform;
+}
+
+
+const String& InspectorFrontendHost::port() const
+{
+#if PLATFORM(QT)
+    DEFINE_STATIC_LOCAL(const String, port, ("qt"));
+#elif PLATFORM(GTK)
+    DEFINE_STATIC_LOCAL(const String, port, ("gtk"));
+#elif PLATFORM(WX)
+    DEFINE_STATIC_LOCAL(const String, port, ("wx"));
+#else
+    DEFINE_STATIC_LOCAL(const String, port, ("unknown"));
+#endif
+
+    return port;
+}
+
+void InspectorFrontendHost::addResourceSourceToFrame(long identifier, Node* frame)
+{
+    if (!m_inspectorController)
+        return;
+    RefPtr<InspectorResource> resource = m_inspectorController->resources().get(identifier);
+    if (resource) {
+        String sourceString = resource->sourceString();
+        if (!sourceString.isEmpty())
+            addSourceToFrame(resource->mimeType(), sourceString, frame);
+    }
+}
+
+bool InspectorFrontendHost::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
+{
+    ASSERT_ARG(frameNode, frameNode);
+
+    if (!frameNode)
+        return false;
+
+    if (!frameNode->attached()) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    ASSERT(frameNode->isElementNode());
+    if (!frameNode->isElementNode())
+        return false;
+
+    Element* element = static_cast<Element*>(frameNode);
+    ASSERT(element->isFrameOwnerElement());
+    if (!element->isFrameOwnerElement())
+        return false;
+
+    HTMLFrameOwnerElement* frameOwner = static_cast<HTMLFrameOwnerElement*>(element);
+    ASSERT(frameOwner->contentFrame());
+    if (!frameOwner->contentFrame())
+        return false;
+
+    FrameLoader* loader = frameOwner->contentFrame()->loader();
+
+    loader->setResponseMIMEType(mimeType);
+    loader->begin();
+    loader->write(source);
+    loader->end();
+
+    return true;
+}
+
+String InspectorFrontendHost::setting(const String& key)
+{
+    return m_inspectorController ? m_inspectorController->setting(key) : "";
+}
+
+void InspectorFrontendHost::setSetting(const String& key, const String& value)
+{
+    if (m_inspectorController)
+        m_inspectorController->setSetting(key, value);
+}
+
+void InspectorFrontendHost::showContextMenu(Event* event, Vector<ContextMenuItem>& items)
+{
+    if (!m_inspectorController)
+        return;
+    if (!m_inspectorController->windowVisible())
+        return;
+
+    ContextMenuController* menuController = m_inspectorController->m_page->contextMenuController();
+    menuController->showContextMenu(event, items, m_menuSelectionHandler);
+}
+
+void InspectorFrontendHost::contextMenuItemSelected(ContextMenuItem* item)
+{
+    if (m_inspectorController && m_inspectorController->windowVisible()) {
+        int itemNumber = item->action() - ContextMenuItemBaseCustomTag;
+        m_inspectorController->m_frontend->contextMenuItemSelected(itemNumber);
+    }
+}
+
+void InspectorFrontendHost::contextMenuCleared()
+{
+    if (m_inspectorController && m_inspectorController->windowVisible())
+        m_inspectorController->m_frontend->contextMenuCleared();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorFrontendHost.h b/WebCore/inspector/InspectorFrontendHost.h
new file mode 100644
index 0000000..e0cfa6d
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontendHost_h
+#define InspectorFrontendHost_h
+
+#include "Console.h"
+#include "ContextMenuSelectionHandler.h"
+#include "InspectorController.h"
+#include "PlatformString.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ContextMenuItem;
+class Event;
+class InspectorClient;
+class Node;
+
+class InspectorFrontendHost : public RefCounted<InspectorFrontendHost>
+{
+public:
+    static PassRefPtr<InspectorFrontendHost> create(InspectorController* inspectorController, InspectorClient* client)
+    {
+        return adoptRef(new InspectorFrontendHost(inspectorController, client));
+    }
+
+    ~InspectorFrontendHost();
+
+    InspectorController* inspectorController() { return m_inspectorController; }
+
+    void disconnectController() { m_inspectorController = 0; }
+
+    void loaded();
+    void attach();
+    void detach();
+    void closeWindow();
+    void windowUnloading();
+
+    void setAttachedWindowHeight(unsigned height);
+    void moveWindowBy(float x, float y) const;
+
+    String localizedStringsURL();
+    String hiddenPanels();
+    const String& platform() const;
+    const String& port() const;
+
+    void addResourceSourceToFrame(long identifier, Node* frame);
+    bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
+
+    String setting(const String& key);
+    void setSetting(const String& key, const String& value);
+
+    // Called from [Custom] implementations.
+    void showContextMenu(Event*, Vector<ContextMenuItem>& items);
+    void contextMenuItemSelected(ContextMenuItem*);
+    void contextMenuCleared();
+
+private:
+    class MenuSelectionHandler : public ContextMenuSelectionHandler {
+    public:
+        static PassRefPtr<MenuSelectionHandler> create(InspectorFrontendHost* frontendHost)
+        {
+            return adoptRef(new MenuSelectionHandler(frontendHost));
+        }
+
+        virtual ~MenuSelectionHandler() { }
+
+        void disconnect() { m_frontendHost = 0; }
+
+        virtual void contextMenuItemSelected(ContextMenuItem* item)
+        {
+            if (m_frontendHost)
+                m_frontendHost->contextMenuItemSelected(item);
+        }
+
+        virtual void contextMenuCleared()
+        {
+            if (m_frontendHost)
+                m_frontendHost->contextMenuCleared();
+        }
+
+    private:
+        MenuSelectionHandler(InspectorFrontendHost* frontendHost)
+            : m_frontendHost(frontendHost) { }
+        InspectorFrontendHost* m_frontendHost;
+    };
+
+    InspectorFrontendHost(InspectorController* inspectorController, InspectorClient* client);
+
+    InspectorController* m_inspectorController;
+    InspectorClient* m_client;
+    RefPtr<MenuSelectionHandler> m_menuSelectionHandler;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontendHost_h)
diff --git a/WebCore/inspector/InspectorFrontendHost.idl b/WebCore/inspector/InspectorFrontendHost.idl
new file mode 100644
index 0000000..c62a7e2
--- /dev/null
+++ b/WebCore/inspector/InspectorFrontendHost.idl
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InspectorFrontendHost {
+        void loaded();
+        void attach();
+        void detach();
+        void closeWindow();
+        void windowUnloading();
+
+        void setAttachedWindowHeight(in unsigned long height);
+        void moveWindowBy(in float x, in float y);
+
+        DOMString localizedStringsURL();
+        DOMString hiddenPanels();
+        DOMString platform();
+        DOMString port();
+
+        void addResourceSourceToFrame(in long identifier, in Node frame);
+        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
+
+        DOMString setting(in DOMString key);
+        void setSetting(in DOMString key, in DOMString value);
+
+        [Custom] void search(in Node node, in DOMString query);
+        [Custom] void showContextMenu(in MouseEvent event, in DOMObject items);
+    };
+}
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index b8bb22b..0a4cb73 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -46,7 +46,7 @@
 
 namespace WebCore {
 
-InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+InspectorResource::InspectorResource(unsigned long identifier, DocumentLoader* loader)
     : m_identifier(identifier)
     , m_loader(loader)
     , m_frame(loader->frame())
@@ -70,7 +70,7 @@ InspectorResource::~InspectorResource()
 {
 }
 
-PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+PassRefPtr<InspectorResource> InspectorResource::createCached(unsigned long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
 {
     PassRefPtr<InspectorResource> resource = create(identifier, loader);
 
@@ -105,6 +105,11 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
 {
     m_expectedContentLength = response.expectedContentLength();
     m_mimeType = response.mimeType();
+    if (m_mimeType.isEmpty() && response.httpStatusCode() == 304) {
+        CachedResource* cachedResource = cache()->resourceForURL(response.url().string());
+        if (cachedResource)
+            m_mimeType = cachedResource->response().mimeType();
+    }
     m_responseHeaderFields = response.httpHeaderFields();
     m_responseStatusCode = response.httpStatusCode();
     m_suggestedFilename = response.suggestedFilename();
@@ -128,6 +133,7 @@ void InspectorResource::createScriptObject(InspectorFrontend* frontend)
         ScriptObject requestHeaders = frontend->newScriptObject();
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("documentURL", m_frame->document()->url().string());
         jsonObject.set("requestURL", requestURL());
         jsonObject.set("host", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
@@ -156,6 +162,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
     ScriptObject jsonObject = frontend->newScriptObject();
     if (m_changes.hasChange(RequestChange)) {
         jsonObject.set("url", requestURL());
+        jsonObject.set("documentURL", m_frame->document()->url().string());
         jsonObject.set("domain", m_requestURL.host());
         jsonObject.set("path", m_requestURL.path());
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
@@ -184,7 +191,7 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         jsonObject.set("type", static_cast<int>(type()));
         jsonObject.set("didTypeChange", true);
     }
-    
+
     if (m_changes.hasChange(LengthChange)) {
         jsonObject.set("contentLength", m_length);
         jsonObject.set("didLengthChange", true);
@@ -240,18 +247,10 @@ CachedResource* InspectorResource::cachedResource() const
     return cachedResource;
 }
 
-InspectorResource::Type InspectorResource::type() const
+InspectorResource::Type InspectorResource::cachedResourceType() const
 {
-    if (!m_xmlHttpResponseText.isNull())
-        return XHR;
-
-    if (m_requestURL == m_loader->requestURL())
-        return Doc;
-
-    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
-        return Image;
-
     CachedResource* cachedResource = this->cachedResource();
+
     if (!cachedResource)
         return Other;
 
@@ -272,6 +271,26 @@ InspectorResource::Type InspectorResource::type() const
     }
 }
 
+InspectorResource::Type InspectorResource::type() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return XHR;
+
+    if (m_requestURL == m_loader->requestURL()) {
+        InspectorResource::Type resourceType = cachedResourceType();
+        if (resourceType == Other)
+            return Doc;
+
+        return resourceType;
+    }
+
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
+        return Image;
+
+    return cachedResourceType();
+
+}
+
 void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
 {
     m_xmlHttpResponseText = data;
@@ -362,6 +381,12 @@ void InspectorResource::addLength(int lengthReceived)
 {
     m_length += lengthReceived;
     m_changes.set(LengthChange);
+
+    // Update load time, otherwise the resource will
+    // have start time == end time and  0 load duration
+    // until its loading is completed.
+    m_endTime = currentTime();
+    m_changes.set(TimingChange);
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 0335586..7d9b977 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -51,7 +51,7 @@ namespace WebCore {
     class Frame;
     class ResourceResponse;
 
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class InspectorResource : public RefCounted<InspectorResource> {
     public:
@@ -68,12 +68,12 @@ namespace WebCore {
             Other
         };
 
-        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
+        static PassRefPtr<InspectorResource> create(unsigned long identifier, DocumentLoader* loader)
         {
             return adoptRef(new InspectorResource(identifier, loader));
         }
 
-        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+        static PassRefPtr<InspectorResource> createCached(unsigned long identifier, DocumentLoader*, const CachedResource*);
 
         ~InspectorResource();
 
@@ -91,7 +91,7 @@ namespace WebCore {
 
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
-        long long identifier() const { return m_identifier; }
+        unsigned long identifier() const { return m_identifier; }
         String requestURL() const { return m_requestURL.string(); }
         Frame* frame() const { return m_frame.get(); }
         const String& mimeType() const { return m_mimeType; }
@@ -125,10 +125,13 @@ namespace WebCore {
         public:
             Changes() : m_change(NoChange) {}
 
-            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline bool hasChange(ChangeType change)
+            {
+                return m_change & change || (m_change == NoChange && change == NoChange);
+            }
             inline void set(ChangeType change)
             {
-                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));
             }
             inline void clear(ChangeType change)
             {
@@ -142,12 +145,13 @@ namespace WebCore {
             ChangeType m_change;
         };
 
-        InspectorResource(long long identifier, DocumentLoader*);
+        InspectorResource(unsigned long identifier, DocumentLoader*);
         Type type() const;
 
+        Type cachedResourceType() const;
         CachedResource* cachedResource() const;
 
-        long long m_identifier;
+        unsigned long m_identifier;
         RefPtr<DocumentLoader> m_loader;
         RefPtr<Frame> m_frame;
         KURL m_requestURL;
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
index 4f7b736..b28aa97 100644
--- a/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -35,6 +35,9 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "TimelineRecordFactory.h"
 
 #include <wtf/CurrentTime.h>
@@ -51,14 +54,15 @@ InspectorTimelineAgent::~InspectorTimelineAgent()
 {
 }
 
-void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 {
-    pushCurrentRecord(TimelineRecordFactory::createDOMDispatchRecord(m_frontend, currentTimeInMilliseconds(), event), DOMDispatchTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEventDispatchRecord(m_frontend, currentTimeInMilliseconds(), event),
+        EventDispatchTimelineRecordType);
 }
 
-void InspectorTimelineAgent::didDispatchDOMEvent()
+void InspectorTimelineAgent::didDispatchEvent()
 {
-    didCompleteCurrentRecord(DOMDispatchTimelineRecordType);
+    didCompleteCurrentRecord(EventDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willLayout()
@@ -81,9 +85,10 @@ void InspectorTimelineAgent::didRecalculateStyle()
     didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
 }
 
-void InspectorTimelineAgent::willPaint()
+void InspectorTimelineAgent::willPaint(const IntRect& rect)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), PaintTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createPaintRecord(m_frontend, currentTimeInMilliseconds(), rect),
+        PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didPaint()
@@ -126,7 +131,7 @@ void InspectorTimelineAgent::didFireTimer()
 
 void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
         XHRReadyStateChangeRecordType);
 }
 
@@ -137,7 +142,7 @@ void InspectorTimelineAgent::didChangeXHRReadyState()
 
 void InspectorTimelineAgent::willLoadXHR(const String& url) 
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRLoadTimelineRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
 }
 
 void InspectorTimelineAgent::didLoadXHR()
@@ -145,14 +150,44 @@ void InspectorTimelineAgent::didLoadXHR()
     didCompleteCurrentRecord(XHRLoadRecordType);
 }
 
-void InspectorTimelineAgent::willEvaluateScriptTag(const String& url, int lineNumber)
+void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumber)
 {
-    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTagTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTimelineRecordType);
 }
     
-void InspectorTimelineAgent::didEvaluateScriptTag()
+void InspectorTimelineAgent::didEvaluateScript()
 {
-    didCompleteCurrentRecord(EvaluateScriptTagTimelineRecordType);
+    didCompleteCurrentRecord(EvaluateScriptTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, bool isMainResource,
+    const ResourceRequest& request)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceSendRequestRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, isMainResource, request);
+    record.set("type", ResourceSendRequestTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceReceiveResponseRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, response);
+    record.set("type", ResourceReceiveResponseTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail)
+{
+    ScriptObject record = TimelineRecordFactory::createResourceFinishRecord(m_frontend, currentTimeInMilliseconds(),
+        identifier, didFail);
+    record.set("type", ResourceFinishTimelineRecordType);
+    m_frontend->addRecordToTimeline(record);
+}
+
+void InspectorTimelineAgent::didMarkTimeline(const String& message)
+{
+    addRecordToTimeline(TimelineRecordFactory::createMarkTimelineRecord(m_frontend, currentTimeInMilliseconds(), message), MarkTimelineRecordType);
 }
 
 void InspectorTimelineAgent::reset()
@@ -180,13 +215,16 @@ void InspectorTimelineAgent::addRecordToTimeline(ScriptObject record, TimelineRe
 
 void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
 {
-    ASSERT(!m_recordStack.isEmpty());
-    TimelineRecordEntry entry = m_recordStack.last();
-    m_recordStack.removeLast();
-    ASSERT(entry.type == type);
-    entry.record.set("children", entry.children);
-    entry.record.set("endTime", currentTimeInMilliseconds());
-    addRecordToTimeline(entry.record, type);
+    // An empty stack could merely mean that the timeline agent was turned on in the middle of
+    // an event.  Don't treat as an error.
+    if (!m_recordStack.isEmpty()) {
+        TimelineRecordEntry entry = m_recordStack.last();
+        m_recordStack.removeLast();
+        ASSERT(entry.type == type);
+        entry.record.set("children", entry.children);
+        entry.record.set("endTime", currentTimeInMilliseconds());
+        addRecordToTimeline(entry.record, type);
+    }
 }
 
 double InspectorTimelineAgent::currentTimeInMilliseconds()
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
index d1d3675..1929286 100644
--- a/WebCore/inspector/InspectorTimelineAgent.h
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -42,10 +42,13 @@
 namespace WebCore {
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
 
     // Must be kept in sync with TimelineAgent.js
     enum TimelineRecordType {
-        DOMDispatchTimelineRecordType = 0,
+        EventDispatchTimelineRecordType = 0,
         LayoutTimelineRecordType = 1,
         RecalculateStylesTimelineRecordType = 2,
         PaintTimelineRecordType = 3,
@@ -55,7 +58,11 @@ namespace WebCore {
         TimerFireTimelineRecordType = 7,
         XHRReadyStateChangeRecordType = 8,
         XHRLoadRecordType = 9,
-        EvaluateScriptTagTimelineRecordType = 10,
+        EvaluateScriptTimelineRecordType = 10,
+        MarkTimelineRecordType = 11,
+        ResourceSendRequestTimelineRecordType = 12,
+        ResourceReceiveResponseTimelineRecordType = 13,
+        ResourceFinishTimelineRecordType = 14,
     };
 
     class InspectorTimelineAgent {
@@ -67,8 +74,8 @@ namespace WebCore {
         void resetFrontendProxyObject(InspectorFrontend*);
 
         // Methods called from WebCore.
-        void willDispatchDOMEvent(const Event&);
-        void didDispatchDOMEvent();
+        void willDispatchEvent(const Event&);
+        void didDispatchEvent();
 
         void willLayout();
         void didLayout();
@@ -76,7 +83,7 @@ namespace WebCore {
         void willRecalculateStyle();
         void didRecalculateStyle();
 
-        void willPaint();
+        void willPaint(const IntRect&);
         void didPaint();
 
         void willWriteHTML();
@@ -92,8 +99,14 @@ namespace WebCore {
         void willLoadXHR(const String&);
         void didLoadXHR();
 
-        void willEvaluateScriptTag(const String&, int);
-        void didEvaluateScriptTag();
+        void willEvaluateScript(const String&, int);
+        void didEvaluateScript();
+
+        void didMarkTimeline(const String&);
+
+        void willSendResourceRequest(unsigned long, bool isMainResource, const ResourceRequest&);
+        void didReceiveResourceResponse(unsigned long, const ResourceResponse&);
+        void didFinishLoadingResource(unsigned long, bool didFail);
 
         static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
     private:
diff --git a/WebCore/inspector/JavaScriptCallFrame.cpp b/WebCore/inspector/JavaScriptCallFrame.cpp
index 1559d82..cbc5314 100644
--- a/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -106,7 +106,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
         return jsNull();
 
     JSLock lock(SilenceAssertionsOnly);
-    return DebuggerCallFrame_evaluateInWorld(m_debuggerCallFrame, script, exception);
+    return m_debuggerCallFrame.evaluate(script, exception);
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/TimelineRecordFactory.cpp b/WebCore/inspector/TimelineRecordFactory.cpp
index 085bcd9..4fdd502 100644
--- a/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/WebCore/inspector/TimelineRecordFactory.cpp
@@ -35,11 +35,14 @@
 
 #include "Event.h"
 #include "InspectorFrontend.h"
+#include "IntRect.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptArray.h"
 #include "ScriptObject.h"
+
 namespace WebCore {
 
-// static
 ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* frontend, double startTime)
 {
     ScriptObject record = frontend->newScriptObject();
@@ -47,8 +50,7 @@ ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* front
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
+ScriptObject TimelineRecordFactory::createEventDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -57,7 +59,6 @@ ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* f
     return record;
 }
 
-// static
 ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend* frontend, double startTime, int timerId)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
@@ -67,7 +68,6 @@ ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend*
     return record;
 }
 
-// static
 ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend* frontend, double startTime, int timerId, int timeout, bool singleShot)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
@@ -79,8 +79,7 @@ ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend*
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
+ScriptObject TimelineRecordFactory::createXHRReadyStateChangeRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -90,8 +89,7 @@ ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(Insp
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url)
+ScriptObject TimelineRecordFactory::createXHRLoadRecord(InspectorFrontend* frontend, double startTime, const String& url)
 {
     ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
@@ -100,15 +98,73 @@ ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFronten
     return record;
 }
 
-// static
-ScriptObject TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
+ScriptObject TimelineRecordFactory::createEvaluateScriptRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
 {
-    ScriptObject item = createGenericRecord(frontend, startTime);
+    ScriptObject record = createGenericRecord(frontend, startTime);
     ScriptObject data = frontend->newScriptObject();
     data.set("url", url);
     data.set("lineNumber", lineNumber);
-    item.set("data", data);
-    return item;
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createMarkTimelineRecord(InspectorFrontend* frontend, double startTime, const String& message) 
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("message", message);
+    record.set("data", data);
+    return record;
+}
+
+
+ScriptObject TimelineRecordFactory::createResourceSendRequestRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, bool isMainResource, const ResourceRequest& request)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("url", request.url().string());
+    data.set("requestMethod", request.httpMethod());
+    data.set("isMainResource", isMainResource);
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createResourceReceiveResponseRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, const ResourceResponse& response)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("statusCode", response.httpStatusCode());
+    data.set("mimeType", response.mimeType());
+    data.set("expectedContentLength", response.expectedContentLength());
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createResourceFinishRecord(InspectorFrontend* frontend, double startTime,
+    unsigned long identifier, bool didFail)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("identifier", identifier);
+    data.set("didFail", didFail);
+    record.set("data", data);
+    return record;
+}
+
+ScriptObject TimelineRecordFactory::createPaintRecord(InspectorFrontend* frontend, double startTime, const IntRect& rect)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("x", rect.x());
+    data.set("y", rect.y());
+    data.set("width", rect.width());
+    data.set("height", rect.height());
+    record.set("data", data);
+    return record;
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/TimelineRecordFactory.h b/WebCore/inspector/TimelineRecordFactory.h
index 3d36649..e0ccc95 100644
--- a/WebCore/inspector/TimelineRecordFactory.h
+++ b/WebCore/inspector/TimelineRecordFactory.h
@@ -37,22 +37,36 @@ namespace WebCore {
 
     class Event;
     class InspectorFrontend;
+    class IntRect;
+    class ResourceRequest;
+    class ResourceResponse;
     class ScriptObject;
 
     class TimelineRecordFactory {
     public:
         static ScriptObject createGenericRecord(InspectorFrontend*, double startTime);
 
-        static ScriptObject createDOMDispatchRecord(InspectorFrontend*, double startTime, const Event&);
+        static ScriptObject createEventDispatchRecord(InspectorFrontend*, double startTime, const Event&);
 
         static ScriptObject createGenericTimerRecord(InspectorFrontend*, double startTime, int timerId);
 
         static ScriptObject createTimerInstallRecord(InspectorFrontend*, double startTime, int timerId, int timeout, bool singleShot);
 
-        static ScriptObject createXHRReadyStateChangeTimelineRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
-        static ScriptObject createXHRLoadTimelineRecord(InspectorFrontend*, double startTime, const String& url);
+        static ScriptObject createXHRReadyStateChangeRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
+        static ScriptObject createXHRLoadRecord(InspectorFrontend*, double startTime, const String& url);
         
-        static ScriptObject createEvaluateScriptTagTimelineRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+        static ScriptObject createEvaluateScriptRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+        
+        static ScriptObject createMarkTimelineRecord(InspectorFrontend*, double startTime, const String&);
+
+        static ScriptObject createResourceSendRequestRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, bool isMainResource, const ResourceRequest&);
+        static ScriptObject createResourceReceiveResponseRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, const ResourceResponse&);
+        static ScriptObject createResourceFinishRecord(InspectorFrontend*, double startTime,
+            unsigned long identifier, bool didFail);
+
+        static ScriptObject createPaintRecord(InspectorFrontend*, double startTime, const IntRect&);
 
     private:
         TimelineRecordFactory() { }
diff --git a/WebCore/inspector/front-end/AbstractTimelinePanel.js b/WebCore/inspector/front-end/AbstractTimelinePanel.js
index 75e4062..c5180f6 100644
--- a/WebCore/inspector/front-end/AbstractTimelinePanel.js
+++ b/WebCore/inspector/front-end/AbstractTimelinePanel.js
@@ -57,10 +57,13 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Should be implemented by the concrete subclasses.
     },
 
-    createInterface: function()
+    get items()
     {
-        this._createFilterPanel();
+        return this._items;
+    },
 
+    createInterface: function()
+    {
         this.containerElement = document.createElement("div");
         this.containerElement.id = "resources-container";
         this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
@@ -70,10 +73,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.sidebarElement.id = "resources-sidebar";
         this.populateSidebar();
 
-        this._createGraph();
+        this._containerContentElement = document.createElement("div");
+        this._containerContentElement.id = "resources-container-content";
+        this.containerElement.appendChild(this._containerContentElement);
+
+        this.summaryBar = new WebInspector.SummaryBar(this.categories);
+        this.summaryBar.element.id = "resources-summary";
+        this._containerContentElement.appendChild(this.summaryBar.element);
+
+        this._timelineGrid = new WebInspector.TimelineGrid();
+        this._containerContentElement.appendChild(this._timelineGrid.element);
+        this.itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
     },
 
-    _createFilterPanel: function()
+    createFilterPanel: function()
     {
         this.filterBarElement = document.createElement("div");
         this.filterBarElement.id = "resources-filter";
@@ -108,14 +121,14 @@ WebInspector.AbstractTimelinePanel.prototype = {
             createFilterElement.call(this, category);
     },
 
-    _showCategory: function(category)
+    showCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.addStyleClass(filterClass);
         this.itemsTreeElement.childrenListElement.addStyleClass(filterClass);
     },
 
-    _hideCategory: function(category)
+    hideCategory: function(category)
     {
         var filterClass = "filter-" + category.toLowerCase();
         this.itemsGraphsElement.removeStyleClass(filterClass);
@@ -132,7 +145,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
                     continue;
 
                 child.removeStyleClass("selected");
-                this._hideCategory(child.category);
+                this.hideCategory(child.category);
             }
         }
 
@@ -148,7 +161,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // Something other than All is being selected, so we want to unselect All.
             if (this.filterAllElement.hasStyleClass("selected")) {
                 this.filterAllElement.removeStyleClass("selected");
-                this._hideCategory("all");
+                this.hideCategory("all");
             }
         }
 
@@ -158,7 +171,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
             unselectAll.call(this);
 
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
             return;
         }
 
@@ -166,18 +179,18 @@ WebInspector.AbstractTimelinePanel.prototype = {
             // If selectMultiple is turned on, and we were selected, we just
             // want to unselect ourselves.
             target.removeStyleClass("selected");
-            this._hideCategory(target.category);
+            this.hideCategory(target.category);
         } else {
             // If selectMultiple is turned on, and we weren't selected, we just
             // want to select ourselves.
             target.addStyleClass("selected");
-            this._showCategory(target.category);
+            this.showCategory(target.category);
         }
     },
 
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -191,83 +204,20 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.containerElement.scrollTop = 0;
     },
 
-    _createGraph: function()
-    {
-        this._containerContentElement = document.createElement("div");
-        this._containerContentElement.id = "resources-container-content";
-        this.containerElement.appendChild(this._containerContentElement);
-
-        this.summaryBar = new WebInspector.SummaryBar(this.categories);
-        this.summaryBar.element.id = "resources-summary";
-        this._containerContentElement.appendChild(this.summaryBar.element);
-
-        this.itemsGraphsElement = document.createElement("div");
-        this.itemsGraphsElement.id = "resources-graphs";
-        this._containerContentElement.appendChild(this.itemsGraphsElement);
-
-        this.dividersElement = document.createElement("div");
-        this.dividersElement.id = "resources-dividers";
-        this._containerContentElement.appendChild(this.dividersElement);
-
-        this.eventDividersElement = document.createElement("div");
-        this.eventDividersElement.id = "resources-event-dividers";
-        this._containerContentElement.appendChild(this.eventDividersElement);
-
-        this.dividersLabelBarElement = document.createElement("div");
-        this.dividersLabelBarElement.id = "resources-dividers-label-bar";
-        this._containerContentElement.appendChild(this.dividersLabelBarElement);
-    },
-
     updateGraphDividersIfNeeded: function(force)
     {
         if (!this.visible) {
             this.needsRefresh = true;
             return false;
         }
-
-        if (document.body.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return false;
-        }
-
-        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
-        var slice = this.calculator.boundarySpan / dividerCount;
-        if (!force && this._currentDividerSlice === slice)
-            return false;
-
-        this._currentDividerSlice = slice;
-
-        this.dividersElement.removeChildren();
-        this.eventDividersElement.removeChildren();
-        this.dividersLabelBarElement.removeChildren();
-
-        for (var i = 1; i <= dividerCount; ++i) {
-            var divider = document.createElement("div");
-            divider.className = "resources-divider";
-            if (i === dividerCount)
-                divider.addStyleClass("last");
-            divider.style.left = ((i / dividerCount) * 100) + "%";
-
-            this.dividersElement.appendChild(divider.cloneNode());
-
-            var label = document.createElement("div");
-            label.className = "resources-divider-label";
-            if (!isNaN(slice))
-                label.textContent = this.calculator.formatValue(slice * i);
-            divider.appendChild(label);
-
-            this.dividersLabelBarElement.appendChild(divider);
-        }
+        return this._timelineGrid.updateDividers(force, this.calculator);
     },
 
     _updateDividersLabelBarPosition: function()
     {
         var scrollTop = this.containerElement.scrollTop;
         var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
-        this.dividersElement.style.top = scrollTop + "px";
-        this.eventDividersElement.style.top = scrollTop + "px";
-        this.dividersLabelBarElement.style.top = dividersTop + "px";
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
     },
 
     get needsRefresh()
@@ -318,26 +268,32 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this.updateGraphDividersIfNeeded();
     },
 
+    invalidateAllItems: function()
+    {
+        this._staleItems = this._items.slice();
+    },
+
     refresh: function()
     {
         this.needsRefresh = false;
 
         var staleItemsLength = this._staleItems.length;
+
         var boundariesChanged = false;
 
         for (var i = 0; i < staleItemsLength; ++i) {
             var item = this._staleItems[i];
-            if (!item._itemTreeElement) {
+            if (!item._itemsTreeElement) {
                 // Create the timeline tree element and graph.
-                item._itemTreeElement = this.createItemTreeElement(item);
-                item._itemTreeElement._itemGraph = this.createItemGraph(item);
+                item._itemsTreeElement = this.createItemTreeElement(item);
+                item._itemsTreeElement._itemGraph = this.createItemGraph(item);
 
-                this.itemsTreeElement.appendChild(item._itemTreeElement);
-                this.itemsGraphsElement.appendChild(item._itemTreeElement._itemGraph.graphElement);
+                this.itemsTreeElement.appendChild(item._itemsTreeElement);
+                this.itemsGraphsElement.appendChild(item._itemsTreeElement._itemGraph.graphElement);
             }
 
-            if (item._itemTreeElement.refresh)
-                item._itemTreeElement.refresh();
+            if (item._itemsTreeElement.refresh)
+                item._itemsTreeElement.refresh();
 
             if (this.calculator.updateBoundaries(item))
                 boundariesChanged = true;
@@ -345,12 +301,12 @@ WebInspector.AbstractTimelinePanel.prototype = {
 
         if (boundariesChanged) {
             // The boundaries changed, so all item graphs are stale.
-            this._staleItems = this._items;
+            this._staleItems = this._items.slice();
             staleItemsLength = this._staleItems.length;
         }
 
         for (var i = 0; i < staleItemsLength; ++i)
-            this._staleItems[i]._itemTreeElement._itemGraph.refresh(this.calculator);
+            this._staleItems[i]._itemsTreeElement._itemGraph.refresh(this.calculator);
 
         this._staleItems = [];
 
@@ -394,7 +350,7 @@ WebInspector.AbstractTimelinePanel.prototype = {
         this._calculator = x;
         this._calculator.reset();
 
-        this._staleItems = this._items;
+        this._staleItems = this._items.slice();
         this.refresh();
     },
 
@@ -408,12 +364,12 @@ WebInspector.AbstractTimelinePanel.prototype = {
     {
         this._items.remove(item, true);
 
-        if (item._itemTreeElement) {
-            this.itemsTreeElement.removeChild(resource._itemTreeElement);
-            this.itemsGraphsElement.removeChild(resource._itemTreeElement._itemGraph.graphElement);
+        if (item._itemsTreeElement) {
+            this.itemsTreeElement.removeChild(item._itemsTreeElement);
+            this.itemsGraphsElement.removeChild(item._itemsTreeElement._itemGraph.graphElement);
         }
 
-        delete item._itemTreeElement;
+        delete item._itemsTreeElement;
         this.adjustScrollPosition();
     },
 
@@ -458,6 +414,11 @@ WebInspector.AbstractTimelinePanel.prototype = {
         // Prevent the container from being scrolled off the end.
         if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
             this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._timelineGrid.addEventDivider(divider);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
index 41a8a3a..5aaae0c 100644
--- a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -31,11 +31,7 @@
 
 WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
 {
-    // In bottom up mode, our parents are our children since we display an inverted tree.
-    // However, we don't want to show the very top parent since it is redundant.
-    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
-
-    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, this._willHaveChildren(profileNode));
 
     this._remainingNodeInfos = [];
 }
@@ -78,6 +74,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
             this._merge(child, true);
     },
 
+    _restore: function()
+    {
+        WebInspector.ProfileDataGridNode.prototype._restore();
+
+        if (!this.children.length)
+            this.hasChildren = this._willHaveChildren();
+    },
+
     _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
     {
         this.selfTime -= child.selfTime;
@@ -128,6 +132,14 @@ WebInspector.BottomUpProfileDataGridNode.prototype = {
         }
 
         delete this._remainingNodeInfos;
+    },
+
+    _willHaveChildren: function(profileNode)
+    {
+        profileNode = profileNode || this.profileNode;
+        // In bottom up mode, our parents are our children since we display an inverted tree.
+        // However, we don't want to show the very top parent since it is redundant.
+        return !!(profileNode.parent && profileNode.parent.parent);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Breakpoint.js b/WebCore/inspector/front-end/Breakpoint.js
index 292975a..5d46cc9 100644
--- a/WebCore/inspector/front-end/Breakpoint.js
+++ b/WebCore/inspector/front-end/Breakpoint.js
@@ -89,7 +89,7 @@ WebInspector.Breakpoint.prototype = {
         this.dispatchEventToListeners("condition-changed");
 
         if (this.enabled)
-            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
+            InspectorBackend.updateBreakpoint(this.sourceID, this.line, c);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index e6edece..9d4fe55 100644
--- a/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -58,21 +58,24 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.listElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+            InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
     {
-        function checkboxClicked()
+        function checkboxClicked(event)
         {
             breakpoint.enabled = !breakpoint.enabled;
+
+            // without this, we'd switch to the source of the clicked breakpoint
+            event.stopPropagation();
         }
 
-        function labelClicked()
+        function breakpointClicked()
         {
             var script = WebInspector.panels.scripts.scriptOrResourceForID(breakpoint.sourceID);
             if (script)
@@ -82,6 +85,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         var breakpointElement = document.createElement("li");
         breakpoint._breakpointListElement = breakpointElement;
         breakpointElement._breakpointObject = breakpoint;
+        breakpointElement.addEventListener("click", breakpointClicked, false);
 
         var checkboxElement = document.createElement("input");
         checkboxElement.className = "checkbox-elem";
@@ -90,9 +94,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         checkboxElement.addEventListener("click", checkboxClicked, false);
         breakpointElement.appendChild(checkboxElement);
 
-        var labelElement = document.createElement("a");
-        labelElement.textContent = breakpoint.label;
-        labelElement.addEventListener("click", labelClicked, false);
+        var labelElement = document.createTextNode(breakpoint.label);
         breakpointElement.appendChild(labelElement);
 
         var sourceTextElement = document.createElement("div");
@@ -133,10 +135,10 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             this.bodyElement.appendChild(this.emptyElement);
         }
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
-        InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+        InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     _breakpointEnableChanged: function(event)
@@ -146,13 +148,13 @@ WebInspector.BreakpointsSidebarPane.prototype = {
         var checkbox = breakpoint._breakpointListElement.firstChild;
         checkbox.checked = breakpoint.enabled;
 
-        if (!InspectorController.debuggerEnabled() || !breakpoint.sourceID)
+        if (!InspectorBackend.debuggerEnabled() || !breakpoint.sourceID)
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+            InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
         else
-            InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     _breakpointTextChanged: function(event)
diff --git a/WebCore/inspector/front-end/Color.js b/WebCore/inspector/front-end/Color.js
index 9d9cd76..11d6bad 100644
--- a/WebCore/inspector/front-end/Color.js
+++ b/WebCore/inspector/front-end/Color.js
@@ -437,7 +437,7 @@ WebInspector.Color.HexTable = {
     "B0C4DE": [[176, 196, 222], [214, 41, 78], "lightSteelBlue"],
     "B0E0E6": [[176, 224, 230], [187, 52, 80], "powderBlue"],
     "B22222": [[178, 34, 34], [0, 68, 42], "fireBrick"],
-    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenRod"],
+    "B8860B": [[184, 134, 11], [43, 89, 38], "darkGoldenrod"],
     "BA55D3": [[186, 85, 211], [288, 59, 58], "mediumOrchid"],
     "BC8F8F": [[188, 143, 143], [0, 25, 65], "rosyBrown"],
     "BDB76B": [[189, 183, 107], [56, 38, 58], "darkKhaki"],
@@ -451,7 +451,7 @@ WebInspector.Color.HexTable = {
     "D87093": [[219, 112, 147], [340, 60, 65], "paleVioletRed"],
     "D8BFD8": [[216, 191, 216], [300, 24, 80], "thistle"],
     "DA70D6": [[218, 112, 214], [302, 59, 65], "orchid"],
-    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenRod"],
+    "DAA520": [[218, 165, 32], [43, 74, 49], "goldenrod"],
     "DC143C": [[237, 164, 61], [35, 83, 58], "crimson"],
     "DCDCDC": [[220, 220, 220], [0, 0, 86], "gainsboro"],
     "DDA0DD": [[221, 160, 221], [300, 47, 75], "plum"],
@@ -460,7 +460,7 @@ WebInspector.Color.HexTable = {
     "E6E6FA": [[230, 230, 250], [240, 67, 94], "lavender"],
     "E9967A": [[233, 150, 122], [15, 72, 70], "darkSalmon"],
     "EE82EE": [[238, 130, 238], [300, 76, 72], "violet"],
-    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenRod"],
+    "EEE8AA": [[238, 232, 170], [55, 67, 80], "paleGoldenrod"],
     "F08080": [[240, 128, 128], [0, 79, 72], "lightCoral"],
     "F0E68C": [[240, 230, 140], [54, 77, 75], "khaki"],
     "F0F8FF": [[240, 248, 255], [208, 100, 97], "aliceBlue"],
@@ -475,7 +475,7 @@ WebInspector.Color.HexTable = {
     "FA8072": [[250, 128, 114], [6, 93, 71], "salmon"],
     "FAEBD7": [[250, 235, 215], [34, 78, 91], "antiqueWhite"],
     "FAF0E6": [[250, 240, 230], [30, 67, 94], "linen"],
-    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenRodYellow"],
+    "FAFAD2": [[250, 250, 210], [60, 80, 90], "lightGoldenrodYellow"],
     "FDF5E6": [[253, 245, 230], [39, 85, 95], "oldLace"],
     "FF0000": [[255, 0, 0], [0, 100, 50], "red"],
     "FF00FF": [[255, 0, 255], [300, 100, 50], "magenta"],
diff --git a/WebCore/inspector/front-end/ConsolePanel.js b/WebCore/inspector/front-end/ConsolePanel.js
new file mode 100644
index 0000000..6dbc558
--- /dev/null
+++ b/WebCore/inspector/front-end/ConsolePanel.js
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ConsolePanel = function()
+{
+    WebInspector.Panel.call(this);
+}
+
+WebInspector.ConsolePanel.prototype = {
+    toolbarItemClass: "console",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Console");
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+
+        this._previousConsoleState = WebInspector.drawer.state;
+        WebInspector.drawer.enterPanelMode();
+        WebInspector.showConsole();
+        
+        // Move the scope bar to the top of the messages, like the resources filter.
+        var scopeBar = document.getElementById("console-filter");
+        var consoleMessages = document.getElementById("console-messages");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("console-view").insertBefore(scopeBar, consoleMessages);
+        
+        // Update styles, and give console-messages a top margin so it doesn't overwrite the scope bar.
+        scopeBar.addStyleClass("console-filter-top");
+        scopeBar.removeStyleClass("status-bar-item");
+
+        consoleMessages.addStyleClass("console-filter-top");
+    },
+
+    hide: function()
+    {
+        WebInspector.Panel.prototype.hide.call(this);
+
+        if (this._previousConsoleState === WebInspector.Drawer.State.Hidden)
+            WebInspector.drawer.immediatelyExitPanelMode();
+        else
+            WebInspector.drawer.exitPanelMode();
+        delete this._previousConsoleState;
+        
+        // Move the scope bar back to the bottom bar, next to Clear Console.
+        var scopeBar = document.getElementById("console-filter");
+
+        scopeBar.parentNode.removeChild(scopeBar);
+        document.getElementById("other-drawer-status-bar-items").appendChild(scopeBar);
+        
+        // Update styles, and remove the top margin on console-messages.
+        scopeBar.removeStyleClass("console-filter-top");
+        scopeBar.addStyleClass("status-bar-item");
+
+        document.getElementById("console-messages").removeStyleClass("console-filter-top");
+    }
+}
+
+WebInspector.ConsolePanel.prototype.__proto__ = WebInspector.Panel.prototype;
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 9317824..9815f4a 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -57,51 +57,60 @@ WebInspector.ConsoleView = function(drawer)
     this.toggleConsoleButton.title = WebInspector.UIString("Show console.");
     this.toggleConsoleButton.addEventListener("click", this._toggleConsoleButtonClicked.bind(this), false);
 
-    var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
-    anchoredStatusBar.appendChild(this.toggleConsoleButton);
-    
     // Will hold the list of filter elements
     this.filterBarElement = document.getElementById("console-filter");
-    
+
     function createDividerElement() {
         var dividerElement = document.createElement("div");
-        
         dividerElement.addStyleClass("divider");
-        
         this.filterBarElement.appendChild(dividerElement);
     }
-    
+
+    var updateFilterHandler = this._updateFilter.bind(this);
     function createFilterElement(category) {
         var categoryElement = document.createElement("li");
         categoryElement.category = category;
-     
-        categoryElement.addStyleClass(categoryElement.category);
-            
+        categoryElement.addStyleClass(categoryElement.category);            
+        categoryElement.addEventListener("click", updateFilterHandler, false);
+
         var label = category.toString();
         categoryElement.appendChild(document.createTextNode(label));
-     
-        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
-     
+
         this.filterBarElement.appendChild(categoryElement);
         return categoryElement;
     }
     
     this.allElement = createFilterElement.call(this, "All");
-    
     createDividerElement.call(this);
-    
     this.errorElement = createFilterElement.call(this, "Errors");
     this.warningElement = createFilterElement.call(this, "Warnings");
     this.logElement = createFilterElement.call(this, "Logs");
 
     this.filter(this.allElement, false);
+
+    this._shortcuts = {};
+
+    var shortcut;
+    var handler = this.clearMessages.bind(this, true);
+
+    shortcut = WebInspector.KeyboardShortcut.makeKey("k", WebInspector.KeyboardShortcut.Modifiers.Meta);
+    this._shortcuts[shortcut] = handler;
+    this._shortcuts[shortcut].isMacOnly = true;
+    shortcut = WebInspector.KeyboardShortcut.makeKey("l", WebInspector.KeyboardShortcut.Modifiers.Ctrl);
+    this._shortcuts[shortcut] = handler;
+
+    this._customFormatters = {
+        "object": this._formatobject,
+        "array":  this._formatarray,
+        "node":   this._formatnode
+    };
 }
 
 WebInspector.ConsoleView.prototype = {
     
     _updateFilter: function(e)
     {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
         var selectMultiple = false;
         if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
@@ -242,7 +251,8 @@ WebInspector.ConsoleView.prototype = {
         this.promptElement.scrollIntoView(false);
     },
 
-    updateMessageRepeatCount: function(count) {
+    updateMessageRepeatCount: function(count)
+    {
         var msg = this.previousMessage;
         var prevRepeatCount = msg.totalRepeatCount;
         
@@ -260,7 +270,8 @@ WebInspector.ConsoleView.prototype = {
         }
     },
 
-    _incrementErrorWarningCount: function(msg) {
+    _incrementErrorWarningCount: function(msg)
+    {
         switch (msg.level) {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 WebInspector.warnings += msg.repeatDelta;
@@ -274,7 +285,7 @@ WebInspector.ConsoleView.prototype = {
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
-            InspectorController.clearMessages(false);
+            InspectorBackend.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -396,6 +407,23 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
+        if (isFnKey(event)) {
+            if (WebInspector.currentPanel && WebInspector.currentPanel.handleKeyEvent) {
+                WebInspector.currentPanel.handleKeyEvent(event);
+                return;
+            }
+        }
+
+        var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
+        var handler = this._shortcuts[shortcut];
+        if (handler) {
+            if (!this._shortcuts[shortcut].isMacOnly || WebInspector.isMac()) {
+                handler();
+                event.preventDefault();
+                return;
+            }
+        }
+
         this.prompt.handleKeyEvent(event);
     },
 
@@ -453,44 +481,18 @@ WebInspector.ConsoleView.prototype = {
     _format: function(output, forceObjectFormat)
     {
         var isProxy = (output != null && typeof output === "object");
+        var type = (forceObjectFormat ? "object" : Object.proxyType(output));
 
-        if (forceObjectFormat)
-            var type = "object";
-        else
-            var type = Object.proxyType(output);
-
-        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
-            // Unwrap primitive value, skip decoration.
-            output = output.description;
-            type = "undecorated"
-        }
-
-        // We don't perform any special formatting on these types, so we just
-        // pass them through the simple _formatvalue function.
-        var undecoratedTypes = {
-            "undefined": 1,
-            "null": 1,
-            "boolean": 1,
-            "number": 1,
-            "undecorated": 1
-        };
-
-        var formatter;
-        if (forceObjectFormat)
-            formatter = "_formatobject";
-        else if (type in undecoratedTypes)
-            formatter = "_formatvalue";
-        else {
-            formatter = "_format" + type;
-            if (!(formatter in this)) {
-                formatter = "_formatobject";
-                type = "object";
-            }
+        var formatter = this._customFormatters[type];
+        if (!formatter || !isProxy) {
+            formatter = this._formatvalue;
+            output = output.description || output;
+            type = "undecorated";
         }
 
         var span = document.createElement("span");
         span.addStyleClass("console-formatted-" + type);
-        this[formatter](output, span);
+        formatter.call(this, output, span);
         return span;
     },
 
@@ -499,25 +501,27 @@ WebInspector.ConsoleView.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatfunction: function(func, elem)
-    {
-        elem.appendChild(document.createTextNode(func.description));
-    },
-
-    _formatdate: function(date, elem)
+    _formatobject: function(obj, elem)
     {
-        elem.appendChild(document.createTextNode(date));
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
-    _formatstring: function(str, elem)
+    _formatnode: function(object, elem)
     {
-        elem.appendChild(document.createTextNode("\"" + str + "\""));
-    },
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.showInElementsPanelEnabled = true;
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
 
-    _formatregexp: function(re, elem)
-    {
-        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-        elem.appendChild(document.createTextNode(formatted));
+        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
     },
 
     _formatarray: function(arr, elem)
@@ -529,6 +533,7 @@ WebInspector.ConsoleView.prototype = {
     {
         if (!properties)
             return;
+
         var elements = [];
         for (var i = 0; i < properties.length; ++i) {
             var name = properties[i].name;
@@ -547,53 +552,6 @@ WebInspector.ConsoleView.prototype = {
                 elem.appendChild(document.createTextNode(", "));
         }
         elem.appendChild(document.createTextNode("]"));
-    },
-
-    _formatnode: function(object, elem)
-    {
-        function printNode(nodeId)
-        {
-            if (!nodeId)
-                return;
-            var treeOutline = new WebInspector.ElementsTreeOutline();
-            treeOutline.showInElementsPanelEnabled = true;
-            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
-            treeOutline.element.addStyleClass("outline-disclosure");
-            if (!treeOutline.children[0].hasChildren)
-                treeOutline.element.addStyleClass("single-node");
-            elem.appendChild(treeOutline.element);
-        }
-        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
-    },
-
-    _formatobject: function(obj, elem)
-    {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
-    },
-
-    _formaterror: function(obj, elem)
-    {
-        var messageElement = document.createElement("span");
-        messageElement.className = "error-message";
-        messageElement.textContent = obj.name + ": " + obj.message;
-        elem.appendChild(messageElement);
-
-        if (obj.sourceURL) {
-            var urlElement = document.createElement("a");
-            urlElement.className = "webkit-html-resource-link";
-            urlElement.href = obj.sourceURL;
-            urlElement.lineNumber = obj.line;
-            urlElement.preferredPanel = "scripts";
-
-            if (obj.line > 0)
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL) + ":" + obj.line;
-            else
-                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL);
-
-            elem.appendChild(document.createTextNode(" ("));
-            elem.appendChild(urlElement);
-            elem.appendChild(document.createTextNode(")"));
-        }
     }
 }
 
@@ -648,62 +606,28 @@ WebInspector.ConsoleMessage.prototype = {
 
     _format: function(parameters)
     {
+        // This node is used like a Builder. Values are contintually appended onto it.
         var formattedResult = document.createElement("span");
-
         if (!parameters.length)
             return formattedResult;
 
         // Formatting code below assumes that parameters are all wrappers whereas frontend console
-        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
-        for (var i = 0; i < parameters.length; ++i) {
+        // API allows passing arbitrary values as messages (strings, numbers, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i)
             if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
                 parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
-        }
 
-        function formatForConsole(obj)
-        {
-            return WebInspector.console._format(obj);
-        }
-
-        function formatAsObjectForConsole(obj)
-        {
-            return WebInspector.console._format(obj, true);
-        }
-
-        if (Object.proxyType(parameters[0]) === "string") {
-            var formatters = {}
-            for (var i in String.standardFormatters)
-                formatters[i] = String.standardFormatters[i];
-
-            // Firebug uses %o for formatting objects.
-            formatters.o = formatForConsole;
-            // Firebug allows both %i and %d for formatting integers.
-            formatters.i = formatters.d;
-            // Support %O to force object formating, instead of the type-based %o formatting.
-            formatters.O = formatAsObjectForConsole;
-
-            function append(a, b)
-            {
-                if (!(b instanceof Node))
-                    a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
-                else
-                    a.appendChild(b);
-                return a;
-            }
-
-            var result = String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
-            formattedResult = result.formattedResult;
+        // Multiple parameters with the first being a format string. Save unused substitutions.
+        if (parameters.length > 1 && Object.proxyType(parameters[0]) === "string") {
+            var result = this._formatWithSubstitutionString(parameters, formattedResult)
             parameters = result.unusedSubstitutions;
             if (parameters.length)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
 
+        // Single parameter, or unused substitutions from above.
         for (var i = 0; i < parameters.length; ++i) {
-            if (Object.proxyType(parameters[i]) === "string")
-                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i].description));
-            else
-                formattedResult.appendChild(formatForConsole(parameters[i]));
-
+            this._formatIndividualValue(parameters[i], formattedResult);
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
@@ -711,6 +635,51 @@ WebInspector.ConsoleMessage.prototype = {
         return formattedResult;
     },
 
+    _formatWithSubstitutionString: function(parameters, formattedResult)
+    {
+        var formatters = {}
+        for (var i in String.standardFormatters)
+            formatters[i] = String.standardFormatters[i];
+
+        function consoleFormatWrapper(force)
+        {
+            return function(obj) {
+                return WebInspector.console._format(obj, force);
+            };
+        }
+
+        // Firebug uses %o for formatting objects.
+        formatters.o = consoleFormatWrapper();
+        // Firebug allows both %i and %d for formatting integers.
+        formatters.i = formatters.d;
+        // Support %O to force object formating, instead of the type-based %o formatting.
+        formatters.O = consoleFormatWrapper(true);
+
+        function append(a, b)
+        {
+            if (!(b instanceof Node))
+                a.appendChild(WebInspector.linkifyStringAsFragment(b.toString()));
+            else
+                a.appendChild(b);
+            return a;
+        }
+
+        // String.format does treat formattedResult like a Builder, result is an object.
+        return String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
+    },
+
+    _formatIndividualValue: function(param, formattedResult)
+    {
+        if (Object.proxyType(param) === "string") {
+            if (this.originatingCommand && this.level === WebInspector.ConsoleMessage.MessageLevel.Log) {
+                var quotedString = "\"" + param.description.replace(/"/g, "\\\"") + "\"";
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(quotedString));
+            } else
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(param.description));
+        } else
+            formattedResult.appendChild(WebInspector.console._format(param));
+    },
+
     toMessageElement: function()
     {
         if (this._element)
@@ -958,9 +927,9 @@ WebInspector.ConsoleCommandResult = function(result, exception, originatingComma
     var line = (exception ? result.line : -1);
     var url = (exception ? result.sourceURL : null);
 
-    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, line, url, null, 1, message);
-
     this.originatingCommand = originatingCommand;
+
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, line, url, null, 1, message);
 }
 
 WebInspector.ConsoleCommandResult.prototype = {
diff --git a/WebCore/inspector/front-end/ContextMenu.js b/WebCore/inspector/front-end/ContextMenu.js
new file mode 100644
index 0000000..3cdb152
--- /dev/null
+++ b/WebCore/inspector/front-end/ContextMenu.js
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ContextMenu = function() {
+    this._items = [];
+    this._handlers = {};
+}
+
+WebInspector.ContextMenu.prototype = {
+    show: function(event)
+    {
+        // Remove trailing separator.
+        while (this._items.length > 0 && !("id" in this._items[this._items.length - 1]))
+            this._items.splice(this._items.length - 1, 1);
+
+        if (this._items.length) {
+            WebInspector._contextMenu = this;
+            InspectorFrontendHost.showContextMenu(event, this._items);
+        }
+    },
+
+    appendItem: function(label, handler)
+    {
+        var id = this._items.length;
+        this._items.push({id: id, label: label});
+        this._handlers[id] = handler;
+    },
+
+    appendSeparator: function()
+    {
+        // No separator dupes allowed.
+        if (this._items.length === 0)
+            return;
+        if (!("id" in this._items[this._items.length - 1]))
+            return;
+        this._items.push({});
+    },
+
+    _itemSelected: function(id)
+    {
+        if (this._handlers[id])
+            this._handlers[id].call(this);
+    }
+}
+
+WebInspector.contextMenuItemSelected = function(id)
+{
+    if (WebInspector._contextMenu)
+        WebInspector._contextMenu._itemSelected(id);
+}
+
+WebInspector.contextMenuCleared = function()
+{
+    // FIXME: Unfortunately, contextMenuCleared is invoked between show and item selected
+    // so we can't delete last menu object from WebInspector. Fix the contract.
+}
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
index 9f9845c..b31b7ea 100644
--- a/WebCore/inspector/front-end/CookieItemsView.js
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -67,7 +67,8 @@ WebInspector.CookieItemsView.prototype = {
         this.element.removeChildren();
 
         var self = this;
-        function callback(cookies, isAdvanced) {
+        function callback(allCookies, isAdvanced) {
+            var cookies = self._cookiesForDomain(allCookies);
             var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
             if (dataGrid) {
                 self._dataGrid = dataGrid;
@@ -85,7 +86,31 @@ WebInspector.CookieItemsView.prototype = {
             }
         }
 
-        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
+        WebInspector.Cookies.getCookiesAsync(callback);
+    },
+
+    _cookiesForDomain: function(allCookies)
+    {
+        var cookiesForDomain = [];
+        var resourceURLsForDocumentURL = [];
+
+        for (var id in WebInspector.resources) {
+            var resource = WebInspector.resources[id];
+            var match = resource.documentURL.match(WebInspector.URLRegExp);
+            if (match && match[2] === this._cookieDomain)
+                resourceURLsForDocumentURL.push(resource.url);
+        }
+
+        for (var i = 0; i < allCookies.length; ++i) {
+            for (var j = 0; j < resourceURLsForDocumentURL.length; ++j) {
+                var resourceURL = resourceURLsForDocumentURL[j];
+                if (WebInspector.Cookies.cookieMatchesResourceURL(allCookies[i], resourceURL)) {
+                    cookiesForDomain.push(allCookies[i]);
+                    break;
+                }
+            }
+        }
+        return cookiesForDomain;
     },
 
     dataGridForCookies: function(cookies)
@@ -185,7 +210,7 @@ WebInspector.CookieItemsView.prototype = {
         for (var columnIdentifier in columns)
             columns[columnIdentifier].width += "%";
 
-        var dataGrid = new WebInspector.DataGrid(columns);
+        var dataGrid = new WebInspector.DataGrid(columns, null, this._deleteCookieCallback.bind(this));
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
@@ -258,11 +283,16 @@ WebInspector.CookieItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (!this._dataGrid)
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
             return;
 
-        var cookie = this._dataGrid.selectedNode.cookie;
-        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
+        this._deleteCookieCallback(this._dataGrid.selectedNode);
+    },
+    
+    _deleteCookieCallback: function(node)
+    {
+        var cookie = node.cookie;
+        InspectorBackend.deleteCookie(cookie.name, this._cookieDomain);
         this.update();
     },
 
diff --git a/WebCore/inspector/front-end/DOMAgent.js b/WebCore/inspector/front-end/DOMAgent.js
index 25ffafa..4ccf843 100644
--- a/WebCore/inspector/front-end/DOMAgent.js
+++ b/WebCore/inspector/front-end/DOMAgent.js
@@ -61,9 +61,10 @@ WebInspector.DOMNode = function(doc, payload) {
     this._matchedCSSRules = [];
 
     if (this.nodeType == Node.ELEMENT_NODE) {
-        if (this.nodeName == "HTML")
+        // HTML and BODY from internal iframes should not overwrite top-level ones.
+        if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
             this.ownerDocument.documentElement = this;
-        if (this.nodeName == "BODY")
+        if (!this.ownerDocument.body && this.nodeName === "BODY")
             this.ownerDocument.body = this;
     }
 }
@@ -178,6 +179,7 @@ WebInspector.DOMNode.prototype = {
         this.lastChild = this.children[this._childNodeCount - 1];
         for (var i = 0; i < this._childNodeCount; ++i) {
             var child = this.children[i];
+            child.index = i;
             child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
             child.prevSibling = i - 1 >= 0 ? this.children[i - 1] : null;
             child.parentNode = this;
@@ -326,25 +328,25 @@ WebInspector.DOMAgent.prototype = {
             callback(parent.children);
         }
         var callId = WebInspector.Callback.wrap(mycallback);
-        InspectorController.getChildNodes(callId, parent.id);
+        InspectorBackend.getChildNodes(callId, parent.id);
     },
 
     setAttributeAsync: function(node, name, value, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
+        InspectorBackend.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
     },
 
     removeAttributeAsync: function(node, name, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
+        InspectorBackend.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
     },
 
     setTextNodeValueAsync: function(node, text, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
+        InspectorBackend.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
     },
 
     _didApplyDomChange: function(node, callback, success)
@@ -372,13 +374,13 @@ WebInspector.DOMAgent.prototype = {
     _setDocument: function(payload)
     {
         this._idToDOMNode = {};
-        if (payload) {
+        if (payload && "id" in payload) {
             this.document = new WebInspector.DOMDocument(this, this._window, payload);
             this._idToDOMNode[payload.id] = this.document;
             this._bindNodes(this.document.children);
         } else
             this.document = null;
-        WebInspector.panels.elements.reset();
+        WebInspector.panels.elements.setDocument(this.document);
     },
 
     _setDetachedRoot: function(payload)
@@ -437,7 +439,7 @@ WebInspector.DOMAgent.prototype = {
 
 WebInspector.Cookies = {}
 
-WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
+WebInspector.Cookies.getCookiesAsync = function(callback)
 {
     function mycallback(cookies, cookiesString) {
         if (cookiesString)
@@ -446,7 +448,7 @@ WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
             callback(cookies, true);
     }
     var callId = WebInspector.Callback.wrap(mycallback);
-    InspectorController.getCookies(callId, cookieDomain);
+    InspectorBackend.getCookies(callId);
 }
 
 WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
@@ -468,6 +470,28 @@ WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
     return cookies;
 }
 
+WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
+{
+    var match = resourceURL.match(WebInspector.URLRegExp);
+    if (!match)
+        return false;
+    // See WebInspector.URLRegExp for definitions of the group index constants.
+    if (!this.cookieDomainMatchesResourceDomain(cookie.domain, match[2]))
+        return false;
+    var resourcePort = match[3] ? match[3] : undefined;
+    var resourcePath = match[4] ? match[4] : '/';
+    return (resourcePath.indexOf(cookie.path) === 0
+        && (!cookie.port || resourcePort == cookie.port)
+        && (!cookie.secure || match[1].toLowerCase() === 'https'));
+}
+
+WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
+{
+    if (cookieDomain.charAt(0) !== '.')
+        return resourceDomain === cookieDomain;
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+}
+
 WebInspector.EventListeners = {}
 
 WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
@@ -476,7 +500,7 @@ WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callb
         return;
 
     var callId = WebInspector.Callback.wrap(callback);
-    InspectorController.getEventListenersForNode(callId, node.id);
+    InspectorBackend.getEventListenersForNode(callId, node.id);
 }
 
 WebInspector.CSSStyleDeclaration = function(payload)
diff --git a/WebCore/inspector/front-end/DOMStorage.js b/WebCore/inspector/front-end/DOMStorage.js
index 03a10bf..c5f658d 100644
--- a/WebCore/inspector/front-end/DOMStorage.js
+++ b/WebCore/inspector/front-end/DOMStorage.js
@@ -57,19 +57,19 @@ WebInspector.DOMStorage.prototype = {
     getEntries: function(callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.getDOMStorageEntries(callId, this._id);
+        InspectorBackend.getDOMStorageEntries(callId, this._id);
     },
     
     setItem: function(key, value, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.setDOMStorageItem(callId, this._id, key, value);
+        InspectorBackend.setDOMStorageItem(callId, this._id, key, value);
     },
     
     removeItem: function(key, callback)
     {
         var callId = WebInspector.Callback.wrap(callback);
-        InspectorController.removeDOMStorageItem(callId, this._id, key);
+        InspectorBackend.removeDOMStorageItem(callId, this._id, key);
     }
 }
 
diff --git a/WebCore/inspector/front-end/DOMStorageDataGrid.js b/WebCore/inspector/front-end/DOMStorageDataGrid.js
deleted file mode 100644
index 45a9ba1..0000000
--- a/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Copyright (C) 2009 Nokia Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *        notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *        notice, this list of conditions and the following disclaimer in the
- *        documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.         IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-WebInspector.DOMStorageDataGrid = function(columns, domStorage, keys)
-{
-    WebInspector.DataGrid.call(this, columns);
-    this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
-    this._domStorage = domStorage;
-    this._keys = keys;
-}
-
-WebInspector.DOMStorageDataGrid.prototype = {
-    _ondblclick: function(event)
-    {
-        if (this._editing)
-            return;
-        if (this._editingNode)
-            return;
-        this._startEditing(event);
-    },
-
-    _startEditingColumnOfDataGridNode: function(node, column)
-    {
-        this._editing = true;
-        this._editingNode = node;
-        this._editingNode.select();
-
-        var element = this._editingNode._element.children[column];
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _startEditing: function(event)
-    {
-        var element = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!element)
-            return;
-
-        this._editingNode = this.dataGridNodeFromEvent(event);
-        if (!this._editingNode) {
-            if (!this.creationNode)
-                return;
-            this._editingNode = this.creationNode;
-        }
-
-        // Force editing the "Key" column when editing the creation node
-        if (this._editingNode.isCreationNode)
-            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
-
-        this._editing = true;
-        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    _editingCommitted: function(element, newText, oldText, context, moveDirection)
-    {
-        var columnIdentifier = (element.hasStyleClass("0-column") ? 0 : 1);
-        var textBeforeEditing = this._editingNode.data[columnIdentifier];
-        var currentEditingNode = this._editingNode;
-
-        function moveToNextIfNeeded(wasChange) {
-            if (!moveDirection)
-                return;
-
-            if (moveDirection === "forward") {
-                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
-                    return;
-
-                if (columnIdentifier === 0)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
-
-                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
-                if (currentEditingNode.isCreationNode && wasChange) {
-                    addCreationNode(false);
-                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
-                }
-                return;
-            }
-
-            if (moveDirection === "backward") {
-                if (columnIdentifier === 1)
-                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
-                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
-
-                if (nextDataGridNode)
-                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
-                return;
-            }
-        }
-
-        if (textBeforeEditing == newText) {
-            this._editingCancelled(element);
-            moveToNextIfNeeded.call(this, false);
-            return;
-        }
-
-        var domStorage = this._domStorage;
-        if (columnIdentifier === 0) {
-            if (this._keys.indexOf(newText) !== -1) {
-                element.textContent = this._editingNode.data[0];
-                this._editingCancelled(element);
-                moveToNextIfNeeded.call(this, false);
-                return;
-            }
-            domStorage.removeItem(this._editingNode.data[0]);
-            domStorage.setItem(newText, this._editingNode.data[1]);
-            this._editingNode.data[0] = newText;
-        } else {
-            domStorage.setItem(this._editingNode.data[0], newText);
-            this._editingNode.data[1] = newText;
-        }
-
-        if (this._editingNode.isCreationNode)
-            this.addCreationNode(false);
-
-        this._editingCancelled(element);
-        moveToNextIfNeeded.call(this, true);
-    },
-
-    _editingCancelled: function(element, context)
-    {
-        delete this._editing;
-        this._editingNode = null;
-    },
-
-    deleteSelectedRow: function()
-    {
-        var node = this.selectedNode;
-        if (!node || node.isCreationNode)
-            return;
-
-        if (this._domStorage)
-            this._domStorage.removeItem(node.data[0]);
-    }
-}
-
-WebInspector.DOMStorageDataGrid.prototype.__proto__ = WebInspector.DataGrid.prototype;
diff --git a/WebCore/inspector/front-end/DOMStorageItemsView.js b/WebCore/inspector/front-end/DOMStorageItemsView.js
index a7da370..7441f2e 100644
--- a/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -65,22 +65,12 @@ WebInspector.DOMStorageItemsView.prototype = {
         this.domStorage.getEntries(callback);
     },
 
-    _showDOMStorageEntries: function(entries) 
+    _showDOMStorageEntries: function(entries)
     {
-        if (entries.length > 0) {
-            this._dataGrid = this._dataGridForDOMStorageEntries(entries);
-            this.element.appendChild(this._dataGrid.element);
-            this._dataGrid.updateWidths();
-            this.deleteButton.visible = true;
-        } else {
-            var emptyMsgElement = document.createElement("div");
-            emptyMsgElement.className = "storage-table-empty";
-            if (this.domStorage)
-                emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
-            this.element.appendChild(emptyMsgElement);
-            this._dataGrid = null;
-            this.deleteButton.visible = false;
-        }
+        this._dataGrid = this._dataGridForDOMStorageEntries(entries);
+        this.element.appendChild(this._dataGrid.element);
+        this._dataGrid.updateWidths();
+        this.deleteButton.visible = true;
     },
 
     resize: function()
@@ -133,7 +123,7 @@ WebInspector.DOMStorageItemsView.prototype = {
         columns[0].width += "%";
         columns[1].width += "%";
 
-        var dataGrid = new WebInspector.DOMStorageDataGrid(columns, this.domStorage, keys);
+        var dataGrid = new WebInspector.DataGrid(columns, this._editingCallback.bind(this), this._deleteCallback.bind(this));
         var length = nodes.length;
         for (var i = 0; i < length; ++i)
             dataGrid.appendChild(nodes[i]);
@@ -145,16 +135,41 @@ WebInspector.DOMStorageItemsView.prototype = {
 
     _deleteButtonClicked: function(event)
     {
-        if (this._dataGrid) {
-            this._dataGrid.deleteSelectedRow();
-            
-            this.show();
-        }
+        if (!this._dataGrid || !this._dataGrid.selectedNode)
+            return;
+
+        this._deleteCallback(this._dataGrid.selectedNode);
     },
 
     _refreshButtonClicked: function(event)
     {
         this.update();
+    },
+    
+    _editingCallback: function(editingNode, columnIdentifier, oldText, newText)
+    {
+        var domStorage = this.domStorage;
+        if (columnIdentifier === 0) {
+            if (oldText)
+                domStorage.removeItem(oldText);
+
+            domStorage.setItem(newText, editingNode.data[1]);
+        } else {
+            domStorage.setItem(editingNode.data[0], newText);
+        }
+        
+        this.update();
+    },
+    
+    _deleteCallback: function(node)
+    {
+        if (!node || node.isCreationNode)
+            return;
+
+        if (this.domStorage)
+            this.domStorage.removeItem(node.data[0]);
+            
+        this.update();
     }
 }
 
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index ce61548..7b58c8e 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DataGrid = function(columns)
+WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
 {
     this.element = document.createElement("div");
     this.element.className = "data-grid";
@@ -38,7 +38,16 @@ WebInspector.DataGrid = function(columns)
 
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
-
+    
+    // FIXME: Add a createCallback which is different from editCallback and has different
+    // behavior when creating a new node.
+    if (editCallback) {
+        this._dataTable.addEventListener("dblclick", this._ondblclick.bind(this), false);
+        this._editCallback = editCallback;
+    }
+    if (deleteCallback)
+        this._deleteCallback = deleteCallback;
+    
     this.aligned = {};
 
     var scrollContainer = document.createElement("div");
@@ -128,6 +137,116 @@ WebInspector.DataGrid = function(columns)
 }
 
 WebInspector.DataGrid.prototype = {
+    _ondblclick: function(event)
+    {
+        if (this._editing || this._editingNode)
+            return;
+
+        this._startEditing(event.target);
+    },
+
+    _startEditingColumnOfDataGridNode: function(node, column)
+    {
+        this._editing = true;
+        this._editingNode = node;
+        this._editingNode.select();
+
+        var element = this._editingNode._element.children[column];
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _startEditing: function(target)
+    {
+        var element = target.enclosingNodeOrSelfWithNodeName("td");
+        if (!element)
+            return;
+
+        this._editingNode = this.dataGridNodeFromNode(target);
+        if (!this._editingNode) {
+            if (!this.creationNode)
+                return;
+            this._editingNode = this.creationNode;
+        }
+
+        // Force editing the 1st column when editing the creation node
+        if (this._editingNode.isCreationNode)
+            return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
+
+        this._editing = true;
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+
+    _editingCommitted: function(element, newText, oldText, context, moveDirection)
+    {
+        // FIXME: We need more column identifiers here throughout this function.
+        // Not needed yet since only editable DataGrid is DOM Storage, which is Key - Value.
+        
+        // FIXME: Better way to do this than regular expressions?
+        var columnIdentifier = parseInt(element.className.match(/\b(\d+)-column\b/)[1]);
+
+        var textBeforeEditing = this._editingNode.data[columnIdentifier];
+        var currentEditingNode = this._editingNode;
+
+        function moveToNextIfNeeded(wasChange) {
+            if (!moveDirection)
+                return;
+
+            if (moveDirection === "forward") {
+                if (currentEditingNode.isCreationNode && columnIdentifier === 0 && !wasChange)
+                    return;
+
+                if (columnIdentifier === 0)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 1);
+
+                var nextDataGridNode = currentEditingNode.traverseNextNode(true, null, true);
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 0);
+                if (currentEditingNode.isCreationNode && wasChange) {
+                    addCreationNode(false);
+                    return this._startEditingColumnOfDataGridNode(this.creationNode, 0);
+                }
+                return;
+            }
+
+            if (moveDirection === "backward") {
+                if (columnIdentifier === 1)
+                    return this._startEditingColumnOfDataGridNode(currentEditingNode, 0);
+                    var nextDataGridNode = currentEditingNode.traversePreviousNode(true, null, true);
+
+                if (nextDataGridNode)
+                    return this._startEditingColumnOfDataGridNode(nextDataGridNode, 1);
+                return;
+            }
+        }
+
+        if (textBeforeEditing == newText) {
+            this._editingCancelled(element);
+            moveToNextIfNeeded.call(this, false);
+            return;
+        }
+
+        // Update the text in the datagrid that we typed
+        this._editingNode.data[columnIdentifier] = newText;
+        
+        // Make the callback - expects an editing node (table row), the column number that is being edited,
+        // the text that used to be there, and the new text.
+        this._editCallback(this._editingNode, columnIdentifier, textBeforeEditing, newText);
+
+        if (this._editingNode.isCreationNode)
+            this.addCreationNode(false);
+
+        this._editingCancelled(element);
+        moveToNextIfNeeded.call(this, true);
+    },
+
+    _editingCancelled: function(element, context)
+    {
+        delete this._editing;
+        this._editingNode = null;
+    },
+    
     get sortColumnIdentifier()
     {
         if (!this._sortColumnCell)
@@ -266,6 +385,7 @@ WebInspector.DataGrid.prototype = {
         delete child._depth;
         delete child._revealed;
         delete child._attached;
+        child._shouldRefreshChildren = true;
 
         var current = child.children[0];
         while (current) {
@@ -273,6 +393,7 @@ WebInspector.DataGrid.prototype = {
             delete current._depth;
             delete current._revealed;
             delete current._attached;
+            current._shouldRefreshChildren = true;
             current = current.traverseNextNode(false, child, true);
         }
 
@@ -350,7 +471,7 @@ WebInspector.DataGrid.prototype = {
 
     handleKeyEvent: function(event)
     {
-        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey)
+        if (!this.selectedNode || event.shiftKey || event.metaKey || event.ctrlKey || this._editing)
             return false;
 
         var handled = false;
@@ -396,6 +517,18 @@ WebInspector.DataGrid.prototype = {
                         this.selectedNode.expand();
                 }
             }
+        } else if (event.keyCode === 8 || event.keyCode === 46) {
+            if (this._deleteCallback) {
+                handled = true;
+                this._deleteCallback(this.selectedNode);
+            }
+        } else if (isEnterKey(event)) {
+            if (this._editCallback) {
+                handled = true;
+                // The first child of the selected element is the <td class="0-column">,
+                // and that's what we want to edit.
+                this._startEditing(this.selectedNode._element.children[0]);
+            }
         }
 
         if (nextSelectedNode) {
@@ -426,9 +559,9 @@ WebInspector.DataGrid.prototype = {
         // This is the root, do nothing.
     },
 
-    dataGridNodeFromEvent: function(event)
+    dataGridNodeFromNode: function(target)
     {
-        var rowElement = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        var rowElement = target.enclosingNodeOrSelfWithNodeName("tr");
         return rowElement._dataGridNode;
     },
 
@@ -473,7 +606,7 @@ WebInspector.DataGrid.prototype = {
 
     _mouseDownInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.selectable)
             return;
 
@@ -491,7 +624,7 @@ WebInspector.DataGrid.prototype = {
 
     _clickInDataTable: function(event)
     {
-        var gridNode = this.dataGridNodeFromEvent(event);
+        var gridNode = this.dataGridNodeFromNode(event.target);
         if (!gridNode || !gridNode.hasChildren)
             return;
 
@@ -1019,6 +1152,30 @@ WebInspector.DataGridNode.prototype = {
 
         for (var i = 0; i < this.children.length; ++i)
             this.children[i]._detach();
+    },
+
+    savePosition: function()
+    {
+        if (this._savedPosition)
+            return;
+
+        if (!this.parent)
+            throw("savePosition: Node must have a parent.");
+        this._savedPosition = {
+            parent: this.parent,
+            index: this.parent.children.indexOf(this)
+        };
+    },
+
+    restorePosition: function()
+    {
+        if (!this._savedPosition)
+            return;
+
+        if (this.parent !== this._savedPosition.parent)
+            this._savedPosition.parent.insertChild(this, this._savedPosition.index);
+
+        delete this._savedPosition;
     }
 }
 
diff --git a/WebCore/inspector/front-end/Database.js b/WebCore/inspector/front-end/Database.js
index 1a348fc..5edefb1 100644
--- a/WebCore/inspector/front-end/Database.js
+++ b/WebCore/inspector/front-end/Database.js
@@ -82,7 +82,7 @@ WebInspector.Database.prototype = {
             callback(names.sort());
         }
         var callId = WebInspector.Callback.wrap(sortingCallback);
-        InspectorController.getDatabaseTableNames(callId, this._id);
+        InspectorBackend.getDatabaseTableNames(callId, this._id);
     },
     
     executeSql: function(query, onSuccess, onError)
diff --git a/WebCore/inspector/front-end/Drawer.js b/WebCore/inspector/front-end/Drawer.js
index 1b50f91..0426a39 100644
--- a/WebCore/inspector/front-end/Drawer.js
+++ b/WebCore/inspector/front-end/Drawer.js
@@ -7,13 +7,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -31,6 +31,12 @@ WebInspector.Drawer = function()
 {
     WebInspector.View.call(this, document.getElementById("drawer"));
 
+    this._savedHeight = 200; // Default.
+    this.state = WebInspector.Drawer.State.Hidden;
+    this.fullPanel = false;
+
+    this.mainElement = document.getElementById("main");
+    this.toolbarElement = document.getElementById("toolbar");
     this.mainStatusBar = document.getElementById("main-status-bar");
     this.mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
     this.viewStatusBar = document.getElementById("other-drawer-status-bar-items");
@@ -45,6 +51,8 @@ WebInspector.Drawer.prototype = {
     set visibleView(x)
     {
         if (this._visibleView === x) {
+            if (this.visible && this.fullPanel)
+                return;
             this.visible = !this.visible;
             return;
         }
@@ -64,6 +72,12 @@ WebInspector.Drawer.prototype = {
         }
     },
 
+    get savedHeight()
+    {
+        var height = this._savedHeight || this.element.offsetHeight;
+        return Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - this.mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+    },
+
     showView: function(view)
     {
         if (!this.visible || this.visibleView !== view)
@@ -85,15 +99,16 @@ WebInspector.Drawer.prototype = {
         document.body.addStyleClass("drawer-visible");
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
-
+        var height = (this.fullPanel ? window.innerHeight - this.toolbarElement.offsetHeight : this.savedHeight);
         var animations = [
-            {element: document.getElementById("main"), end: {bottom: this.element.offsetHeight}},
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}},
             {element: document.getElementById("main-status-bar"), start: {"padding-left": anchoredItems.offsetWidth - 1}, end: {"padding-left": 0}},
             {element: document.getElementById("other-drawer-status-bar-items"), start: {opacity: 0}, end: {opacity: 1}}
         ];
 
-        var consoleStatusBar = document.getElementById("drawer-status-bar");
-        consoleStatusBar.insertBefore(anchoredItems, consoleStatusBar.firstChild);
+        var drawerStatusBar = document.getElementById("drawer-status-bar");
+        drawerStatusBar.insertBefore(anchoredItems, drawerStatusBar.firstChild);
 
         function animationFinished()
         {
@@ -102,9 +117,11 @@ WebInspector.Drawer.prototype = {
             if (this.visibleView.afterShow)
                 this.visibleView.afterShow();
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = (this.fullPanel ? WebInspector.Drawer.State.Full : WebInspector.Drawer.State.Variable);
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
     },
 
     hide: function()
@@ -113,20 +130,23 @@ WebInspector.Drawer.prototype = {
             return;
 
         WebInspector.View.prototype.hide.call(this);
-        
+
         if (this.visibleView)
             this.visibleView.hide();
 
         this._animating = true;
 
+        if (!this.fullPanel)
+            this._savedHeight = this.element.offsetHeight;
+
         if (this.element === WebInspector.currentFocusElement || this.element.isAncestor(WebInspector.currentFocusElement))
             WebInspector.currentFocusElement = WebInspector.previousFocusElement;
 
         var anchoredItems = document.getElementById("anchored-status-bar-items");
 
-        // Temporally set properties and classes to mimic the post-animation values so panels
+        // Temporarily set properties and classes to mimic the post-animation values so panels
         // like Elements in their updateStatusBarItems call will size things to fit the final location.
-        document.getElementById("main-status-bar").style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
+        this.mainStatusBar.style.setProperty("padding-left", (anchoredItems.offsetWidth - 1) + "px");
         document.body.removeStyleClass("drawer-visible");
         if ("updateStatusBarItems" in WebInspector.currentPanel)
             WebInspector.currentPanel.updateStatusBarItems();
@@ -145,9 +165,96 @@ WebInspector.Drawer.prototype = {
             mainStatusBar.style.removeProperty("padding-left");
             document.body.removeStyleClass("drawer-visible");
             delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = WebInspector.Drawer.State.Hidden;
+        }
+
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    resize: function()
+    {
+        if (this.state === WebInspector.Drawer.State.Hidden)
+            return;
+
+        var height;
+        var mainElement = document.getElementById("main");
+        if (this.state === WebInspector.Drawer.State.Variable) {
+            height = parseInt(this.element.style.height);
+            height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
+        } else
+            height = window.innerHeight - this.toolbarElement.offsetHeight;
+
+        mainElement.style.bottom = height + "px";
+        this.element.style.height = height + "px";
+    },
+
+    enterPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = true;
+        
+        if (this.visible) {
+            this._savedHeight = this.element.offsetHeight;
+            var height = window.innerHeight - this.toolbarElement.offsetHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Full);
+        }
+    },
+
+    exitPanelMode: function()
+    {
+        this._cancelAnimationIfNeeded();
+        this.fullPanel = false;
+
+        if (this.visible) {
+            // If this animation gets cancelled, we want the state of the drawer to be Variable,
+            // so that the new animation can't do an immediate transition between Hidden/Full states.
+            this.state = WebInspector.Drawer.State.Variable;
+            var height = this.savedHeight;
+            this._animateDrawerHeight(height, WebInspector.Drawer.State.Variable);
+        }
+    },
+
+    immediatelyExitPanelMode: function()
+    {
+        this.visible = false;
+        this.fullPanel = false;
+    },
+
+    _cancelAnimationIfNeeded: function()
+    {
+        if (this._animating) {
+            clearInterval(this._currentAnimationInterval);
+            delete this._animating;
+            delete this._currentAnimationInterval;
+        }
+    },
+
+    _animateDrawerHeight: function(height, finalState)
+    {
+        this._animating = true;
+        var animations = [
+            {element: this.element, end: {height: height}},
+            {element: document.getElementById("main"), end: {bottom: height}}
+        ];
+
+        function animationFinished()
+        {
+            delete this._animating;
+            delete this._currentAnimationInterval;
+            this.state = finalState;
         }
 
-        WebInspector.animateStyle(animations, window.event && window.event.shiftKey ? 2000 : 250, animationFinished.bind(this));
+        this._currentAnimationInterval = WebInspector.animateStyle(animations, this._animationDuration(), animationFinished.bind(this));
+    },
+
+    _animationDuration: function()
+    {
+        // Immediate if going between Hidden and Full in full panel mode
+        if (this.fullPanel && (this.state === WebInspector.Drawer.State.Hidden || this.state === WebInspector.Drawer.State.Full))
+            return 0;
+
+        return (window.event && window.event.shiftKey ? 2000 : 250);
     },
 
     _safelyRemoveChildren: function()
@@ -165,10 +272,10 @@ WebInspector.Drawer.prototype = {
 
     _startStatusBarDragging: function(event)
     {
-        if (!this.visible || event.target !== document.getElementById("main-status-bar"))
+        if (!this.visible || event.target !== this.mainStatusBar)
             return;
 
-        WebInspector.elementDragStart(document.getElementById("main-status-bar"), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
+        WebInspector.elementDragStart(this.mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
 
         this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop;
 
@@ -178,7 +285,6 @@ WebInspector.Drawer.prototype = {
     _statusBarDragging: function(event)
     {
         var mainElement = document.getElementById("main");
-
         var height = window.innerHeight - event.pageY + this._statusBarDragOffset;
         height = Number.constrain(height, Preferences.minConsoleHeight, window.innerHeight - mainElement.totalOffsetTop - Preferences.minConsoleHeight);
 
@@ -193,6 +299,7 @@ WebInspector.Drawer.prototype = {
     {
         WebInspector.elementDragEnd(event);
 
+        this._savedHeight = this.element.offsetHeight;
         delete this._statusBarDragOffset;
 
         event.stopPropagation();
@@ -200,3 +307,9 @@ WebInspector.Drawer.prototype = {
 }
 
 WebInspector.Drawer.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.Drawer.State = {
+    Hidden: 0,
+    Variable: 1,
+    Full: 2
+};
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index aa6319c..9b18251 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -58,8 +58,8 @@ WebInspector.ElementsPanel = function()
         this.panel.updateProperties();
         this.panel.updateEventListeners();
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.panel.nodeSearchButton.toggled = false;
         }
         if (this._focusedDOMNode)
@@ -150,8 +150,8 @@ WebInspector.ElementsPanel.prototype = {
 
         WebInspector.hoveredDOMNode = null;
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.nodeSearchButton.toggled = false;
         }
     },
@@ -164,13 +164,24 @@ WebInspector.ElementsPanel.prototype = {
 
     reset: function()
     {
+        if (this.focusedDOMNode) {
+            this._selectedPathOnReset = [];
+            var node = this.focusedDOMNode;
+            while ("index" in node) {
+                this._selectedPathOnReset.push(node.nodeName);
+                this._selectedPathOnReset.push(node.index);
+                node = node.parentNode;
+            }
+            this._selectedPathOnReset.reverse();
+        }
+
         this.rootDOMNode = null;
         this.focusedDOMNode = null;
 
         WebInspector.hoveredDOMNode = null;
 
-        if (InspectorController.searchingForNode()) {
-            InspectorController.toggleNodeSearch();
+        if (InspectorBackend.searchingForNode()) {
+            InspectorBackend.toggleNodeSearch();
             this.nodeSearchButton.toggled = false;
         }
 
@@ -178,31 +189,48 @@ WebInspector.ElementsPanel.prototype = {
 
         delete this.currentQuery;
         this.searchCanceled();
+    },
 
-        var domWindow = WebInspector.domAgent.domWindow;
-        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
-            return;
+    setDocument: function(inspectedRootDocument)
+    {
+        this.reset();
 
-        // If the window isn't visible, return early so the DOM tree isn't built
-        // and mutation event listeners are not added.
-        if (!InspectorController.isWindowVisible())
+        if (!inspectedRootDocument)
             return;
 
-        var inspectedRootDocument = domWindow.document;
         inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
         inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
 
+        this.treeOutline.suppressSelectHighlight = true;
         this.rootDOMNode = inspectedRootDocument;
+        this.treeOutline.suppressSelectHighlight = false;
 
-        var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
-        if (canidateFocusNode) {
-            this.treeOutline.suppressSelectHighlight = true;
-            this.focusedDOMNode = canidateFocusNode;
-            this.treeOutline.suppressSelectHighlight = false;
+        function selectNode(candidateFocusNode)
+        {
+            if (!candidateFocusNode)
+                candidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
+
+            if (!candidateFocusNode)
+                return;
 
+            this.treeOutline.suppressSelectHighlight = true;
+            this.focusedDOMNode = candidateFocusNode;
             if (this.treeOutline.selectedTreeElement)
                 this.treeOutline.selectedTreeElement.expand();
+            this.treeOutline.suppressSelectHighlight = false;
+        }
+
+        function selectLastSelectedNode(nodeId)
+        {
+            var node = nodeId ? WebInspector.domAgent.nodeForId(nodeId) : 0;
+            selectNode.call(this, node);
         }
+
+        if (this._selectedPathOnReset)
+            InjectedScriptAccess.nodeByPath(this._selectedPathOnReset, selectLastSelectedNode.bind(this));
+        else
+            selectNode.call(this);
+        delete this._selectedPathOnReset;
     },
 
     searchCanceled: function()
@@ -525,7 +553,7 @@ WebInspector.ElementsPanel.prototype = {
     _mouseMovedOutOfCrumbs: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.crumbsElement))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.crumbsElement))
             return;
 
         WebInspector.hoveredDOMNode = null;
@@ -998,6 +1026,21 @@ WebInspector.ElementsPanel.prototype = {
 
     handleKeyEvent: function(event)
     {
+        // Cmd/Control + Shift + C should be a shortcut to clicking the Node Search Button.
+        // This shortcut matches Firebug.
+        if (event.keyIdentifier === "U+0043") {     // C key
+            if (WebInspector.isMac())
+                var isNodeSearchKey = event.metaKey && !event.ctrlKey && !event.altKey && event.shiftKey;
+            else
+                var isNodeSearchKey = event.ctrlKey && !event.metaKey && !event.altKey && event.shiftKey;
+
+            if (isNodeSearchKey) {
+                this._nodeSearchButtonClicked(event);
+                event.preventDefault();
+                return;
+            }
+        }
+        
         this.treeOutline.handleKeyEvent(event);
     },
 
@@ -1008,7 +1051,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         event.clipboardData.clearData();
         event.preventDefault();
-        InspectorController.copyNode(this.focusedDOMNode.id);
+        InspectorBackend.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1037,9 +1080,9 @@ WebInspector.ElementsPanel.prototype = {
 
     _nodeSearchButtonClicked: function(event)
     {
-        InspectorController.toggleNodeSearch();
+        InspectorBackend.toggleNodeSearch();
 
-        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
+        this.nodeSearchButton.toggled = InspectorBackend.searchingForNode();
     }
 }
 
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index be01647..a035e7d 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -41,6 +41,8 @@ WebInspector.ElementsTreeOutline = function() {
     this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
+
+    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
@@ -83,7 +85,7 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x.id);
+                InspectorBackend.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,9 +94,9 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode.id);
+                        InspectorBackend.highlightDOMNode(hoveredNode.id);
                     else
-                        InspectorController.hideDOMNodeHighlight();
+                        InspectorBackend.hideDOMNodeHighlight();
                 }
 
                 this._restorePreviousHighlightNodeTimeout = setTimeout(restoreHighlightToHoveredNode, 2000);
@@ -104,6 +106,8 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     update: function()
     {
+        var selectedNode = this.selectedTreeElement ? this.selectedTreeElement.representedObject : null;
+
         this.removeChildren();
 
         if (!this.rootDOMNode)
@@ -125,7 +129,8 @@ WebInspector.ElementsTreeOutline.prototype = {
             }
         }
 
-        this.updateSelection();
+        if (selectedNode)
+            this.revealAndSelectNode(selectedNode);
     },
 
     updateSelection: function()
@@ -192,9 +197,10 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (!selectedElement)
             return;
 
-        // Delete or backspace pressed, delete the node.
-        if (event.keyCode === 8 || event.keyCode === 46) {
+        if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Backspace ||
+                event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Delete) {
             selectedElement.remove();
+            event.preventDefault();
             return;
         }
 
@@ -255,6 +261,23 @@ WebInspector.ElementsTreeOutline.prototype = {
         }
 
         WebInspector.hoveredDOMNode = null;
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        var listItem = event.target.enclosingNodeOrSelfWithNodeName("LI");
+        if (!listItem || !listItem.treeElement)
+            return;
+
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
+        var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
+        if (tag)
+            listItem.treeElement._populateTagContextMenu(contextMenu, event);
+        else if (textNode)
+            listItem.treeElement._populateTextContextMenu(contextMenu, textNode);
+        contextMenu.show(event);
     }
 }
 
@@ -321,6 +344,26 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
+    createTooltipForImageNode: function(node, callback)
+    {
+        function createTooltipThenCallback(properties)
+        {
+            if (!properties) {
+                callback();
+                return;
+            }
+
+            var tooltipText = null;
+            if (properties.offsetHeight === properties.naturalHeight && properties.offsetWidth === properties.naturalWidth)
+                tooltipText = WebInspector.UIString("%d × %d pixels", properties.offsetWidth, properties.offsetHeight);
+            else
+                tooltipText = WebInspector.UIString("%d × %d pixels (Natural: %d × %d pixels)", properties.offsetWidth, properties.offsetHeight, properties.naturalWidth, properties.naturalHeight);
+            callback(tooltipText);
+        }
+        var objectProxy = new WebInspector.ObjectProxy(node.id);
+        WebInspector.ObjectProxy.getPropertiesAsync(objectProxy, ["naturalHeight", "naturalWidth", "offsetHeight", "offsetWidth"], createTooltipThenCallback);
+    },
+
     toggleNewAttributeButton: function(visible)
     {
         function removeAddAttributeSpan()
@@ -525,12 +568,12 @@ WebInspector.ElementsTreeElement.prototype = {
             event.preventDefault();
     },
 
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
         if (this._editing)
             return;
 
-        if (this._startEditingFromEvent(event, treeElement))
+        if (this._startEditingFromEvent(event))
             return;
 
         if (this.hasChildren && !this.expanded)
@@ -552,7 +595,7 @@ WebInspector.ElementsTreeElement.prototype = {
         this.updateSelection();
     },
 
-    _startEditingFromEvent: function(event, treeElement)
+    _startEditingFromEvent: function(event)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -570,11 +613,31 @@ WebInspector.ElementsTreeElement.prototype = {
 
         var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
         if (newAttribute)
-            return this._addNewAttribute(treeElement.listItemElement);
+            return this._addNewAttribute();
 
         return false;
     },
 
+    _populateTagContextMenu: function(contextMenu, event)
+    {
+        var attribute = event.target.enclosingNodeOrSelfWithClass("webkit-html-attribute");
+        var newAttribute = event.target.enclosingNodeOrSelfWithClass("add-attribute");
+
+        // Add attribute-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Add Attribute"), this._addNewAttribute.bind(this));
+        if (attribute && !newAttribute)
+            contextMenu.appendItem(WebInspector.UIString("Edit Attribute"), this._startEditingAttribute.bind(this, attribute, event.target));
+        contextMenu.appendSeparator();
+
+        // Add node-related actions.
+        contextMenu.appendItem(WebInspector.UIString("Delete Node"), this.remove.bind(this));
+    },
+
+    _populateTextContextMenu: function(contextMenu, textNode)
+    {
+        contextMenu.appendItem(WebInspector.UIString("Edit Text"), this._startEditingTextNode.bind(this, textNode));
+    },
+
     _startEditing: function()
     {
         if (this.treeOutline.focusedDOMNode !== this.representedObject)
@@ -588,7 +651,7 @@ WebInspector.ElementsTreeElement.prototype = {
             if (attribute)
                 return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-value")[0]);
 
-            return this._addNewAttribute(listItem);
+            return this._addNewAttribute();
         }
 
         if (this.representedObject.nodeType === Node.TEXT_NODE) {
@@ -599,7 +662,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
     },
 
-    _addNewAttribute: function(listItemElement)
+    _addNewAttribute: function()
     {
         var attr = document.createElement("span");
         attr.className = "webkit-html-attribute";
@@ -613,7 +676,7 @@ WebInspector.ElementsTreeElement.prototype = {
         attr.appendChild(name);
         attr.appendChild(value);
 
-        var tag = listItemElement.getElementsByClassName("webkit-html-tag")[0];
+        var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
         this._insertInLastAttributePosition(tag, attr);
         return this._startEditingAttribute(attr, attr);
     },
@@ -731,7 +794,6 @@ WebInspector.ElementsTreeElement.prototype = {
 
         if (!parseElement.hasAttributes()) {
             this.representedObject.removeAttribute(attributeName);
-            this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
         }
@@ -748,8 +810,6 @@ WebInspector.ElementsTreeElement.prototype = {
         if (!foundOriginalAttribute)
             this.representedObject.removeAttribute(attributeName);
 
-        this._updateTitle();
-
         this.treeOutline.focusedNodeChanged(true);
 
         moveToNextAttributeIfNeeded.call(this);
@@ -768,26 +828,42 @@ WebInspector.ElementsTreeElement.prototype = {
             textNode = this.representedObject;
 
         textNode.nodeValue = newText;
-        this._updateTitle();
+
+        // No need to call _updateTitle here, it will be called after the nodeValue is committed.
     },
 
     _editingCancelled: function(element, context)
     {
         delete this._editing;
 
-        this._updateTitle();
+        // No need to call _updateTitle here, the editing code will revert to the original text.
     },
 
     _updateTitle: function()
     {
-        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
-        this.title = "<span class=\"highlight\">" + title + "</span>";
-        delete this.selectionElement;
-        this.updateSelection();
-        this._preventFollowingLinksOnDoubleClick();
+        // If we are editing, return early to prevent canceling the edit.
+        // After editing is committed _updateTitle will be called.
+        if (this._editing)
+            return;
+
+        var self = this;
+        function callback(tooltipText)
+        {
+            var title = self._nodeTitleInfo(self.representedObject, self.hasChildren, WebInspector.linkifyURL, tooltipText).title;
+            self.title = "<span class=\"highlight\">" + title + "</span>";
+            delete self.selectionElement;
+            self.updateSelection();
+            self._preventFollowingLinksOnDoubleClick();
+        };
+
+        // TODO: Replace with InjectedScriptAccess.getBasicProperties(obj, [names]).
+        if (this.representedObject.nodeName.toLowerCase() !== "img")
+            callback();
+        else
+            this.createTooltipForImageNode(this.representedObject, callback);
     },
 
-    _nodeTitleInfo: function(node, hasChildren, linkify)
+    _nodeTitleInfo: function(node, hasChildren, linkify, tooltipText)
     {
         var info = {title: "", hasChildren: hasChildren};
         
@@ -807,7 +883,7 @@ WebInspector.ElementsTreeElement.prototype = {
                         var value = attr.value;
                         if (linkify && (attr.name === "src" || attr.name === "href")) {
                             var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a", tooltipText);
                         } else {
                             var value = value.escapeHTML();
                             value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
@@ -847,8 +923,8 @@ WebInspector.ElementsTreeElement.prototype = {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
                         
-                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
-                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighlighter(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else {
@@ -908,7 +984,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         var callId = WebInspector.Callback.wrap(removeNodeCallback);
-        InspectorController.removeNode(callId, this.representedObject.id);
+        InspectorBackend.removeNode(callId, this.representedObject.id);
     }
 }
 
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 2938196..c083c0e 100644
--- a/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -108,7 +108,7 @@ WebInspector.EventListenersSidebarPane.prototype = {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
         Preferences.eventListenersFilter = selectedOption.value;
 
-        InspectorController.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
+        InspectorFrontendHost.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update();
diff --git a/WebCore/inspector/front-end/FontView.js b/WebCore/inspector/front-end/FontView.js
index 4e1c931..8468cc9 100644
--- a/WebCore/inspector/front-end/FontView.js
+++ b/WebCore/inspector/front-end/FontView.js
@@ -36,7 +36,7 @@ WebInspector.FontView = function(resource)
 
     this.fontStyleElement = document.createElement("style");
     this.fontStyleElement.textContent = "@font-face { font-family: \"" + uniqueFontName + "\"; src: url(" + this.resource.url + "); }";
-    document.getElementsByTagName("head").item(0).appendChild(this.fontStyleElement);
+    document.head.appendChild(this.fontStyleElement);
 
     this.fontPreviewElement = document.createElement("div");
     this.fontPreviewElement.className = "preview";
diff --git a/WebCore/inspector/front-end/Images/consoleIcon.png b/WebCore/inspector/front-end/Images/consoleIcon.png
new file mode 100644
index 0000000..94ffa95
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/consoleIcon.png
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 3bed8da..209e99f 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -59,7 +59,8 @@ InjectedScript.getStyles = function(nodeId, authorOnly)
     var node = InjectedScript._nodeForId(nodeId);
     if (!node)
         return false;
-    var matchedRules = InjectedScript._window().getMatchedCSSRules(node, "", authorOnly);
+    var defaultView = node.ownerDocument.defaultView;
+    var matchedRules = defaultView.getMatchedCSSRules(node, "", authorOnly);
     var matchedCSSRules = [];
     for (var i = 0; matchedRules && i < matchedRules.length; ++i)
         matchedCSSRules.push(InjectedScript._serializeRule(matchedRules[i]));
@@ -72,7 +73,7 @@ InjectedScript.getStyles = function(nodeId, authorOnly)
     }
     var result = {};
     result.inlineStyle = InjectedScript._serializeStyle(node.style, true);
-    result.computedStyle = InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+    result.computedStyle = InjectedScript._serializeStyle(defaultView.getComputedStyle(node));
     result.matchedCSSRules = matchedCSSRules;
     result.styleAttributes = styleAttributes;
     return result;
@@ -83,7 +84,7 @@ InjectedScript.getComputedStyle = function(nodeId)
     var node = InjectedScript._nodeForId(nodeId);
     if (!node)
         return false;
-    return InjectedScript._serializeStyle(InjectedScript._window().getComputedStyle(node));
+    return InjectedScript._serializeStyle(node.ownerDocument.defaultView.getComputedStyle(node));
 }
 
 InjectedScript.getInlineStyle = function(nodeId)
@@ -230,15 +231,19 @@ InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
 
 InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
 {
-    var stylesheet = InjectedScript.stylesheet;
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+    if (!selectedNode)
+        return false;
+    var ownerDocument = selectedNode.ownerDocument;
+
+    var stylesheet = ownerDocument.__stylesheet;
     if (!stylesheet) {
-        var inspectedDocument = InjectedScript._window().document;
-        var head = inspectedDocument.getElementsByTagName("head")[0];
-        var styleElement = inspectedDocument.createElement("style");
+        var head = ownerDocument.head;
+        var styleElement = ownerDocument.createElement("style");
         styleElement.type = "text/css";
         head.appendChild(styleElement);
-        stylesheet = inspectedDocument.styleSheets[inspectedDocument.styleSheets.length - 1];
-        InjectedScript.stylesheet = stylesheet;
+        stylesheet = ownerDocument.styleSheets[ownerDocument.styleSheets.length - 1];
+        ownerDocument.__stylesheet = stylesheet;
     }
 
     try {
@@ -248,7 +253,6 @@ InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
         return false;
     }
 
-    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
     var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
     rule.__isViaInspector = true;
 
@@ -557,7 +561,7 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, obj
 {
     var result = {};
     try {
-        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+        result.value = InjectedScriptHost.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
             result.value = result.value.errorText;
@@ -575,7 +579,7 @@ InjectedScript._evaluateOn = function(evalFunction, object, expression)
     InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
-    expression = "with (window.console._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    expression = "with (window.console._inspectorCommandLineAPI) { with (window) {\n" + expression + "\n} }";
     var value = evalFunction.call(object, expression);
 
     // When evaluating on call frame error is not thrown, but returned as a value.
@@ -642,10 +646,10 @@ InjectedScript.performSearch = function(whitespaceTrimmedQuery)
 
             node[searchResultsProperty] = true;
             InjectedScript._searchResults.push(node);
-            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            var nodeId = InjectedScriptHost.pushNodePathToFrontend(node, false);
             nodeIds.push(nodeId);
         }
-        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+        InjectedScriptHost.addNodesToSearchResult(nodeIds.join(","));
     }
 
     function matchExactItems(doc)
@@ -844,7 +848,7 @@ InjectedScript.openInInspectedWindow = function(url)
 
 InjectedScript.getCallFrames = function()
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     if (!callFrame)
         return false;
 
@@ -867,7 +871,7 @@ InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
 
 InjectedScript._callFrameForId = function(id)
 {
-    var callFrame = InspectorController.currentCallFrame();
+    var callFrame = InjectedScriptHost.currentCallFrame();
     while (--id >= 0 && callFrame)
         callFrame = callFrame.caller;
     return callFrame;
@@ -875,7 +879,7 @@ InjectedScript._callFrameForId = function(id)
 
 InjectedScript._clearConsoleMessages = function()
 {
-    InspectorController.clearMessages(true);
+    InjectedScriptHost.clearMessages(true);
 }
 
 InjectedScript._inspectObject = function(o)
@@ -886,90 +890,105 @@ InjectedScript._inspectObject = function(o)
     var inspectedWindow = InjectedScript._window();
     inspectedWindow.console.log(o);
     if (Object.type(o) === "node") {
-        InspectorController.pushNodePathToFrontend(o, true);
+        InjectedScriptHost.pushNodePathToFrontend(o, true);
     } else {
         switch (Object.describe(o)) {
             case "Database":
-                InspectorController.selectDatabase(o);
+                InjectedScriptHost.selectDatabase(o);
                 break;
             case "Storage":
-                InspectorController.selectDOMStorage(o);
+                InjectedScriptHost.selectDOMStorage(o);
                 break;
         }
     }
 }
 
+InjectedScript._copy = function(o)
+{
+    if (Object.type(o) === "node") {
+        var nodeId = InjectedScriptHost.pushNodePathToFrontend(o, false);
+        InjectedScriptHost.copyNode(nodeId);
+    } else {
+        InjectedScriptHost.copyText(o);
+    }
+}
+
 InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
     if (evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI"))
         return;
-    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \
-        $: function() { return document.getElementById.apply(document, arguments) }, \
-        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-        $x: function(xpath, context) { \
-            var nodes = []; \
-            try { \
-                var doc = context || document; \
-                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                var node; \
-                while (node = results.iterateNext()) nodes.push(node); \
-            } catch (e) {} \
-            return nodes; \
-        }, \
-        dir: function() { return console.dir.apply(console, arguments) }, \
-        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-        profile: function() { return console.profile.apply(console, arguments) }, \
-        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \
-        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \
-            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \
-            \"resize\", \"scroll\"], \
-        _normalizeEventTypes: function(t) { \
-            if (typeof t === \"undefined\") \
-                t = _inspectorCommandLineAPI._allEventTypes; \
-            else if (typeof t === \"string\") \
-                t = [t]; \
-            var i, te = []; \
-            for (i = 0; i < t.length; i++) { \
-                if (t[i] === \"mouse\") \
-                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \
-                        \"mousemove\", \"mouseover\", \"mouseout\"); \
-                else if (t[i] === \"key\") \
-                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \
-                else \
-                    te.push(t[i]); \
-            } \
-            return te; \
-        }, \
-        monitorEvent: function(o, t) { \
-            if (!o || !o.addEventListener || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-                o.addEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        unmonitorEvent: function(o, t) { \
-            if (!o || !o.removeEventListener) \
-                return; \
-            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
-            for (i = 0; i < t.length; i++) { \
-                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
-            } \
-        }, \
-        _inspectedNodes: [], \
-        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \
-        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \
-        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \
-        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \
-        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] } \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \n\
+        $: function() { return document.getElementById.apply(document, arguments) }, \n\
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \n\
+        $x: function(xpath, context) \n\
+        { \n\
+            var nodes = []; \n\
+            try { \n\
+                var doc = context || document; \n\
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \n\
+                var node; \n\
+                while (node = results.iterateNext()) nodes.push(node); \n\
+            } catch (e) {} \n\
+            return nodes; \n\
+        }, \n\
+        dir: function() { return console.dir.apply(console, arguments) }, \n\
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \n\
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \n\
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \n\
+        profile: function() { return console.profile.apply(console, arguments) }, \n\
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \n\
+        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \n\
+        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \n\
+            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \n\
+            \"resize\", \"scroll\"], \n\
+        _normalizeEventTypes: function(t) \n\
+        { \n\
+            if (typeof t === \"undefined\") \n\
+                t = console._inspectorCommandLineAPI._allEventTypes; \n\
+            else if (typeof t === \"string\") \n\
+                t = [t]; \n\
+            var i, te = []; \n\
+            for (i = 0; i < t.length; i++) { \n\
+                if (t[i] === \"mouse\") \n\
+                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \n\
+                        \"mousemove\", \"mouseover\", \"mouseout\"); \n\
+                else if (t[i] === \"key\") \n\
+                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \n\
+                else \n\
+                    te.push(t[i]); \n\
+            } \n\
+            return te; \n\
+        }, \n\
+        monitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.addEventListener || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+                o.addEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        unmonitorEvents: function(o, t) \n\
+        { \n\
+            if (!o || !o.removeEventListener) \n\
+                return; \n\
+            t = console._inspectorCommandLineAPI._normalizeEventTypes(t); \n\
+            for (i = 0; i < t.length; i++) { \n\
+                o.removeEventListener(t[i], console._inspectorCommandLineAPI._logEvent, false); \n\
+            } \n\
+        }, \n\
+        _inspectedNodes: [], \n\
+        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \n\
+        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \n\
+        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \n\
+        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \n\
+        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] }, \n\
     };");
 
-    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
-    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.clear = InjectedScriptHost.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InjectedScriptHost.wrapCallback(InjectedScript._inspectObject);
+    inspectorCommandLineAPI.copy = InjectedScriptHost.wrapCallback(InjectedScript._copy);
 }
 
 InjectedScript._resolveObject = function(objectProxy)
@@ -993,14 +1012,14 @@ InjectedScript._window = function()
 {
     // TODO: replace with 'return window;' once this script is injected into
     // the page's context.
-    return InspectorController.inspectedWindow();
+    return InjectedScriptHost.inspectedWindow();
 }
 
 InjectedScript._nodeForId = function(nodeId)
 {
     if (!nodeId)
         return null;
-    return InspectorController.nodeForId(nodeId);
+    return InjectedScriptHost.nodeForId(nodeId);
 }
 
 InjectedScript._objectForId = function(objectId)
@@ -1012,7 +1031,7 @@ InjectedScript._objectForId = function(objectId)
     if (typeof objectId === "number") {
         return InjectedScript._nodeForId(objectId);
     } else if (typeof objectId === "string") {
-        return InspectorController.unwrapObject(objectId);
+        return InjectedScriptHost.unwrapObject(objectId);
     } else if (typeof objectId === "object") {
         var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
         if (objectId.thisObject)
@@ -1028,7 +1047,14 @@ InjectedScript.pushNodeToFrontend = function(objectProxy)
     var object = InjectedScript._resolveObject(objectProxy);
     if (!object || Object.type(object) !== "node")
         return false;
-    return InspectorController.pushNodePathToFrontend(object, false);
+    return InjectedScriptHost.pushNodePathToFrontend(object, false);
+}
+
+InjectedScript.nodeByPath = function(path)
+{
+    // We make this call through the injected script only to get a nice
+    // callback for it.
+    return InjectedScriptHost.pushNodeByPathToFrontend(path.join(","));
 }
 
 // Called from within InspectorController on the 'inspected page' side.
@@ -1111,23 +1137,23 @@ InjectedScript.executeSql = function(callId, databaseId, query)
                 data[columnIdentifier] = String(text);
             }
         }
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
     }
 
     function errorCallback(tx, error)
     {
-        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+        InjectedScriptHost.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
     }
 
     function queryTransaction(tx)
     {
-        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+        tx.executeSql(query, null, InjectedScriptHost.wrapCallback(successCallback), InjectedScriptHost.wrapCallback(errorCallback));
     }
 
-    var database = InspectorController.databaseForId(databaseId);
+    var database = InjectedScriptHost.databaseForId(databaseId);
     if (!database)
         errorCallback(null, { code : 2 });  // Return as unexpected version.
-    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    database.transaction(InjectedScriptHost.wrapCallback(queryTransaction), InjectedScriptHost.wrapCallback(errorCallback));
     return true;
 }
 
@@ -1197,8 +1223,6 @@ Object.describe = function(obj, abbreviated)
         else if (abbreviated)
             objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
         return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
     default:
         return String(obj);
     }
diff --git a/WebCore/inspector/front-end/InjectedScriptAccess.js b/WebCore/inspector/front-end/InjectedScriptAccess.js
index c6d4b65..14a3a6b 100644
--- a/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -47,11 +47,11 @@ InjectedScriptAccess._installHandler = function(methodName, async)
                 WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
         }
         var callId = WebInspector.Callback.wrap(myCallback);
-        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
+        InspectorBackend.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
     };
 }
 
-// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are implemented and called:
 // - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
 // - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
 // We keep these sorted.
@@ -70,6 +70,7 @@ InjectedScriptAccess._installHandler("getStyles");
 InjectedScriptAccess._installHandler("openInInspectedWindow");
 InjectedScriptAccess._installHandler("performSearch");
 InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("nodeByPath");
 InjectedScriptAccess._installHandler("searchCanceled");
 InjectedScriptAccess._installHandler("setPropertyValue");
 InjectedScriptAccess._installHandler("setStyleProperty");
diff --git a/WebCore/inspector/front-end/InspectorBackendStub.js b/WebCore/inspector/front-end/InspectorBackendStub.js
new file mode 100644
index 0000000..1710b12
--- /dev/null
+++ b/WebCore/inspector/front-end/InspectorBackendStub.js
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorBackend) {
+
+WebInspector.InspectorBackendStub = function()
+{
+    this._searchingForNode = false;
+    this._attachedWindowHeight = 0;
+    this._debuggerEnabled = true;
+    this._profilerEnabled = true;
+    this._resourceTrackingEnabled = false;
+    this._timelineEnabled = false;
+    this._settings = {};
+}
+
+WebInspector.InspectorBackendStub.prototype = {
+    wrapCallback: function(func)
+    {
+        return func;
+    },
+
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+    port: function()
+    {
+        return "unknown";
+    },
+
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    storeLastActivePanel: function(panel)
+    {
+    },
+
+    clearMessages: function()
+    {
+    },
+
+    searchingForNode: function()
+    {
+        return this._searchingForNode;
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    toggleNodeSearch: function()
+    {
+        this._searchingForNode = !this._searchingForNode;
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveByUnrestricted: function(x, y)
+    {
+    },
+
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    getResourceDocumentNode: function(identifier)
+    {
+        return undefined;
+    },
+
+    highlightDOMNode: function(node)
+    {
+    },
+
+    hideDOMNodeHighlight: function()
+    {
+    },
+
+    inspectedWindow: function()
+    {
+        return window;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    windowUnloading: function()
+    {
+        return false;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    debuggerEnabled: function()
+    {
+        return this._debuggerEnabled;
+    },
+
+    enableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = true;
+        WebInspector.resourceTrackingWasEnabled();
+    },
+
+    disableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = false;
+        WebInspector.resourceTrackingWasDisabled();
+    },
+
+    resourceTrackingEnabled: function()
+    {
+        return this._resourceTrackingEnabled;
+    },
+
+    enableDebugger: function()
+    {
+        this._debuggerEnabled = true;
+    },
+
+    disableDebugger: function()
+    {
+        this._debuggerEnabled = false;
+    },
+
+    addBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    removeBreakpoint: function(sourceID, line)
+    {
+    },
+
+    updateBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    pauseInDebugger: function()
+    {
+    },
+
+    pauseOnExceptions: function()
+    {
+        return false;
+    },
+
+    setPauseOnExceptions: function(value)
+    {
+    },
+
+    resumeDebugger: function()
+    {
+    },
+
+    profilerEnabled: function()
+    {
+        return true;
+    },
+
+    enableProfiler: function()
+    {
+        this._profilerEnabled = true;
+    },
+
+    disableProfiler: function()
+    {
+        this._profilerEnabled = false;
+    },
+
+    startProfiling: function()
+    {
+    },
+
+    stopProfiling: function()
+    {
+    },
+
+    getProfileHeaders: function(callId)
+    {
+        WebInspector.didGetProfileHeaders(callId, []);
+    },
+
+    getProfile: function(callId, uid)
+    {
+        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
+        {
+            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
+        }
+    },
+
+    takeHeapSnapshot: function()
+    {
+    },
+
+    databaseTableNames: function(database)
+    {
+        return [];
+    },
+
+    stepIntoStatementInDebugger: function()
+    {
+    },
+
+    stepOutOfFunctionInDebugger: function()
+    {
+    },
+
+    stepOverStatementInDebugger: function()
+    {
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    dispatchOnInjectedScript: function()
+    {
+    },
+
+    releaseWrapperObjectGroup: function()
+    {
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+InspectorBackend = new WebInspector.InspectorBackendStub();
+
+}
diff --git a/WebCore/inspector/front-end/InspectorControllerStub.js b/WebCore/inspector/front-end/InspectorControllerStub.js
index 6fb5a1b..e69de29 100644
--- a/WebCore/inspector/front-end/InspectorControllerStub.js
+++ b/WebCore/inspector/front-end/InspectorControllerStub.js
@@ -1,291 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-if (!window.InspectorController) {
-
-WebInspector.InspectorControllerStub = function()
-{
-    this._searchingForNode = false;
-    this._windowVisible = true;
-    this._attachedWindowHeight = 0;
-    this._debuggerEnabled = true;
-    this._profilerEnabled = true;
-    this._resourceTrackingEnabled = false;
-    this._timelineEnabled = false;
-    this._settings = {};
-}
-
-WebInspector.InspectorControllerStub.prototype = {
-    wrapCallback: function(func)
-    {
-        return func;
-    },
-
-    isWindowVisible: function()
-    {
-        return this._windowVisible;
-    },
-
-    platform: function()
-    {
-        return "mac-leopard";
-    },
-
-
-    closeWindow: function()
-    {
-        this._windowVisible = false;
-    },
-
-    attach: function()
-    {
-    },
-
-    detach: function()
-    {
-    },
-
-    storeLastActivePanel: function(panel)
-    {
-    },
-
-    clearMessages: function()
-    {
-    },
-
-    searchingForNode: function()
-    {
-        return this._searchingForNode;
-    },
-
-    search: function(sourceRow, query)
-    {
-    },
-
-    toggleNodeSearch: function()
-    {
-        this._searchingForNode = !this._searchingForNode;
-    },
-
-    setAttachedWindowHeight: function(height)
-    {
-    },
-
-    moveByUnrestricted: function(x, y)
-    {
-    },
-
-
-    addResourceSourceToFrame: function(identifier, element)
-    {
-    },
-
-    addSourceToFrame: function(mimeType, source, element)
-    {
-        return false;
-    },
-
-    getResourceDocumentNode: function(identifier)
-    {
-        return undefined;
-    },
-
-    highlightDOMNode: function(node)
-    {
-    },
-
-    hideDOMNodeHighlight: function()
-    {
-    },
-
-    inspectedWindow: function()
-    {
-        return window;
-    },
-
-    loaded: function()
-    {
-    },
-
-    localizedStringsURL: function()
-    {
-        return undefined;
-    },
-
-    windowUnloading: function()
-    {
-        return false;
-    },
-
-    hiddenPanels: function()
-    {
-        return "";
-    },
-
-    debuggerEnabled: function()
-    {
-        return this._debuggerEnabled;
-    },
-
-    enableResourceTracking: function()
-    {
-        this._resourceTrackingEnabled = true;
-        WebInspector.resourceTrackingWasEnabled();
-    },
-
-    disableResourceTracking: function()
-    {
-        this._resourceTrackingEnabled = false;
-        WebInspector.resourceTrackingWasDisabled();
-    },
-
-    resourceTrackingEnabled: function()
-    {
-        return this._resourceTrackingEnabled;
-    },
-
-    enableDebugger: function()
-    {
-        this._debuggerEnabled = true;
-    },
-
-    disableDebugger: function()
-    {
-        this._debuggerEnabled = false;
-    },
-
-    addBreakpoint: function(sourceID, line, condition)
-    {
-    },
-
-    removeBreakpoint: function(sourceID, line)
-    {
-    },
-
-    updateBreakpoint: function(sourceID, line, condition)
-    {
-    },
-
-    pauseInDebugger: function()
-    {
-    },
-
-    pauseOnExceptions: function()
-    {
-        return false;
-    },
-
-    setPauseOnExceptions: function(value)
-    {
-    },
-
-    resumeDebugger: function()
-    {
-    },
-
-    profilerEnabled: function()
-    {
-        return true;
-    },
-
-    enableProfiler: function()
-    {
-        this._profilerEnabled = true;
-    },
-
-    disableProfiler: function()
-    {
-        this._profilerEnabled = false;
-    },
-
-    startProfiling: function()
-    {
-    },
-
-    stopProfiling: function()
-    {
-    },
-
-    getProfileHeaders: function(callId)
-    {
-        WebInspector.didGetProfileHeaders(callId, []);
-    },
-
-    getProfile: function(callId, uid)
-    {
-        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
-        {
-            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
-        }
-    },
-
-    takeHeapSnapshot: function()
-    {
-    },
-
-    databaseTableNames: function(database)
-    {
-        return [];
-    },
-
-    stepIntoStatementInDebugger: function()
-    {
-    },
-
-    stepOutOfFunctionInDebugger: function()
-    {
-    },
-
-    stepOverStatementInDebugger: function()
-    {
-    },
-
-    setSetting: function(setting, value)
-    {
-        this._settings[setting] = value;
-    },
-
-    dispatchOnInjectedScript: function()
-    {
-    },
-
-    releaseWrapperObjectGroup: function()
-    {
-    },
-
-    setting: function(setting)
-    {
-        return this._settings[setting];
-    }
-}
-
-window.InspectorController = new WebInspector.InspectorControllerStub();
-
-}
diff --git a/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/WebCore/inspector/front-end/InspectorFrontendHostStub.js
new file mode 100644
index 0000000..facea4e
--- /dev/null
+++ b/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorFrontendHost) {
+
+WebInspector.InspectorFrontendHostStub = function()
+{
+    this._attachedWindowHeight = 0;
+    this._settings = {};
+}
+
+WebInspector.InspectorFrontendHostStub.prototype = {
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+    port: function()
+    {
+        return "unknown";
+    },
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveWindowBy: function(x, y)
+    {
+    },
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
+
+}
diff --git a/WebCore/inspector/front-end/KeyboardShortcut.js b/WebCore/inspector/front-end/KeyboardShortcut.js
index ed28a48..0a068d5 100644
--- a/WebCore/inspector/front-end/KeyboardShortcut.js
+++ b/WebCore/inspector/front-end/KeyboardShortcut.js
@@ -44,6 +44,7 @@ WebInspector.KeyboardShortcut.Modifiers = {
 };
 
 WebInspector.KeyboardShortcut.KeyCodes = {
+    Backspace: 8,
     Esc: 27,
     Space: 32,
     PageUp: 33,      // also NUM_NORTH_EAST
@@ -54,6 +55,7 @@ WebInspector.KeyboardShortcut.KeyCodes = {
     Up: 38,          // also NUM_NORTH
     Right: 39,       // also NUM_EAST
     Down: 40,        // also NUM_SOUTH
+    Delete: 46,
     F1: 112,
     F2: 113,
     F3: 114,
@@ -76,12 +78,14 @@ WebInspector.KeyboardShortcut.KeyCodes = {
 
 /**
  * Creates a number encoding keyCode in the lower 8 bits and modifiers mask in the higher 8 bits.
- * It is usefull for matching pressed keys.
- * @param {number} keyCode Code of the key.
- * @param {number} optModifiers Optional list of modifiers passed as additional paramerters.
+ * It is useful for matching pressed keys.
+ * keyCode is the Code of the key, or a character "a-z" which is converted to a keyCode value.
+ * optModifiers is an Optional list of modifiers passed as additional paramerters.
  */
 WebInspector.KeyboardShortcut.makeKey = function(keyCode, optModifiers)
 {
+    if (typeof keyCode === "string")
+        keyCode = keyCode.charCodeAt(0) - 32;
     var modifiers = WebInspector.KeyboardShortcut.Modifiers.None;
     for (var i = 1; i < arguments.length; i++)
         modifiers |= arguments[i];
diff --git a/WebCore/inspector/front-end/MetricsSidebarPane.js b/WebCore/inspector/front-end/MetricsSidebarPane.js
index a33653b..f5e6758 100644
--- a/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -35,27 +35,22 @@ WebInspector.MetricsSidebarPane = function()
 WebInspector.MetricsSidebarPane.prototype = {
     update: function(node)
     {
-        var body = this.bodyElement;
-
-        body.removeChildren();
-
         if (node)
             this.node = node;
         else
             node = this.node;
 
-        if (!node || !node.ownerDocument.defaultView)
-            return;
-
-        if (node.nodeType !== Node.ELEMENT_NODE)
+        if (!node || !node.ownerDocument.defaultView || node.nodeType !== Node.ELEMENT_NODE) {
+            this.bodyElement.removeChildren();
             return;
+        }
 
         var self = this;
         var callback = function(stylePayload) {
             if (!stylePayload)
                 return;
             var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
-            self._update(node, body, style);
+            self._update(style);
         };
         InjectedScriptAccess.getComputedStyle(node.id, callback);
 
@@ -67,7 +62,7 @@ WebInspector.MetricsSidebarPane.prototype = {
         InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
     },
 
-    _update: function(node, body, style)
+    _update: function(style)
     {
         var metricsElement = document.createElement("div");
         metricsElement.className = "metrics";
@@ -169,7 +164,8 @@ WebInspector.MetricsSidebarPane.prototype = {
         }
 
         metricsElement.appendChild(previousBox);
-        body.appendChild(metricsElement);
+        this.bodyElement.removeChildren();
+        this.bodyElement.appendChild(metricsElement);
     },
 
     startEditing: function(targetElement, box, styleProperty)
diff --git a/WebCore/inspector/front-end/ObjectPropertiesSection.js b/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 8bb4e35..7bdf17f 100644
--- a/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -150,7 +150,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing();
     },
diff --git a/WebCore/inspector/front-end/ObjectProxy.js b/WebCore/inspector/front-end/ObjectProxy.js
index bb4afa5..f4a59a7 100644
--- a/WebCore/inspector/front-end/ObjectProxy.js
+++ b/WebCore/inspector/front-end/ObjectProxy.js
@@ -45,6 +45,24 @@ WebInspector.ObjectProxy.wrapPrimitiveValue = function(value)
     return proxy;
 }
 
+WebInspector.ObjectProxy.getPropertiesAsync = function(objectProxy, propertiesToQueryFor, callback)
+{
+    function createPropertiesMapThenCallback(propertiesPayload)
+    {
+        if (!propertiesPayload) {
+            callback();
+            return;
+        }
+
+        var result = [];
+        for (var i = 0; i < propertiesPayload.length; ++i)
+            if (propertiesToQueryFor.indexOf(propertiesPayload[i].name) !== -1)
+                result[propertiesPayload[i].name] = propertiesPayload[i].value.description;
+        callback(result);
+    };
+    InjectedScriptAccess.getProperties(objectProxy, true, createPropertiesMapThenCallback);
+}
+
 WebInspector.ObjectPropertyProxy = function(name, value)
 {
     this.name = name;
diff --git a/WebCore/inspector/front-end/Panel.js b/WebCore/inspector/front-end/Panel.js
index 6cd200b..d816ce5 100644
--- a/WebCore/inspector/front-end/Panel.js
+++ b/WebCore/inspector/front-end/Panel.js
@@ -231,8 +231,11 @@ WebInspector.Panel.prototype = {
             showFirstResult = true;
         }
 
-        if (currentView !== this.visibleView)
-            this.showView(currentView);
+        if (currentView !== this.visibleView) {
+            currentView = this.visibleView;
+            this._currentSearchResultIndex = 0;
+            showFirstResult = true;
+        }
 
         if (showFirstResult)
             currentView.jumpToFirstSearchResult();
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index afced41..c164e94 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -83,7 +83,7 @@ WebInspector.CPUProfileView = function(profile)
     var self = this;
     function profileCallback(profile)
     {
-        self.profile.representedObject = profile;
+        self.profile = profile;
         self._assignParentsInProfile();
       
         self.profileDataGridTree = self.bottomUpProfileDataGridTree;
@@ -95,7 +95,7 @@ WebInspector.CPUProfileView = function(profile)
     }
 
     var callId = WebInspector.Callback.wrap(profileCallback);
-    InspectorController.getProfile(callId, this.profile.uid);
+    InspectorBackend.getProfile(callId, this.profile.uid);
 }
 
 WebInspector.CPUProfileView.prototype = {
@@ -505,7 +505,7 @@ WebInspector.CPUProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile.representedObject);
+        this._sortProfile(this.profile);
     },
 
     _sortProfile: function()
@@ -594,9 +594,9 @@ WebInspector.CPUProfileType.prototype = {
         this._recording = !this._recording;
 
         if (this._recording)
-            InspectorController.startProfiling();
+            InspectorBackend.startProfiling();
         else
-            InspectorController.stopProfiling();
+            InspectorBackend.stopProfiling();
     },
 
     setRecordingProfile: function(isProfiling)
@@ -616,26 +616,3 @@ WebInspector.CPUProfileType.prototype = {
 }
 
 WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
-
-WebInspector.CPUProfile = function(profile)
-{
-    this.representedObject = profile;
-    this.typeId = WebInspector.CPUProfileType.TypeId;
-}
-
-WebInspector.CPUProfile.prototype = {
-    get title()
-    {
-        return this.representedObject.title;
-    },
-
-    get uid()
-    {
-        return this.representedObject.uid;
-    },
-
-    get head()
-    {
-        return this.representedObject.head;
-    }
-}
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index 74c2bb6..b276ecb 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -210,8 +210,9 @@ WebInspector.ProfilesPanel.prototype = {
         return escape(text) + '/' + escape(profileTypeId);
     },
 
-    addProfileHeader: function(typeId, profile)
+    addProfileHeader: function(profile)
     {
+        var typeId = profile.typeId;
         var profileType = this.getProfileType(typeId);
         var sidebarParent = profileType.treeElement;
         var small = false;
@@ -361,7 +362,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this._profiles[i].viewForProfile();
+            var profile = this._profiles[i];
+            var view = profile.__profilesPanelProfileType.viewForProfile(profile);
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -398,7 +400,7 @@ WebInspector.ProfilesPanel.prototype = {
     _updateInterface: function()
     {
         // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
-        if (InspectorController.profilerEnabled()) {
+        if (InspectorBackend.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             for (var typeId in this._profileTypeButtonsByIdMap)
@@ -417,26 +419,27 @@ WebInspector.ProfilesPanel.prototype = {
 
     _enableProfiling: function()
     {
-        if (InspectorController.profilerEnabled())
+        if (InspectorBackend.profilerEnabled())
             return;
         this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleProfiling: function(optionalAlways)
     {
-        if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler(true);
+        if (InspectorBackend.profilerEnabled())
+            InspectorBackend.disableProfiler(true);
         else
-            InspectorController.enableProfiler(!!optionalAlways);
+            InspectorBackend.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
     {
-        // FIXME: This code needs to be adjusted when more profiling types are added.
-        // Currently defaults to CPU profiles.
-        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
-        if (cpuProfiles.children.length)
-            return;
+        var sidebarTreeChildrenCount = this.sidebarTree.children.length;
+        for (var i = 0; i < sidebarTreeChildrenCount; ++i) {
+            var treeElement = this.sidebarTree.children[i];
+            if (treeElement.children.length)
+                return;
+        }
 
         function populateCallback(profileHeaders) {
             profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
@@ -446,7 +449,7 @@ WebInspector.ProfilesPanel.prototype = {
         }
 
         var callId = WebInspector.Callback.wrap(populateCallback);
-        InspectorController.getProfileHeaders(callId);
+        InspectorBackend.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
diff --git a/WebCore/inspector/front-end/PropertiesSidebarPane.js b/WebCore/inspector/front-end/PropertiesSidebarPane.js
index ec08210..d84874e 100644
--- a/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -36,12 +36,11 @@ WebInspector.PropertiesSidebarPane.prototype = {
     {
         var body = this.bodyElement;
 
-        body.removeChildren();
-
-        this.sections = [];
-
-        if (!node)
+        if (!node) {
+            body.removeChildren();
+            this.sections = [];
             return;
+        }
 
         var self = this;
         var callback = function(prototypes) {
diff --git a/WebCore/inspector/front-end/Resource.js b/WebCore/inspector/front-end/Resource.js
index 56696e3..d23b5da 100644
--- a/WebCore/inspector/front-end/Resource.js
+++ b/WebCore/inspector/front-end/Resource.js
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
+WebInspector.Resource = function(requestHeaders, url, documentURL, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
 {
     this.identifier = identifier;
 
@@ -35,6 +35,7 @@ WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComp
     this.mainResource = mainResource;
     this.requestHeaders = requestHeaders;
     this.url = url;
+    this.documentURL = documentURL;
     this.domain = domain;
     this.path = path;
     this.lastPathComponent = lastPathComponent;
@@ -111,7 +112,8 @@ WebInspector.Resource.Type = {
     Font:       3,
     Script:     4,
     XHR:        5,
-    Other:      6,
+    Media:      6,
+    Other:      7,
 
     isTextType: function(type)
     {
@@ -161,6 +163,18 @@ WebInspector.Resource.prototype = {
         this.dispatchEventToListeners("url changed");
     },
 
+    get documentURL()
+    {
+        return this._documentURL;
+    },
+
+    set documentURL(x)
+    {
+        if (this._documentURL === x)
+            return;
+        this._documentURL = x;
+    },
+
     get domain()
     {
         return this._domain;
@@ -587,7 +601,7 @@ WebInspector.Resource.prototype = {
         if (this.mimeType in WebInspector.MIMETypes)
             return this.type in WebInspector.MIMETypes[this.mimeType];
 
-        return true;
+        return false;
     },
 
     _checkWarnings: function()
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index 2ea7fdb..8175c2f 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -248,7 +248,7 @@ WebInspector.ResourceView.prototype = {
         }
     },
 
-    _toggleURLdecoding: function(treeElement, event)
+    _toggleURLdecoding: function(event)
     {
         this._decodeRequestParameters = !this._decodeRequestParameters;
         this._refreshQueryString();
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index 940570f..60c1895 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -39,6 +39,7 @@ WebInspector.ResourcesPanel = function()
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
 
+    this.createFilterPanel();
     this.createInterface();
 
     this._createStatusbarButtons();
@@ -348,7 +349,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         this.summaryBar.reset();
 
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (InspectorBackend.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             this.largerResourcesButton.visible = true;
@@ -564,8 +565,8 @@ WebInspector.ResourcesPanel.prototype = {
             loadDividerPadding.style.left = percent + "%";
             loadDividerPadding.title = WebInspector.UIString("Load event fired");
             loadDividerPadding.appendChild(loadDivider);
-            
-            this.eventDividersElement.appendChild(loadDividerPadding);
+
+            this.addEventDivider(loadDividerPadding);
         }
         
         if (this.mainResourceDOMContentTime !== -1) {
@@ -579,8 +580,8 @@ WebInspector.ResourcesPanel.prototype = {
             domContentDividerPadding.style.left = percent + "%";
             domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
             domContentDividerPadding.appendChild(domContentDivider);
-            
-            this.eventDividersElement.appendChild(domContentDividerPadding);
+
+            this.addEventDivider(domContentDividerPadding);
         }
     },
 
@@ -615,7 +616,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         this.itemsTreeElement.smallChildren = !this.itemsTreeElement.smallChildren;
         Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
+        InspectorFrontendHost.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.itemsTreeElement.smallChildren) {
             this.itemsGraphsElement.addStyleClass("small");
@@ -674,27 +675,27 @@ WebInspector.ResourcesPanel.prototype = {
 
     _enableResourceTracking: function()
     {
-        if (InspectorController.resourceTrackingEnabled())
+        if (InspectorBackend.resourceTrackingEnabled())
             return;
         this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
     },
 
     _toggleResourceTracking: function(optionalAlways)
     {
-        if (InspectorController.resourceTrackingEnabled()) {
+        if (InspectorBackend.resourceTrackingEnabled()) {
             this.largerResourcesButton.visible = false;
             this.sortingSelectElement.visible = false;
-            InspectorController.disableResourceTracking(true);
+            InspectorBackend.disableResourceTracking(true);
         } else {
             this.largerResourcesButton.visible = true;
             this.sortingSelectElement.visible = true;
-            InspectorController.enableResourceTracking(!!optionalAlways);
+            InspectorBackend.enableResourceTracking(!!optionalAlways);
         }
     },
 
     get _resources()
     {
-        return this._items;
+        return this.items;
     }
 }
 
@@ -958,6 +959,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // FIXME: should actually add handler to parent, to be resolved via
         // https://bugs.webkit.org/show_bug.cgi?id=30227
         this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
+        this.updateErrorsAndWarnings();
     },
 
     onselect: function()
@@ -965,7 +967,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         WebInspector.panels.resources.showResource(this.resource);
     },
     
-    ondblclick: function(treeElement, event)
+    ondblclick: function(event)
     {
         InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
@@ -1041,6 +1043,8 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
 
             this.createIconElement();
         }
+
+        this.tooltip = this.resource.url;
     },
 
     resetBubble: function()
diff --git a/WebCore/inspector/front-end/ScriptView.js b/WebCore/inspector/front-end/ScriptView.js
index 124190c..38157ac 100644
--- a/WebCore/inspector/front-end/ScriptView.js
+++ b/WebCore/inspector/front-end/ScriptView.js
@@ -59,7 +59,7 @@ WebInspector.ScriptView.prototype = {
 
         this.attach();
 
-        if (!InspectorController.addSourceToFrame("text/javascript", this.script.source, this.sourceFrame.element))
+        if (!InspectorFrontendHost.addSourceToFrame("text/javascript", this.script.source, this.sourceFrame.element))
             return;
 
         delete this._frameNeedsSetup;
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 4aa0ab2..8b31a8b 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -161,36 +161,35 @@ WebInspector.ScriptsPanel = function()
     this._breakpointsURLMap = {};
 
     this._shortcuts = {};
-
-    var isMac = InspectorController.platform().indexOf("mac-") === 0;
-    var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
+    var handler, shortcut;
+    var platformSpecificModifier = WebInspector.isMac() ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
 
     // Continue.
-    var handler = this.pauseButton.click.bind(this.pauseButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
+    handler = this.pauseButton.click.bind(this.pauseButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F8);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Slash, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step over.
-    var handler = this.stepOverButton.click.bind(this.stepOverButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
+    handler = this.stepOverButton.click.bind(this.stepOverButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F10);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.SingleQuote, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step into.
-    var handler = this.stepIntoButton.click.bind(this.stepIntoButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
+    handler = this.stepIntoButton.click.bind(this.stepIntoButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     // Step out.
-    var handler = this.stepOutButton.click.bind(this.stepOutButton);
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
+    handler = this.stepOutButton.click.bind(this.stepOutButton);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.F11, WebInspector.KeyboardShortcut.Modifiers.Shift);
     this._shortcuts[shortcut] = handler;
-    var shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
+    shortcut = WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.KeyCodes.Semicolon, WebInspector.KeyboardShortcut.Modifiers.Shift, platformSpecificModifier);
     this._shortcuts[shortcut] = handler;
 
     this.reset();
@@ -236,7 +235,7 @@ WebInspector.ScriptsPanel.prototype = {
             view.visible = false;
         }
         if (this._attachDebuggerWhenShown) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
             delete this._attachDebuggerWhenShown;
         }
     },
@@ -276,22 +275,29 @@ WebInspector.ScriptsPanel.prototype = {
             resource.addScript(script);
         }
 
+        sourceURL = script.sourceURL;
+
+        if (sourceID)
+            this._sourceIDMap[sourceID] = (resource || script);
+
         if (sourceURL in this._breakpointsURLMap && sourceID) {
             var breakpoints = this._breakpointsURLMap[sourceURL];
             var breakpointsLength = breakpoints.length;
             for (var i = 0; i < breakpointsLength; ++i) {
                 var breakpoint = breakpoints[i];
+
                 if (startingLine <= breakpoint.line) {
+                    // remove and add the breakpoint, to clean up things like the sidebar
+                    this.removeBreakpoint(breakpoint);
                     breakpoint.sourceID = sourceID;
+                    this.addBreakpoint(breakpoint);
+                    
                     if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
+                        InspectorBackend.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
                 }
             }
         }
 
-        if (sourceID)
-            this._sourceIDMap[sourceID] = (resource || script);
-
         this._addScriptToFilesMenu(script);
     },
 
@@ -415,7 +421,7 @@ WebInspector.ScriptsPanel.prototype = {
     attachDebuggerWhenShown: function()
     {
         if (this.element.parentElement) {
-            InspectorController.enableDebugger(false);
+            InspectorBackend.enableDebugger(false);
         } else {
             this._attachDebuggerWhenShown = true;
         }
@@ -438,7 +444,7 @@ WebInspector.ScriptsPanel.prototype = {
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (!InspectorController.debuggerEnabled()) {
+        if (!InspectorBackend.debuggerEnabled()) {
             this._paused = false;
             this._waitingToPause = false;
             this._stepping = false;
@@ -489,17 +495,17 @@ WebInspector.ScriptsPanel.prototype = {
 
     canShowResource: function(resource)
     {
-        return resource && resource.scripts.length && InspectorController.debuggerEnabled();
+        return resource && resource.scripts.length && InspectorBackend.debuggerEnabled();
     },
 
     showScript: function(script, line)
     {
-        this._showScriptOrResource(script, line, true);
+        this._showScriptOrResource(script, {line: line, shouldHighlightLine: true});
     },
 
     showResource: function(resource, line)
     {
-        this._showScriptOrResource(resource, line, true);
+        this._showScriptOrResource(resource, {line: line, shouldHighlightLine: true});
     },
 
     showView: function(view)
@@ -567,8 +573,12 @@ WebInspector.ScriptsPanel.prototype = {
             return this.sourceFrameForScript(scriptOrResource);
     },
 
-    _showScriptOrResource: function(scriptOrResource, line, shouldHighlightLine, fromBackForwardAction)
+    _showScriptOrResource: function(scriptOrResource, options)
     {
+        // options = {line:, shouldHighlightLine:, fromBackForwardAction:, initialLoad:}
+        if (!options) 
+            options = {};
+
         if (!scriptOrResource)
             return;
 
@@ -594,7 +604,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (!view)
             return;
 
-        if (!fromBackForwardAction) {
+        var url = scriptOrResource.url || scriptOrResource.sourceURL;
+        if (url && !options.initialLoad)
+            InspectorFrontendHost.setSetting("LastViewedScriptFile", url);
+
+        if (!options.fromBackForwardAction) {
             var oldIndex = this._currentBackForwardIndex;
             if (oldIndex >= 0)
                 this._backForwardList.splice(oldIndex + 1, this._backForwardList.length - oldIndex);
@@ -615,19 +629,26 @@ WebInspector.ScriptsPanel.prototype = {
 
         this.visibleView = view;
 
-        if (line) {
+        if (options.line) {
             if (view.revealLine)
-                view.revealLine(line);
-            if (view.highlightLine && shouldHighlightLine)
-                view.highlightLine(line);
+                view.revealLine(options.line);
+            if (view.highlightLine && options.shouldHighlightLine)
+                view.highlightLine(options.line);
         }
 
         var option;
         if (scriptOrResource instanceof WebInspector.Script) {
             option = scriptOrResource.filesSelectOption;
+
+            // hasn't been added yet - happens for stepping in evals,
+            // so use the force option to force the script into the menu.
+            if (!option) {
+                this._addScriptToFilesMenu(scriptOrResource, {force: true});
+                option = scriptOrResource.filesSelectOption;
+            }
+
             console.assert(option);
         } else {
-            var url = scriptOrResource.url;
             var script = this._scriptsForURLsInFilesSelect[url];
             if (script)
                option = script.filesSelectOption;
@@ -637,8 +658,13 @@ WebInspector.ScriptsPanel.prototype = {
             this.filesSelectElement.selectedIndex = option.index;
     },
 
-    _addScriptToFilesMenu: function(script)
+    _addScriptToFilesMenu: function(script, options)
     {
+        var force = options && options.force;
+
+        if (!script.sourceURL && !force)
+            return;
+
         if (script.resource && this._scriptsForURLsInFilesSelect[script.sourceURL])
             return;
 
@@ -679,7 +705,14 @@ WebInspector.ScriptsPanel.prototype = {
         // Call _showScriptOrResource if the option we just appended ended up being selected.
         // This will happen for the first item added to the menu.
         if (select.options[select.selectedIndex] === option)
-            this._showScriptOrResource(option.representedObject);
+            this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        else {
+            // if not first item, check to see if this was the last viewed
+            var url = option.representedObject.url || option.representedObject.sourceURL;
+            var lastURL = InspectorFrontendHost.setting("LastViewedScriptFile");
+            if (url && url === lastURL)
+                this._showScriptOrResource(option.representedObject, {initialLoad: true});
+        }
     },
 
     _clearCurrentExecutionLine: function()
@@ -702,7 +735,7 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
-        this._showScriptOrResource(scriptOrResource, currentFrame.line);
+        this._showScriptOrResource(scriptOrResource, {line: currentFrame.line});
 
         this._executionSourceFrame = this._sourceFrameForScriptOrResource(scriptOrResource);
         if (this._executionSourceFrame)
@@ -748,7 +781,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _updatePauseOnExceptionsButton: function()
     {
-        if (InspectorController.pauseOnExceptions()) {
+        if (InspectorBackend.pauseOnExceptions()) {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
             this.pauseOnExceptionButton.toggled = true;
         } else {
@@ -759,7 +792,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _updateDebuggerButtons: function()
     {
-        if (InspectorController.debuggerEnabled()) {
+        if (InspectorBackend.debuggerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
             this.pauseOnExceptionButton.visible = true;
@@ -821,7 +854,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[--this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
@@ -832,13 +865,13 @@ WebInspector.ScriptsPanel.prototype = {
             return;
         }
 
-        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], null, false, true);
+        this._showScriptOrResource(this._backForwardList[++this._currentBackForwardIndex], {fromBackForwardAction: true});
         this._updateBackAndForwardButtons();
     },
 
     _enableDebugging: function()
     {
-        if (InspectorController.debuggerEnabled())
+        if (InspectorBackend.debuggerEnabled())
             return;
         this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
@@ -849,15 +882,15 @@ WebInspector.ScriptsPanel.prototype = {
         this._waitingToPause = false;
         this._stepping = false;
 
-        if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger(true);
+        if (InspectorBackend.debuggerEnabled())
+            InspectorBackend.disableDebugger(true);
         else
-            InspectorController.enableDebugger(!!optionalAlways);
+            InspectorBackend.enableDebugger(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
     {
-        InspectorController.setPauseOnExceptions(!InspectorController.pauseOnExceptions());
+        InspectorBackend.setPauseOnExceptions(!InspectorBackend.pauseOnExceptions());
         this._updatePauseOnExceptionsButton();
     },
 
@@ -866,11 +899,11 @@ WebInspector.ScriptsPanel.prototype = {
         if (this._paused) {
             this._paused = false;
             this._waitingToPause = false;
-            InspectorController.resumeDebugger();
+            InspectorBackend.resumeDebugger();
         } else {
             this._stepping = false;
             this._waitingToPause = true;
-            InspectorController.pauseInDebugger();
+            InspectorBackend.pauseInDebugger();
         }
 
         this._clearInterface();
@@ -883,7 +916,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOverStatementInDebugger();
+        InspectorBackend.stepOverStatementInDebugger();
     },
 
     _stepIntoClicked: function()
@@ -893,7 +926,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepIntoStatementInDebugger();
+        InspectorBackend.stepIntoStatementInDebugger();
     },
 
     _stepOutClicked: function()
@@ -903,7 +936,7 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._clearInterface();
 
-        InspectorController.stepOutOfFunctionInDebugger();
+        InspectorBackend.stepOutOfFunctionInDebugger();
     }
 }
 
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 1c11f76..b5cf4c0 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -207,12 +207,11 @@ WebInspector.SourceFrame.prototype = {
         this.element.contentDocument.addEventListener("webkitAnimationEnd", this._highlightLineEnds.bind(this), false);
 
         // Register 'eval' shortcut.
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
-        var platformSpecificModifier = isMac ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
+        var platformSpecificModifier = WebInspector.isMac() ? WebInspector.KeyboardShortcut.Modifiers.Meta : WebInspector.KeyboardShortcut.Modifiers.Ctrl;
         var shortcut = WebInspector.KeyboardShortcut.makeKey(69 /* 'E' */, platformSpecificModifier | WebInspector.KeyboardShortcut.Modifiers.Shift);
         this._shortcuts[shortcut] = this._evalSelectionInCallFrame.bind(this);
 
-        var headElement = this.element.contentDocument.getElementsByTagName("head")[0];
+        var headElement = this.element.contentDocument.head;
         if (!headElement) {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
@@ -264,6 +263,7 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.removeChildren = Element.prototype.removeChildren;
         this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
         this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
@@ -336,6 +336,8 @@ WebInspector.SourceFrame.prototype = {
             WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
         else if (this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+
+        event.preventDefault();
     },
 
     _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
@@ -729,20 +731,20 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighlighter(table, this);
         cssSyntaxHighlighter.process();
     }
 }
 
 WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+WebInspector.SourceSyntaxHighlighter = function(table, sourceFrame)
 {
     this.table = table;
     this.sourceFrame = sourceFrame;
 }
 
-WebInspector.SourceSyntaxHighligher.prototype = {
+WebInspector.SourceSyntaxHighlighter.prototype = {
     createSpan: function(content, className)
     {
         var span = document.createElement("span");
@@ -751,234 +753,1089 @@ WebInspector.SourceSyntaxHighligher.prototype = {
         return span;
     },
 
-    generateFinder: function(regex, matchNumber, className)
-    {
-        return function(str) {
-            var match = regex.exec(str);
-            if (!match)
-                return null;
-            this.previousMatchLength = match[matchNumber].length;
-            return this.createSpan(match[matchNumber], className);
-        };
-    },
-
     process: function()
     {
         // Split up the work into chunks so we don't block the
         // UI thread while processing.
 
-        var i = 0;
         var rows = this.table.rows;
         var rowsLength = rows.length;
-        var previousCell = null;
-        const linesPerChunk = 10;
-
+        const tokensPerChunk = 100;
+        const lineLengthLimit = 20000;
+        
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+        
         function processChunk()
         {
-            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                this.syntaxHighlightLine(cell, previousCell);
-                if (i < (end - 1))
-                    this.deleteContinueFlags(previousCell);
-                previousCell = cell;
-            }
+            for (var i = 0; i < tokensPerChunk; i++) {
+                if (this.cursor >= this.lineCode.length)
+                    moveToNextLine.call(this);
+                if (this.lineIndex >= rowsLength) {
+                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                    return;
+                }
+                if (this.cursor > lineLengthLimit) {
+                    var codeFragment = this.lineCode.substring(this.cursor);
+                    this.nonToken += codeFragment;
+                    this.cursor += codeFragment.length;
+                }
 
-            if (i >= rowsLength && processChunkInterval) {
-                this.deleteContinueFlags(previousCell);
-                delete this.previousMatchLength;
+                this.lex();
+            }
+        }
+        
+        function moveToNextLine()
+        {
+            this.appendNonToken();
+            
+            var row = rows[this.lineIndex];
+            var line = row ? row.cells[1] : null;
+            if (line && this.newLine) {
+                line.removeChildren();
+                
+                if (this.messageBubble)
+                    this.newLine.appendChild(this.messageBubble);
+                
+                line.parentNode.insertBefore(this.newLine, line);
+                line.parentNode.removeChild(line);
+                
+                this.newLine = null;
+            }
+            this.lineIndex++;
+            if (this.lineIndex >= rowsLength && processChunkInterval) {
                 clearInterval(processChunkInterval);
-
                 this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                return;
+            }
+            row = rows[this.lineIndex];
+            line = row ? row.cells[1] : null;
+            
+            this.messageBubble = null;
+            if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
+                this.messageBubble = line.lastChild;
+                line.removeChild(this.messageBubble);
             }
-        }
-
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-    }
-}
-
-WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
-
-    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
-    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
-    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
-    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
-    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
-    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
-    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
-    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
-    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
-    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
-}
 
-WebInspector.CSSSourceSyntaxHighligher.prototype = {
-    deleteContinueFlags: function(cell)
-    {
-        if (!cell)
-            return;
-        delete cell._commentContinues;
-        delete cell._inSelector;
+            this.lineCode = line.textContent;
+            this.newLine = line.cloneNode(false);
+            this.cursor = 0;
+            if (!line)
+                moveToNextLine();
+        }
     },
-
-    findPseudoClass: function(str)
+    
+    lex: function()
     {
-        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var span = document.createElement("span");
-        span.appendChild(document.createTextNode(match[1]));
-        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
-        return span;
-    },
-
-    findURL: function(str)
-    {
-        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
-        var outerSpan = document.createElement("span");
-        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
-        outerSpan.appendChild(document.createTextNode("("));
-        outerSpan.appendChild(innerUrlSpan);
-        outerSpan.appendChild(document.createTextNode(")"));
-        return outerSpan;
+        var token = null;
+        var codeFragment = this.lineCode.substring(this.cursor);
+        
+        for (var i = 0; i < this.rules.length; i++) {
+            var rule = this.rules[i];
+            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
+            if (this.continueState === ruleContinueStateCondition) {
+                if (typeof rule.lexStateCondition !== "undefined" && this.lexState !== rule.lexStateCondition)
+                    continue;
+                var match = rule.pattern.exec(codeFragment);
+                if (match) {
+                    token = match[0];
+                    if (token) {
+                        if (!rule.dontAppendNonToken)
+                            this.appendNonToken();
+                        return rule.action.call(this, token);
+                    }
+                }
+            }
+        }
+        this.nonToken += codeFragment[0];
+        this.cursor++;
     },
-
-    findAtRule: function(str)
+    
+    appendNonToken: function ()
     {
-        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
-        if (!match)
-            return null;
-        this.previousMatchLength = match[0].length;
-        return this.createSpan(match[0], "webkit-css-at-rule");
+        if (this.nonToken.length > 0) {
+            this.newLine.appendChild(document.createTextNode(this.nonToken));
+            this.nonToken = "";
+        }
     },
-
-    syntaxHighlightLine: function(line, prevLine)
+    
+    syntaxHighlightNode: function(node)
     {
-        var code = line.textContent;
-        while (line.firstChild)
-            line.removeChild(line.firstChild);
-
-        var token;
-        var tmp = 0;
-        var i = 0;
-        this.previousMatchLength = 0;
-
-        if (prevLine) {
-            if (prevLine._commentContinues) {
-                if (!(token = this.findMultilineCommentEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-comment");
-                    line._commentContinues = true;
-                }
-            }
-            if (token) {
-                i += this.previousMatchLength ? this.previousMatchLength : code.length;
-                tmp = i;
-                line.appendChild(token);
+        this.lineCode = node.textContent;
+        node.removeChildren();
+        this.newLine = node;
+        this.cursor = 0;
+        while (true) {
+            if (this.cursor >= this.lineCode.length) {
+                var codeFragment = this.lineCode.substring(this.cursor);
+                this.nonToken += codeFragment;
+                this.cursor += codeFragment.length;
+                this.appendNonToken();
+                this.newLine = null;
+                return;
             }
-        }
 
-        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
-        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
-        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
-        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
-
-        for ( ; i < code.length; ++i) {
-            var codeFragment = code.substr(i);
-            var prevChar = code[i - 1];
-            var currChar = codeFragment[0];
-            token = this.findSingleLineComment(codeFragment);
-            if (!token) {
-                if ((token = this.findMultilineCommentStart(codeFragment)))
-                    line._commentContinues = true;
-                else if (currChar === ";" && !inAtRuleBlock)
-                    atRuleStarted = false;
-                else if (currChar === "}") {
-                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
-                        inSelector = false;
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    } else if (inSelector) {
-                        inSelector = false;
-                    } else if (inAtRuleBlock) {
-                        inAtRuleBlock = false;
-                        atRuleStarted = false;
-                    }
-                } else if (currChar === "{") {
-                    if (!atRuleStarted || inAtRuleBlock) {
-                        inSelector = true;
-                    } else if (!inAtRuleBlock && atRuleIsSelector) {
-                        inAtRuleBlock = true;
-                        inSelector = true;
-                    } else if (!inAtRuleBlock) {
-                        inAtRuleBlock = true;
-                        inSelector = false;
-                    }
-                } else if (inSelector) {
-                    if (!prevChar || /^\d/.test(prevChar)) {
-                        token = this.findUnits(codeFragment);
-                    } else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = this.findNumber(codeFragment) ||
-                                this.findKeyword(codeFragment) ||
-                                this.findURL(codeFragment) ||
-                                this.findProperty(codeFragment) ||
-                                this.findAtRule(codeFragment) ||
-                                this.findGenericIdent(codeFragment) ||
-                                this.findSingleLineString(codeFragment);
-                    }
-                } else if (!inSelector) {
-                    if (atRuleStarted && !inAtRuleBlock)
-                        token = this.findURL(codeFragment); // for @import
-                    if (!token) {
-                        token = this.findSelector(codeFragment) ||
-                                this.findPseudoClass(codeFragment) ||
-                                this.findAtRule(codeFragment);
-                    }
-                }
-            }
+            this.lex();
+        }
+    }
+}
 
-            if (token) {
-                if (currChar === "@") {
-                    atRuleStarted = true;
+WebInspector.CSSSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighlighter.call(this, table, sourceFrame);
 
-                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
-                    // instead it acts as a selector and contains properties and values.
-                    var text = token.textContent;
-                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
-                }
+    this.LexState = {
+        Initial: 1,
+        DeclarationProperty: 2,
+        DeclarationValue: 3,
+        AtMedia: 4,
+        AtRule: 5,
+        AtKeyframes: 6
+    };
+    this.ContinueState = {
+        None: 0,
+        Comment: 1
+    };
+    
+    this.nonToken = "";
+    this.cursor = 0;
+    this.lineIndex = -1;
+    this.lineCode = "";
+    this.newLine = null;
+    this.lexState = this.LexState.Initial;
+    this.continueState = this.ContinueState.None;
+    
+    const urlPattern = /^url\(\s*(?:(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*')|(?:[!#$%&*-~\w]|(?:\\[\da-f]{1,6}\s?|\.))*)\s*\)/i;
+    const stringPattern = /^(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*')/i;
+    const identPattern = /^-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*/i;
+    const startBlockPattern = /^{/i;
+    const endBlockPattern = /^}/i;
+    this.rules = [{
+        pattern: /^\/\*[^\*]*\*+([^\/*][^*]*\*+)*\//i,
+        action: commentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/i,
+        action: commentStartAction
+    }, {
+        pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/i,
+        action: commentEndAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^.*/i,
+        action: commentMiddleAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^(?:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\*)(?:#-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\.-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\[\s*-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*(?:(?:=|~=|\|=)\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*'))\s*)?\]|:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\(\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*)?\)))*|(?:#-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\.-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|\[\s*-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*(?:(?:=|~=|\|=)\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|(?:"(?:[^\\\"]|(?:\\[\da-f]{1,6}\s?|\.))*"|'(?:[^\\\']|(?:\\[\da-f]{1,6}\s?|\.))*'))\s*)?\]|:(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*|-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\(\s*(?:-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*\s*)?\)))+)/i,
+        action: selectorAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startRulesetBlockAction,
+        lexStateCondition: this.LexState.Initial,
+        dontAppendNonToken: true
+    }, {
+        pattern: identPattern,
+        action: propertyAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^:/i,
+        action: declarationColonAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:#(?:[\da-f]{6}|[\da-f]{3})|rgba\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|hsla\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|rgb\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\)|hsl\(\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*,\s*(?:\d+|\d*\.\d+)%?\s*\))/i,
+        action: colorAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: /^(?:-?(?:\d+|\d*\.\d+)(?:em|rem|__qem|ex|px|cm|mm|in|pt|pc|deg|rad|grad|turn|ms|s|Hz|kHz|%)?)/i,
+        action: numvalueAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: urlPattern,
+        action: urlAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: /^!\s*important/i,
+        action: importantAction,
+        lexStateCondition: this.LexState.DeclarationValue
+    }, {
+        pattern: identPattern,
+        action: valueIdentAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^;/i,
+        action: declarationSemicolonAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: endBlockPattern,
+        action: endRulesetBlockAction,
+        lexStateCondition: this.LexState.DeclarationProperty,
+        dontAppendNonToken: true
+    }, {
+        pattern: endBlockPattern,
+        action: endRulesetBlockAction,
+        lexStateCondition: this.LexState.DeclarationValue,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@media/i,
+        action: atMediaAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startAtMediaBlockAction,
+        lexStateCondition: this.LexState.AtMedia,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@-webkit-keyframes/i,
+        action: atKeyframesAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: startBlockPattern,
+        action: startAtMediaBlockAction,
+        lexStateCondition: this.LexState.AtKeyframes,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^@-?(?:\w|(?:\\[\da-f]{1,6}\s?|\.))(?:[-\w]|(?:\\[\da-f]{1,6}\s?|\.))*/i,
+        action: atRuleAction,
+        lexStateCondition: this.LexState.Initial
+    }, {
+        pattern: /^;/i,
+        action: endAtRuleAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: urlPattern,
+        action: urlAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.AtRule
+    }, {
+        pattern: stringPattern,
+        action: stringAction,
+        lexStateCondition: this.LexState.AtKeyframes
+    }, {
+        pattern: identPattern,
+        action: atRuleIdentAction,
+        lexStateCondition: this.LexState.AtRule,
+        dontAppendNonToken: true
+    }, {
+        pattern: identPattern,
+        action: atRuleIdentAction,
+        lexStateCondition: this.LexState.AtMedia,
+        dontAppendNonToken: true
+    }, {
+        pattern: startBlockPattern,
+        action: startAtRuleBlockAction,
+        lexStateCondition: this.LexState.AtRule,
+        dontAppendNonToken: true
+    }];
+    
+    function commentAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+    }
+    
+    function commentStartAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+        this.continueState = this.ContinueState.Comment;
+    }
+    
+    function commentEndAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+        this.continueState = this.ContinueState.None;
+    }
 
-                if (tmp !== i)
-                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                line.appendChild(token);
-                i += this.previousMatchLength - 1;
-                tmp = i + 1;
-            }
-        }
+    function commentMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-comment"));
+    }
+    
+    function selectorAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-selector"));
+    }
+    
+    function startRulesetBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    function endRulesetBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    const propertyKeywords = {
+        "background": true,
+        "background-attachment": true,
+        "background-clip": true,
+        "background-color": true,
+        "background-image": true,
+        "background-origin": true,
+        "background-position": true,
+        "background-position-x": true,
+        "background-position-y": true,
+        "background-repeat": true,
+        "background-repeat-x": true,
+        "background-repeat-y": true,
+        "background-size": true,
+        "border": true,
+        "border-bottom": true,
+        "border-bottom-color": true,
+        "border-bottom-left-radius": true,
+        "border-bottom-right-radius": true,
+        "border-bottom-style": true,
+        "border-bottom-width": true,
+        "border-collapse": true,
+        "border-color": true,
+        "border-left": true,
+        "border-left-color": true,
+        "border-left-style": true,
+        "border-left-width": true,
+        "border-radius": true,
+        "border-right": true,
+        "border-right-color": true,
+        "border-right-style": true,
+        "border-right-width": true,
+        "border-spacing": true,
+        "border-style": true,
+        "border-top": true,
+        "border-top-color": true,
+        "border-top-left-radius": true,
+        "border-top-right-radius": true,
+        "border-top-style": true,
+        "border-top-width": true,
+        "border-width": true,
+        "bottom": true,
+        "caption-side": true,
+        "clear": true,
+        "clip": true,
+        "color": true,
+        "content": true,
+        "counter-increment": true,
+        "counter-reset": true,
+        "cursor": true,
+        "direction": true,
+        "display": true,
+        "empty-cells": true,
+        "float": true,
+        "font": true,
+        "font-family": true,
+        "font-size": true,
+        "font-stretch": true,
+        "font-style": true,
+        "font-variant": true,
+        "font-weight": true,
+        "height": true,
+        "left": true,
+        "letter-spacing": true,
+        "line-height": true,
+        "list-style": true,
+        "list-style-image": true,
+        "list-style-position": true,
+        "list-style-type": true,
+        "margin": true,
+        "margin-bottom": true,
+        "margin-left": true,
+        "margin-right": true,
+        "margin-top": true,
+        "max-height": true,
+        "max-width": true,
+        "min-height": true,
+        "min-width": true,
+        "opacity": true,
+        "orphans": true,
+        "outline": true,
+        "outline-color": true,
+        "outline-offset": true,
+        "outline-style": true,
+        "outline-width": true,
+        "overflow": true,
+        "overflow-x": true,
+        "overflow-y": true,
+        "padding": true,
+        "padding-bottom": true,
+        "padding-left": true,
+        "padding-right": true,
+        "padding-top": true,
+        "page": true,
+        "page-break-after": true,
+        "page-break-before": true,
+        "page-break-inside": true,
+        "pointer-events": true,
+        "position": true,
+        "quotes": true,
+        "resize": true,
+        "right": true,
+        "size": true,
+        "src": true,
+        "table-layout": true,
+        "text-align": true,
+        "text-decoration": true,
+        "text-indent": true,
+        "text-line-through": true,
+        "text-line-through-color": true,
+        "text-line-through-mode": true,
+        "text-line-through-style": true,
+        "text-line-through-width": true,
+        "text-overflow": true,
+        "text-overline": true,
+        "text-overline-color": true,
+        "text-overline-mode": true,
+        "text-overline-style": true,
+        "text-overline-width": true,
+        "text-rendering": true,
+        "text-shadow": true,
+        "text-transform": true,
+        "text-underline": true,
+        "text-underline-color": true,
+        "text-underline-mode": true,
+        "text-underline-style": true,
+        "text-underline-width": true,
+        "top": true,
+        "unicode-bidi": true,
+        "unicode-range": true,
+        "vertical-align": true,
+        "visibility": true,
+        "white-space": true,
+        "widows": true,
+        "width": true,
+        "word-break": true,
+        "word-spacing": true,
+        "word-wrap": true,
+        "z-index": true,
+        "zoom": true,
+        "-webkit-animation": true,
+        "-webkit-animation-delay": true,
+        "-webkit-animation-direction": true,
+        "-webkit-animation-duration": true,
+        "-webkit-animation-iteration-count": true,
+        "-webkit-animation-name": true,
+        "-webkit-animation-play-state": true,
+        "-webkit-animation-timing-function": true,
+        "-webkit-appearance": true,
+        "-webkit-backface-visibility": true,
+        "-webkit-background-clip": true,
+        "-webkit-background-composite": true,
+        "-webkit-background-origin": true,
+        "-webkit-background-size": true,
+        "-webkit-binding": true,
+        "-webkit-border-fit": true,
+        "-webkit-border-horizontal-spacing": true,
+        "-webkit-border-image": true,
+        "-webkit-border-radius": true,
+        "-webkit-border-vertical-spacing": true,
+        "-webkit-box-align": true,
+        "-webkit-box-direction": true,
+        "-webkit-box-flex": true,
+        "-webkit-box-flex-group": true,
+        "-webkit-box-lines": true,
+        "-webkit-box-ordinal-group": true,
+        "-webkit-box-orient": true,
+        "-webkit-box-pack": true,
+        "-webkit-box-reflect": true,
+        "-webkit-box-shadow": true,
+        "-webkit-box-sizing": true,
+        "-webkit-column-break-after": true,
+        "-webkit-column-break-before": true,
+        "-webkit-column-break-inside": true,
+        "-webkit-column-count": true,
+        "-webkit-column-gap": true,
+        "-webkit-column-rule": true,
+        "-webkit-column-rule-color": true,
+        "-webkit-column-rule-style": true,
+        "-webkit-column-rule-width": true,
+        "-webkit-column-width": true,
+        "-webkit-columns": true,
+        "-webkit-font-size-delta": true,
+        "-webkit-font-smoothing": true,
+        "-webkit-highlight": true,
+        "-webkit-line-break": true,
+        "-webkit-line-clamp": true,
+        "-webkit-margin-bottom-collapse": true,
+        "-webkit-margin-collapse": true,
+        "-webkit-margin-start": true,
+        "-webkit-margin-top-collapse": true,
+        "-webkit-marquee": true,
+        "-webkit-marquee-direction": true,
+        "-webkit-marquee-increment": true,
+        "-webkit-marquee-repetition": true,
+        "-webkit-marquee-speed": true,
+        "-webkit-marquee-style": true,
+        "-webkit-mask": true,
+        "-webkit-mask-attachment": true,
+        "-webkit-mask-box-image": true,
+        "-webkit-mask-clip": true,
+        "-webkit-mask-composite": true,
+        "-webkit-mask-image": true,
+        "-webkit-mask-origin": true,
+        "-webkit-mask-position": true,
+        "-webkit-mask-position-x": true,
+        "-webkit-mask-position-y": true,
+        "-webkit-mask-repeat": true,
+        "-webkit-mask-repeat-x": true,
+        "-webkit-mask-repeat-y": true,
+        "-webkit-mask-size": true,
+        "-webkit-match-nearest-mail-blockquote-color": true,
+        "-webkit-nbsp-mode": true,
+        "-webkit-padding-start": true,
+        "-webkit-perspective": true,
+        "-webkit-perspective-origin": true,
+        "-webkit-perspective-origin-x": true,
+        "-webkit-perspective-origin-y": true,
+        "-webkit-rtl-ordering": true,
+        "-webkit-text-decorations-in-effect": true,
+        "-webkit-text-fill-color": true,
+        "-webkit-text-security": true,
+        "-webkit-text-size-adjust": true,
+        "-webkit-text-stroke": true,
+        "-webkit-text-stroke-color": true,
+        "-webkit-text-stroke-width": true,
+        "-webkit-transform": true,
+        "-webkit-transform-origin": true,
+        "-webkit-transform-origin-x": true,
+        "-webkit-transform-origin-y": true,
+        "-webkit-transform-origin-z": true,
+        "-webkit-transform-style": true,
+        "-webkit-transition": true,
+        "-webkit-transition-delay": true,
+        "-webkit-transition-duration": true,
+        "-webkit-transition-property": true,
+        "-webkit-transition-timing-function": true,
+        "-webkit-user-drag": true,
+        "-webkit-user-modify": true,
+        "-webkit-user-select": true,
+        "-webkit-variable-declaration-block": true
+    };
+    function propertyAction(token)
+    {
+        this.cursor += token.length;
+        if (token in propertyKeywords) {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-property"));
+        } else
+            this.nonToken += token;
+    }
+    
+    function declarationColonAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationValue;
+    }
 
-        line._inSelector = inSelector;
-        line._inAtRuleBlock = inAtRuleBlock;
-        line._atRuleStarted = atRuleStarted;
-        line._atRuleIsSelector = atRuleIsSelector;
+    const valueKeywords = {
+        "inherit": true,
+        "initial": true,
+        "none": true,
+        "hidden": true,
+        "inset": true,
+        "groove": true,
+        "ridge": true,
+        "outset": true,
+        "dotted": true,
+        "dashed": true,
+        "solid": true,
+        "double": true,
+        "caption": true,
+        "icon": true,
+        "menu": true,
+        "message-box": true,
+        "small-caption": true,
+        "-webkit-mini-control": true,
+        "-webkit-small-control": true,
+        "-webkit-control": true,
+        "status-bar": true,
+        "italic": true,
+        "oblique": true,
+        "all": true,
+        "small-caps": true,
+        "normal": true,
+        "bold": true,
+        "bolder": true,
+        "lighter": true,
+        "xx-small": true,
+        "x-small": true,
+        "small": true,
+        "medium": true,
+        "large": true,
+        "x-large": true,
+        "xx-large": true,
+        "-webkit-xxx-large": true,
+        "smaller": true,
+        "larger": true,
+        "wider": true,
+        "narrower": true,
+        "ultra-condensed": true,
+        "extra-condensed": true,
+        "condensed": true,
+        "semi-condensed": true,
+        "semi-expanded": true,
+        "expanded": true,
+        "extra-expanded": true,
+        "ultra-expanded": true,
+        "serif": true,
+        "sans-serif": true,
+        "cursive": true,
+        "fantasy": true,
+        "monospace": true,
+        "-webkit-body": true,
+        "aqua": true,
+        "black": true,
+        "blue": true,
+        "fuchsia": true,
+        "gray": true,
+        "green": true,
+        "lime": true,
+        "maroon": true,
+        "navy": true,
+        "olive": true,
+        "orange": true,
+        "purple": true,
+        "red": true,
+        "silver": true,
+        "teal": true,
+        "white": true,
+        "yellow": true,
+        "transparent": true,
+        "-webkit-link": true,
+        "-webkit-activelink": true,
+        "activeborder": true,
+        "activecaption": true,
+        "appworkspace": true,
+        "background": true,
+        "buttonface": true,
+        "buttonhighlight": true,
+        "buttonshadow": true,
+        "buttontext": true,
+        "captiontext": true,
+        "graytext": true,
+        "highlight": true,
+        "highlighttext": true,
+        "inactiveborder": true,
+        "inactivecaption": true,
+        "inactivecaptiontext": true,
+        "infobackground": true,
+        "infotext": true,
+        "match": true,
+        "menutext": true,
+        "scrollbar": true,
+        "threeddarkshadow": true,
+        "threedface": true,
+        "threedhighlight": true,
+        "threedlightshadow": true,
+        "threedshadow": true,
+        "window": true,
+        "windowframe": true,
+        "windowtext": true,
+        "-webkit-focus-ring-color": true,
+        "currentcolor": true,
+        "grey": true,
+        "-webkit-text": true,
+        "repeat": true,
+        "repeat-x": true,
+        "repeat-y": true,
+        "no-repeat": true,
+        "clear": true,
+        "copy": true,
+        "source-over": true,
+        "source-in": true,
+        "source-out": true,
+        "source-atop": true,
+        "destination-over": true,
+        "destination-in": true,
+        "destination-out": true,
+        "destination-atop": true,
+        "xor": true,
+        "plus-darker": true,
+        "plus-lighter": true,
+        "baseline": true,
+        "middle": true,
+        "sub": true,
+        "super": true,
+        "text-top": true,
+        "text-bottom": true,
+        "top": true,
+        "bottom": true,
+        "-webkit-baseline-middle": true,
+        "-webkit-auto": true,
+        "left": true,
+        "right": true,
+        "center": true,
+        "justify": true,
+        "-webkit-left": true,
+        "-webkit-right": true,
+        "-webkit-center": true,
+        "outside": true,
+        "inside": true,
+        "disc": true,
+        "circle": true,
+        "square": true,
+        "decimal": true,
+        "decimal-leading-zero": true,
+        "lower-roman": true,
+        "upper-roman": true,
+        "lower-greek": true,
+        "lower-alpha": true,
+        "lower-latin": true,
+        "upper-alpha": true,
+        "upper-latin": true,
+        "hebrew": true,
+        "armenian": true,
+        "georgian": true,
+        "cjk-ideographic": true,
+        "hiragana": true,
+        "katakana": true,
+        "hiragana-iroha": true,
+        "katakana-iroha": true,
+        "inline": true,
+        "block": true,
+        "list-item": true,
+        "run-in": true,
+        "compact": true,
+        "inline-block": true,
+        "table": true,
+        "inline-table": true,
+        "table-row-group": true,
+        "table-header-group": true,
+        "table-footer-group": true,
+        "table-row": true,
+        "table-column-group": true,
+        "table-column": true,
+        "table-cell": true,
+        "table-caption": true,
+        "-webkit-box": true,
+        "-webkit-inline-box": true,
+        "-wap-marquee": true,
+        "auto": true,
+        "crosshair": true,
+        "default": true,
+        "pointer": true,
+        "move": true,
+        "vertical-text": true,
+        "cell": true,
+        "context-menu": true,
+        "alias": true,
+        "progress": true,
+        "no-drop": true,
+        "not-allowed": true,
+        "-webkit-zoom-in": true,
+        "-webkit-zoom-out": true,
+        "e-resize": true,
+        "ne-resize": true,
+        "nw-resize": true,
+        "n-resize": true,
+        "se-resize": true,
+        "sw-resize": true,
+        "s-resize": true,
+        "w-resize": true,
+        "ew-resize": true,
+        "ns-resize": true,
+        "nesw-resize": true,
+        "nwse-resize": true,
+        "col-resize": true,
+        "row-resize": true,
+        "text": true,
+        "wait": true,
+        "help": true,
+        "all-scroll": true,
+        "-webkit-grab": true,
+        "-webkit-grabbing": true,
+        "ltr": true,
+        "rtl": true,
+        "capitalize": true,
+        "uppercase": true,
+        "lowercase": true,
+        "visible": true,
+        "collapse": true,
+        "above": true,
+        "absolute": true,
+        "always": true,
+        "avoid": true,
+        "below": true,
+        "bidi-override": true,
+        "blink": true,
+        "both": true,
+        "close-quote": true,
+        "crop": true,
+        "cross": true,
+        "embed": true,
+        "fixed": true,
+        "hand": true,
+        "hide": true,
+        "higher": true,
+        "invert": true,
+        "landscape": true,
+        "level": true,
+        "line-through": true,
+        "local": true,
+        "loud": true,
+        "lower": true,
+        "-webkit-marquee": true,
+        "mix": true,
+        "no-close-quote": true,
+        "no-open-quote": true,
+        "nowrap": true,
+        "open-quote": true,
+        "overlay": true,
+        "overline": true,
+        "portrait": true,
+        "pre": true,
+        "pre-line": true,
+        "pre-wrap": true,
+        "relative": true,
+        "scroll": true,
+        "separate": true,
+        "show": true,
+        "static": true,
+        "thick": true,
+        "thin": true,
+        "underline": true,
+        "-webkit-nowrap": true,
+        "stretch": true,
+        "start": true,
+        "end": true,
+        "reverse": true,
+        "horizontal": true,
+        "vertical": true,
+        "inline-axis": true,
+        "block-axis": true,
+        "single": true,
+        "multiple": true,
+        "forwards": true,
+        "backwards": true,
+        "ahead": true,
+        "up": true,
+        "down": true,
+        "slow": true,
+        "fast": true,
+        "infinite": true,
+        "slide": true,
+        "alternate": true,
+        "read-only": true,
+        "read-write": true,
+        "read-write-plaintext-only": true,
+        "element": true,
+        "ignore": true,
+        "intrinsic": true,
+        "min-intrinsic": true,
+        "clip": true,
+        "ellipsis": true,
+        "discard": true,
+        "dot-dash": true,
+        "dot-dot-dash": true,
+        "wave": true,
+        "continuous": true,
+        "skip-white-space": true,
+        "break-all": true,
+        "break-word": true,
+        "space": true,
+        "after-white-space": true,
+        "checkbox": true,
+        "radio": true,
+        "push-button": true,
+        "square-button": true,
+        "button": true,
+        "button-bevel": true,
+        "default-button": true,
+        "list-button": true,
+        "listbox": true,
+        "listitem": true,
+        "media-fullscreen-button": true,
+        "media-mute-button": true,
+        "media-play-button": true,
+        "media-seek-back-button": true,
+        "media-seek-forward-button": true,
+        "media-rewind-button": true,
+        "media-return-to-realtime-button": true,
+        "media-slider": true,
+        "media-sliderthumb": true,
+        "media-volume-slider-container": true,
+        "media-volume-slider": true,
+        "media-volume-sliderthumb": true,
+        "media-controls-background": true,
+        "media-current-time-display": true,
+        "media-time-remaining-display": true,
+        "menulist": true,
+        "menulist-button": true,
+        "menulist-text": true,
+        "menulist-textfield": true,
+        "slider-horizontal": true,
+        "slider-vertical": true,
+        "sliderthumb-horizontal": true,
+        "sliderthumb-vertical": true,
+        "caret": true,
+        "searchfield": true,
+        "searchfield-decoration": true,
+        "searchfield-results-decoration": true,
+        "searchfield-results-button": true,
+        "searchfield-cancel-button": true,
+        "textfield": true,
+        "textarea": true,
+        "caps-lock-indicator": true,
+        "round": true,
+        "border": true,
+        "border-box": true,
+        "content": true,
+        "content-box": true,
+        "padding": true,
+        "padding-box": true,
+        "contain": true,
+        "cover": true,
+        "logical": true,
+        "visual": true,
+        "lines": true,
+        "running": true,
+        "paused": true,
+        "flat": true,
+        "preserve-3d": true,
+        "ease": true,
+        "linear": true,
+        "ease-in": true,
+        "ease-out": true,
+        "ease-in-out": true,
+        "document": true,
+        "reset": true,
+        "visiblePainted": true,
+        "visibleFill": true,
+        "visibleStroke": true,
+        "painted": true,
+        "fill": true,
+        "stroke": true,
+        "antialiased": true,
+        "subpixel-antialiased": true,
+        "optimizeSpeed": true,
+        "optimizeLegibility": true,
+        "geometricPrecision": true
+    };
+    function valueIdentAction(token) {
+        this.cursor += token.length;
+        if (token in valueKeywords) {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-keyword"));
+        } else
+            this.nonToken += token;
+    }
 
-        if (tmp < code.length)
-            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    function numvalueAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-number"));
+    }
+    
+    function declarationSemicolonAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    function urlAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-url"));
+    }
+    
+    function stringAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-string"));
+    }
+    
+    function colorAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-color"));
+    }
+    
+    function importantAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-important"));
+    }
+    
+    function atMediaAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtMedia;
+    }
+    
+    function startAtMediaBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function atKeyframesAction(token)
+    {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtKeyframes;
+    }
+    
+    function startAtKeyframesBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function atRuleAction(token) {
+        this.cursor += token.length;
+        this.newLine.appendChild(this.createSpan(token, "webkit-css-at-rule"));
+        this.lexState = this.LexState.AtRule;
+    }
+    
+    function endAtRuleAction(token) {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function startAtRuleBlockAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DeclarationProperty;
+    }
+    
+    const mediaTypes = ["all", "aural", "braille", "embossed", "handheld", "print", "projection", "screen", "tty", "tv"];
+    function atRuleIdentAction(token) {
+        this.cursor += token.length;
+        if (mediaTypes.indexOf(token) === -1)
+            this.nonToken += token;
+        else {
+            this.appendNonToken.call(this);
+            this.newLine.appendChild(this.createSpan(token, "webkit-css-keyword"));
+        }
     }
 }
 
-WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+WebInspector.CSSSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighlighter.prototype;
 
 WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
-    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+    WebInspector.SourceSyntaxHighlighter.call(this, table, sourceFrame);
 
     this.LexState = {
         Initial: 1,
@@ -996,212 +1853,282 @@ WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     this.cursor = 0;
     this.lineIndex = -1;
     this.lineCode = "";
-    this.lineFragment = null;
+    this.newLine = null;
     this.lexState = this.LexState.Initial;
     this.continueState = this.ContinueState.None;
     
     this.rules = [{
-            pattern: /^(?:\/\/.*)/,
-            action: singleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineSingleLineCommentAction
-        }, {
-            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
-            action: multiLineCommentStartAction
-        }, {
-            pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
-            action: multiLineCommentEndAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^.*/,
-            action: multiLineCommentMiddleAction,
-            continueStateCondition: this.ContinueState.Comment
-        }, {
-            pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
-            action: numericLiteralAction
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: stringLiteralAction
-        }, {
-            pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
-            action: singleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: singleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.SingleQuoteString
-        }, {
-            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringStartAction
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
-            action: doubleQuoteStringEndAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
-            action: doubleQuoteStringMiddleAction,
-            continueStateCondition: this.ContinueState.DoubleQuoteString
-        }, {
-            pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: identOrKeywordAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^\)/,
-            action: rightParenAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
-            action: punctuatorAction,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/=?)/,
-            action: divPunctuatorAction,
-            stateCondition: this.LexState.DivisionAllowed,
-            dontAppendNonToken: true
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpLiteralAction
-        }, {
-            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpStartAction
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
-            action: regExpEndAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }, {
-            pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
-            action: regExpMiddleAction,
-            continueStateCondition: this.ContinueState.RegExp
-        }];
+        pattern: /^(?:\/\/.*)/,
+        action: singleLineCommentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
+        action: multiLineSingleLineCommentAction
+    }, {
+        pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
+        action: multiLineCommentStartAction
+    }, {
+        pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
+        action: multiLineCommentEndAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^.*/,
+        action: multiLineCommentMiddleAction,
+        continueStateCondition: this.ContinueState.Comment
+    }, {
+        pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
+        action: numericLiteralAction
+    }, {
+        pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+        action: stringLiteralAction
+    }, {
+        pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: singleQuoteStringStartAction
+    }, {
+        pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+        action: singleQuoteStringEndAction,
+        continueStateCondition: this.ContinueState.SingleQuoteString
+    }, {
+        pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: singleQuoteStringMiddleAction,
+        continueStateCondition: this.ContinueState.SingleQuoteString
+    }, {
+        pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: doubleQuoteStringStartAction
+    }, {
+        pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
+        action: doubleQuoteStringEndAction,
+        continueStateCondition: this.ContinueState.DoubleQuoteString
+    }, {
+        pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+        action: doubleQuoteStringMiddleAction,
+        continueStateCondition: this.ContinueState.DoubleQuoteString
+    }, {
+        pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: identOrKeywordAction
+    }, {
+        pattern: /^\)/,
+        action: rightParenAction,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
+        action: punctuatorAction,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:\/=?)/,
+        action: divPunctuatorAction,
+        lexStateCondition: this.LexState.DivisionAllowed,
+        dontAppendNonToken: true
+    }, {
+        pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: regExpLiteralAction
+    }, {
+        pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
+        action: regExpStartAction
+    }, {
+        pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+        action: regExpEndAction,
+        continueStateCondition: this.ContinueState.RegExp
+    }, {
+        pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
+        action: regExpMiddleAction,
+        continueStateCondition: this.ContinueState.RegExp
+    }];
     
     function singleLineCommentAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function multiLineSingleLineCommentAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function multiLineCommentStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
         this.continueState = this.ContinueState.Comment;
     }
     
     function multiLineCommentEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
         this.continueState = this.ContinueState.None;
     }
     
     function multiLineCommentMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-comment"));
     }
     
     function numericLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-number"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-number"));
         this.lexState = this.LexState.DivisionAllowed;
     }
     
     function stringLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.lexState = this.LexState.Initial;
     }
     
     function singleQuoteStringStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.SingleQuoteString;
     }
     
     function singleQuoteStringEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.None;
     }
     
     function singleQuoteStringMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
     }
     
     function doubleQuoteStringStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.DoubleQuoteString;
     }
     
     function doubleQuoteStringEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
         this.continueState = this.ContinueState.None;
     }
     
     function doubleQuoteStringMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-string"));
     }
     
     function regExpLiteralAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.lexState = this.LexState.Initial;
     }
 
     function regExpStartAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.continueState = this.ContinueState.RegExp;
     }
 
     function regExpEndAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
         this.continueState = this.ContinueState.None;
     }
 
     function regExpMiddleAction(token)
     {
         this.cursor += token.length;
-        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.newLine.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
     }
     
+    const keywords = {
+        "null": true,
+        "true": true,
+        "false": true,
+        "break": true,
+        "case": true,
+        "catch": true,
+        "const": true,
+        "default": true,
+        "finally": true,
+        "for": true,
+        "instanceof": true,
+        "new": true,
+        "var": true,
+        "continue": true,
+        "function": true,
+        "return": true,
+        "void": true,
+        "delete": true,
+        "if": true,
+        "this": true,
+        "do": true,
+        "while": true,
+        "else": true,
+        "in": true,
+        "switch": true,
+        "throw": true,
+        "try": true,
+        "typeof": true,
+        "debugger": true,
+        "class": true,
+        "enum": true,
+        "export": true,
+        "extends": true,
+        "import": true,
+        "super": true,
+        "get": true,
+        "set": true
+    };
     function identOrKeywordAction(token)
     {
-        const keywords = ["null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for", "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if", "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "with", "debugger", "class", "enum", "export", "extends", "import", "super", "get", "set"];
         this.cursor += token.length;
-        if (keywords.indexOf(token) === -1) {
-            this.nonToken += token;
-            this.lexState = this.LexState.DivisionAllowed;
-        } else {
-            this.appendNonToken();
-            this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
+        
+        if (token in keywords) {
+            this.newLine.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
             this.lexState = this.LexState.Initial;
+        } else {
+            var identElement = this.createSpan(token, "webkit-javascript-ident");
+            identElement.addEventListener("mouseover", showDatatip, false);
+            this.newLine.appendChild(identElement);
+            this.lexState = this.LexState.DivisionAllowed;
+        }
+    }
+    
+    function showDatatip(event) {
+        if (!WebInspector.panels.scripts || !WebInspector.panels.scripts.paused)
+            return;
+
+        var node = event.target;
+        var parts = [node.textContent];
+        while (node.previousSibling && node.previousSibling.textContent === ".") {
+            node = node.previousSibling.previousSibling;
+            if (!node || !node.hasStyleClass("webkit-javascript-ident"))
+                break;
+            parts.unshift(node.textContent);
+        }
+
+        var expression = parts.join(".");
+
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", callback);
+        function callback(result, exception)
+        {
+            if (exception)
+                return;
+            event.target.setAttribute("title", result.description);
+            event.target.addEventListener("mouseout", onmouseout, false);
+            
+            function onmouseout(event)
+            {
+                event.target.removeAttribute("title");
+                event.target.removeEventListener("mouseout", onmouseout, false);
+            }
         }
     }
     
@@ -1227,131 +2154,4 @@ WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     }
 }
 
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
-    process: function()
-    {
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
-
-        var rows = this.table.rows;
-        var rowsLength = rows.length;
-        const tokensPerChunk = 100;
-        const lineLengthLimit = 20000;
-        
-        var boundProcessChunk = processChunk.bind(this);
-        var processChunkInterval = setInterval(boundProcessChunk, 25);
-        boundProcessChunk();
-        
-        function processChunk()
-        {
-            for (var i = 0; i < tokensPerChunk; i++) {
-                if (this.cursor >= this.lineCode.length)
-                    moveToNextLine.call(this);
-                if (this.lineIndex >= rowsLength) {
-                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                    return;
-                }
-                if (this.cursor > lineLengthLimit) {
-                    var codeFragment = this.lineCode.substring(this.cursor);
-                    this.nonToken += codeFragment;
-                    this.cursor += codeFragment.length;
-                }
-
-                this.lex();
-            }
-        }
-        
-        function moveToNextLine()
-        {
-            this.appendNonToken();
-            
-            var row = rows[this.lineIndex];
-            var line = row ? row.cells[1] : null;
-            if (line && this.lineFragment) {
-                var messageBubble = null;
-                if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
-                    messageBubble = line.lastChild;
-                    line.removeChild(messageBubble);
-                }
-                
-                Element.prototype.removeChildren.call(line);
-                
-                line.appendChild(this.lineFragment);
-                if (messageBubble)
-                    line.appendChild(messageBubble);
-                this.lineFragment = null;
-            }
-            this.lineIndex++;
-            if (this.lineIndex >= rowsLength && processChunkInterval) {
-                clearInterval(processChunkInterval);
-                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
-                return;
-            }
-            row = rows[this.lineIndex];
-            line = row ? row.cells[1] : null;
-            this.lineCode = line.textContent;
-            this.lineFragment = document.createDocumentFragment();
-            this.cursor = 0;
-            if (!line)
-                moveToNextLine();
-        }
-    },
-    
-    lex: function()
-    {
-        var token = null;
-        var codeFragment = this.lineCode.substring(this.cursor);
-        
-        for (var i = 0; i < this.rules.length; i++) {
-            var rule = this.rules[i];
-            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
-            if (this.continueState === ruleContinueStateCondition) {
-                if (typeof rule.stateCondition !== "undefined" && this.lexState !== rule.stateCondition)
-                    continue;
-                var match = rule.pattern.exec(codeFragment);
-                if (match) {
-                    token = match[0];
-                    if (token) {
-                        if (!rule.dontAppendNonToken)
-                            this.appendNonToken();
-                        return rule.action.call(this, token);
-                    }
-                }
-            }
-        }
-        this.nonToken += codeFragment[0];
-        this.cursor++;
-    },
-    
-    appendNonToken: function ()
-    {
-        if (this.nonToken.length > 0) {
-            this.lineFragment.appendChild(document.createTextNode(this.nonToken));
-            this.nonToken = "";
-        }
-    },
-    
-    syntaxHighlightNode: function(node)
-    {
-        this.lineCode = node.textContent;
-        this.lineFragment = document.createDocumentFragment();
-        this.cursor = 0;
-        while (true) {
-            if (this.cursor >= this.lineCode.length) {
-                var codeFragment = this.lineCode.substring(this.cursor);
-                this.nonToken += codeFragment;
-                this.cursor += codeFragment.length;
-                this.appendNonToken();
-                while (node.firstChild)
-                    node.removeChild(node.firstChild);
-                node.appendChild(this.lineFragment);
-                this.lineFragment =null;
-                return;
-            }
-
-            this.lex();
-        }
-    }
-}
-
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighlighter.prototype;
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index c1b1bbf..7ab7b5b 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -97,7 +97,7 @@ WebInspector.SourceView.prototype = {
 
         delete this._frameNeedsSetup;
         this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
-        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+        InspectorFrontendHost.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
     },
     
     _contentLoaded: function()
@@ -180,13 +180,13 @@ WebInspector.SourceView.prototype = {
         {
             if (isNaN(lineToSearch)) {
                 // Search the whole document since there was no line to search.
-                this._searchResults = (InspectorController.search(this.sourceFrame.element.contentDocument, query) || []);
+                this._searchResults = (InspectorFrontendHost.search(this.sourceFrame.element.contentDocument, query) || []);
             } else {
                 var sourceRow = this.sourceFrame.sourceRow(lineToSearch);
                 if (sourceRow) {
                     if (filterlessQuery) {
                         // There is still a query string, so search for that string in the line.
-                        this._searchResults = (InspectorController.search(sourceRow, filterlessQuery) || []);
+                        this._searchResults = (InspectorFrontendHost.search(sourceRow, filterlessQuery) || []);
                     } else {
                         // Match the whole line, since there was no remaining query string to match.
                         var rowRange = this.sourceFrame.element.contentDocument.createRange();
@@ -196,7 +196,7 @@ WebInspector.SourceView.prototype = {
                 }
 
                 // Attempt to search for the whole query, just incase it matches a color like "#333".
-                var wholeQueryMatches = InspectorController.search(this.sourceFrame.element.contentDocument, query);
+                var wholeQueryMatches = InspectorFrontendHost.search(this.sourceFrame.element.contentDocument, query);
                 if (wholeQueryMatches)
                     this._searchResults = this._searchResults.concat(wholeQueryMatches);
             }
diff --git a/WebCore/inspector/front-end/StoragePanel.js b/WebCore/inspector/front-end/StoragePanel.js
index 1aa11ee..dd558df 100644
--- a/WebCore/inspector/front-end/StoragePanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -97,7 +97,6 @@ WebInspector.StoragePanel.prototype = {
 
         this._domStorage = [];
 
-        this._cookieDomains = {};
         this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
@@ -124,13 +123,8 @@ WebInspector.StoragePanel.prototype = {
     
     addCookieDomain: function(domain)
     {
-        // Eliminate duplicate domains from the list.
-        if (typeof this._cookieDomains[domain] !== "undefined")
-            return;
-
         var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
         this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
-        this._cookieDomains[domain] = true;
     },
 
     addDOMStorage: function(domStorage)
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index a95dae3..5178a98 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -93,13 +93,12 @@ WebInspector.StylesSidebarPane.prototype = {
             node = this.node;
 
         var body = this.bodyElement;
-        if (!refresh || !node) {
+
+        if (!node) {
             body.removeChildren();
             this.sections = [];
-        }
-
-        if (!node)
             return;
+        }
 
         var self = this;
         function callback(styles)
@@ -335,7 +334,7 @@ WebInspector.StylesSidebarPane.prototype = {
         var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
         Preferences.colorFormat = selectedOption.value;
 
-        InspectorController.setSetting("color-format", Preferences.colorFormat);
+        InspectorFrontendHost.setSetting("color-format", Preferences.colorFormat);
 
         for (var i = 0; i < this.sections.length; ++i)
             this.sections[i].update(true);
@@ -1099,7 +1098,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
-    ondblclick: function(element, event)
+    ondblclick: function(event)
     {
         this.startEditing(event.target);
         event.stopPropagation();
@@ -1354,7 +1353,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
             if (updateInterface)
                 self.updateAll(true);
 
-            if (!self.rule)
+            if (!section.rule)
                 WebInspector.panels.elements.treeOutline.update();
         }
 
diff --git a/WebCore/inspector/front-end/TestController.js b/WebCore/inspector/front-end/TestController.js
index 12e1ac7..b2630ae 100644
--- a/WebCore/inspector/front-end/TestController.js
+++ b/WebCore/inspector/front-end/TestController.js
@@ -42,8 +42,8 @@ WebInspector.TestController.prototype = {
 
     notifyDone: function(result)
     {
-        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
-        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+        var message = typeof result === "undefined" ? "\"<undefined>\"" : JSON.stringify(result);
+        InspectorBackend.didEvaluateForTestInFrontend(this._callId, message);
     },
 
     runAfterPendingDispatches: function(callback)
@@ -52,7 +52,6 @@ WebInspector.TestController.prototype = {
             callback();
             return;
         }
-
         setTimeout(this.runAfterPendingDispatches.bind(this), 0, callback);
     }
 }
@@ -60,16 +59,20 @@ WebInspector.TestController.prototype = {
 WebInspector.evaluateForTestInFrontend = function(callId, script)
 {
     var controller = new WebInspector.TestController(callId);
-    try {
-        var result;
-        if (window[script] && typeof window[script] === "function")
-            result = window[script].call(this, controller);
-        else
-            result = window.eval(script);
+    function invokeMethod()
+    {
+        try {
+            var result;
+            if (window[script] && typeof window[script] === "function")
+                result = window[script].call(WebInspector, controller);
+            else
+                result = window.eval(script);
 
-        if (!controller._waitUntilDone)
-            controller.notifyDone(result);
-    } catch (e) {
-        controller.notifyDone(e.toString());
+            if (!controller._waitUntilDone)
+                controller.notifyDone(result);
+        } catch (e) {
+            controller.notifyDone(e.toString());
+        }
     }
+    controller.runAfterPendingDispatches(invokeMethod);
 }
diff --git a/WebCore/inspector/front-end/TextPrompt.js b/WebCore/inspector/front-end/TextPrompt.js
index f73ab0d..2230eaa 100644
--- a/WebCore/inspector/front-end/TextPrompt.js
+++ b/WebCore/inspector/front-end/TextPrompt.js
@@ -55,6 +55,13 @@ WebInspector.TextPrompt.prototype = {
 
     handleKeyEvent: function(event)
     {
+        function defaultAction()
+        {
+            this.clearAutoComplete();
+            this.autoCompleteSoon();
+        }
+
+        var handled = false;
         switch (event.keyIdentifier) {
             case "Up":
                 this._upKeyPressed(event);
@@ -70,11 +77,36 @@ WebInspector.TextPrompt.prototype = {
                 if (!this.acceptAutoComplete())
                     this.autoCompleteSoon();
                 break;
+            case "Alt":
+            case "Meta":
+            case "Shift":
+            case "Control":
+                break;
+            case "U+0050": // Ctrl+P = Previous
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveBackInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
+            case "U+004E": // Ctrl+N = Next
+                if (WebInspector.isMac() && event.ctrlKey && !event.metaKey && !event.altKey && !event.shiftKey) {
+                    handled = true;
+                    this._moveForwardInHistory();
+                    break;
+                }
+                defaultAction.call(this);
+                break;
             default:
-                this.clearAutoComplete();
-                this.autoCompleteSoon();
+                defaultAction.call(this);
                 break;
         }
+
+        if (handled) {
+            event.preventDefault();
+            event.stopPropagation();
+        }
     },
 
     acceptAutoComplete: function()
@@ -118,7 +150,7 @@ WebInspector.TextPrompt.prototype = {
         this._userEnteredRange.deleteContents();
 
         var userTextNode = document.createTextNode(this._userEnteredText);
-        this._userEnteredRange.insertNode(userTextNode);           
+        this._userEnteredRange.insertNode(userTextNode);
 
         var selectionRange = document.createRange();
         selectionRange.setStart(userTextNode, this._userEnteredText.length);
@@ -174,10 +206,9 @@ WebInspector.TextPrompt.prototype = {
             var currentText = fullWordRange.toString();
 
             var foundIndex = null;
-            for (var i = 0; i < completions.length; ++i) {
+            for (var i = 0; i < completions.length; ++i)
                 if (completions[i] === currentText)
                     foundIndex = i;
-            }
 
             if (foundIndex === null || (foundIndex + 1) >= completions.length)
                 var completionText = completions[0];
@@ -199,7 +230,7 @@ WebInspector.TextPrompt.prototype = {
             var suffixText = completionText.substring(wordPrefixLength);
 
             var prefixTextNode = document.createTextNode(prefixText);
-            fullWordRange.insertNode(prefixTextNode);           
+            fullWordRange.insertNode(prefixTextNode);
 
             this.autoCompleteElement = document.createElement("span");
             this.autoCompleteElement.className = "auto-complete-text";
@@ -211,7 +242,7 @@ WebInspector.TextPrompt.prototype = {
             finalSelectionRange.setEnd(prefixTextNode, wordPrefixLength);
         } else {
             var completionTextNode = document.createTextNode(completionText);
-            fullWordRange.insertNode(completionTextNode);           
+            fullWordRange.insertNode(completionTextNode);
 
             if (completions.length > 1)
                 finalSelectionRange.setStart(completionTextNode, wordPrefixLength);
@@ -258,6 +289,50 @@ WebInspector.TextPrompt.prototype = {
         return true;
     },
 
+    isCaretOnFirstLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(0, selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.previousSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.previousSibling;
+        }
+
+        return true;
+    },
+
+    isCaretOnLastLine: function()
+    {
+        var selection = window.getSelection();
+        var focusNode = selection.focusNode;
+        if (!focusNode || focusNode.nodeType !== Node.TEXT_NODE || focusNode.parentNode !== this.element)
+            return true;
+
+        if (focusNode.textContent.substring(selection.focusOffset).indexOf("\n") !== -1)
+            return false;
+        focusNode = focusNode.nextSibling;
+
+        while (focusNode) {
+            if (focusNode.nodeType !== Node.TEXT_NODE)
+                return true;
+            if (focusNode.textContent.indexOf("\n") !== -1)
+                return false;
+            focusNode = focusNode.nextSibling;
+        }
+
+        return true;
+    },
+
     moveCaretToEndOfPrompt: function()
     {
         var selection = window.getSelection();
@@ -281,39 +356,71 @@ WebInspector.TextPrompt.prototype = {
 
     _upKeyPressed: function(event)
     {
+        if (!this.isCaretOnFirstLine())
+            return;
+
+        event.preventDefault();
+        event.stopPropagation();
+
+        this._moveBackInHistory();
+    },
+
+    _downKeyPressed: function(event)
+    {
+        if (!this.isCaretOnLastLine())
+            return;
+
         event.preventDefault();
         event.stopPropagation();
 
+        this._moveForwardInHistory();
+    },
+
+    _moveBackInHistory: function()
+    {
         if (this.historyOffset == this.history.length)
             return;
 
         this.clearAutoComplete(true);
 
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             this.tempSavedCommand = this.text;
 
         ++this.historyOffset;
         this.text = this.history[this.history.length - this.historyOffset];
+
+        this.element.scrollIntoViewIfNeeded();
+        var firstNewlineIndex = this.text.indexOf("\n");
+        if (firstNewlineIndex === -1)
+            this.moveCaretToEndOfPrompt();
+        else {
+            var selection = window.getSelection();
+            var selectionRange = document.createRange();
+
+            selectionRange.setStart(this.element.firstChild, firstNewlineIndex);
+            selectionRange.setEnd(this.element.firstChild, firstNewlineIndex);
+
+            selection.removeAllRanges();
+            selection.addRange(selectionRange);
+        }
     },
 
-    _downKeyPressed: function(event)
+    _moveForwardInHistory: function()
     {
-        event.preventDefault();
-        event.stopPropagation();
-
-        if (this.historyOffset == 0)
+        if (this.historyOffset === 0)
             return;
 
         this.clearAutoComplete(true);
 
         --this.historyOffset;
 
-        if (this.historyOffset == 0) {
+        if (this.historyOffset === 0) {
             this.text = this.tempSavedCommand;
             delete this.tempSavedCommand;
             return;
         }
 
         this.text = this.history[this.history.length - this.historyOffset];
+        this.element.scrollIntoViewIfNeeded();
     }
 }
diff --git a/WebCore/inspector/front-end/TimelineAgent.js b/WebCore/inspector/front-end/TimelineAgent.js
index cbbb736..c9e9d64 100644
--- a/WebCore/inspector/front-end/TimelineAgent.js
+++ b/WebCore/inspector/front-end/TimelineAgent.js
@@ -34,17 +34,21 @@ WebInspector.TimelineAgent = function() {
 
 // Must be kept in sync with TimelineItem.h
 WebInspector.TimelineAgent.RecordType = {
-    DOMDispatch         : 0,
-    Layout              : 1,
-    RecalculateStyles   : 2,
-    Paint               : 3,
-    ParseHTML           : 4,
-    TimerInstall        : 5,
-    TimerRemove         : 6,
-    TimerFire           : 7,
+    EventDispatch : 0,
+    Layout : 1,
+    RecalculateStyles : 2,
+    Paint : 3,
+    ParseHTML : 4,
+    TimerInstall : 5,
+    TimerRemove : 6,
+    TimerFire : 7,
     XHRReadyStateChange : 8,
-    XHRLoad             : 9,
-    EvaluateScriptTag   : 10
+    XHRLoad : 9,
+    EvaluateScript : 10,
+    MarkTimeline : 11,
+    ResourceSendRequest : 12,
+    ResourceReceiveResponse : 13,
+    ResourceFinish : 14
 };
 
 WebInspector.addRecordToTimeline = function(record) {
diff --git a/WebCore/inspector/front-end/TimelineGrid.js b/WebCore/inspector/front-end/TimelineGrid.js
new file mode 100644
index 0000000..2866ecd
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineGrid.js
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineGrid = function()
+{
+    this.element = document.createElement("div");
+
+    this._itemsGraphsElement = document.createElement("div");
+    this._itemsGraphsElement.id = "resources-graphs";
+    this.element.appendChild(this._itemsGraphsElement);
+
+    this._dividersElement = document.createElement("div");
+    this._dividersElement.id = "resources-dividers";
+    this.element.appendChild(this._dividersElement);
+
+    this._eventDividersElement = document.createElement("div");
+    this._eventDividersElement.id = "resources-event-dividers";
+    this.element.appendChild(this._eventDividersElement);
+
+    this._dividersLabelBarElement = document.createElement("div");
+    this._dividersLabelBarElement.id = "resources-dividers-label-bar";
+    this.element.appendChild(this._dividersLabelBarElement);
+}
+
+WebInspector.TimelineGrid.prototype = {
+    get itemsGraphsElement()
+    {
+        return this._itemsGraphsElement;
+    },
+
+    updateDividers: function(force, calculator, paddingLeft)
+    {
+        var dividerCount = Math.round(this._dividersElement.offsetWidth / 64);
+        var slice = calculator.boundarySpan / dividerCount;
+        if (!force && this._currentDividerSlice === slice)
+            return false;
+
+        if (!(typeof paddingLeft === "number"))
+            paddingLeft = 0;
+        this._currentDividerSlice = slice;
+
+        this._eventDividersElement.removeChildren();
+        // Reuse divider elements and labels.
+        var divider = this._dividersElement.firstChild;
+        var dividerLabelBar = this._dividersLabelBarElement.firstChild;
+
+        var clientWidth = this._dividersLabelBarElement.clientWidth - paddingLeft;
+        for (var i = paddingLeft ? 0 : 1; i <= dividerCount; ++i) {
+            if (!divider) {
+                divider = document.createElement("div");
+                divider.className = "resources-divider";
+                this._dividersElement.appendChild(divider);
+
+                dividerLabelBar = document.createElement("div");
+                dividerLabelBar.className = "resources-divider";
+                var label = document.createElement("div");
+                label.className = "resources-divider-label";
+                dividerLabelBar._labelElement = label;
+                dividerLabelBar.appendChild(label);
+                this._dividersLabelBarElement.appendChild(dividerLabelBar);
+            }
+
+            if (i === dividerCount)
+                divider.addStyleClass("last");
+            else
+                divider.removeStyleClass("last");
+
+            var left = paddingLeft + clientWidth * (i / dividerCount);
+            var percentLeft = 100 * left / this._dividersLabelBarElement.clientWidth + "%";
+            divider.style.left = percentLeft;
+            dividerLabelBar.style.left = percentLeft;
+
+            if (!isNaN(slice))
+                dividerLabelBar._labelElement.textContent = calculator.formatValue(slice * i);
+
+            divider = divider.nextSibling;
+            dividerLabelBar = dividerLabelBar.nextSibling;
+        }
+
+        // Remove extras.
+        while (divider) {
+            var nextDivider = divider.nextSibling;
+            this._dividersElement.removeChild(divider);
+            divider = nextDivider;
+        }
+        while (dividerLabelBar) {
+            var nextDivider = dividerLabelBar.nextSibling;
+            this._dividersLabelBarElement.removeChild(dividerLabelBar);
+            dividerLabelBar = nextDivider;
+        }
+        return true;
+    },
+
+    addEventDivider: function(divider)
+    {
+        this._eventDividersElement.appendChild(divider);
+    },
+
+    setScrollAndDividerTop: function(scrollTop, dividersTop)
+    {
+        this._dividersElement.style.top = scrollTop + "px";
+        this._eventDividersElement.style.top = scrollTop + "px";
+        this._dividersLabelBarElement.style.top = dividersTop + "px";
+    }
+}
diff --git a/WebCore/inspector/front-end/TimelineOverviewPane.js b/WebCore/inspector/front-end/TimelineOverviewPane.js
new file mode 100644
index 0000000..b673abe
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -0,0 +1,387 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineOverviewPane = function(categories)
+{
+    this.element = document.createElement("div");
+    this.element.id = "timeline-overview-panel";
+
+    this._categories = categories;
+    this._overviewSidebarElement = document.createElement("div");
+    this._overviewSidebarElement.id = "timeline-overview-sidebar";
+    this.element.appendChild(this._overviewSidebarElement);
+
+    var overviewTreeElement = document.createElement("ol");
+    overviewTreeElement.className = "sidebar-tree";
+    this._overviewSidebarElement.appendChild(overviewTreeElement);
+    var sidebarTree = new TreeOutline(overviewTreeElement);
+
+    var categoriesTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("TIMELINES"), {}, true);
+    categoriesTreeElement.expanded = true;
+    sidebarTree.appendChild(categoriesTreeElement);
+    for (var categoryName in this._categories) {
+        var category = this._categories[categoryName];
+        categoriesTreeElement.appendChild(new WebInspector.TimelineCategoryTreeElement(category, this._onCheckboxClicked.bind(this, category)));
+    }
+
+    this._overviewGrid = new WebInspector.TimelineGrid();
+    this._overviewGrid.element.id = "timeline-overview-grid";
+    this._overviewGrid.itemsGraphsElement.id = "timeline-overview-graphs";
+    this.element.appendChild(this._overviewGrid.element);
+
+    this._categoryGraphs = {};
+    var i = 0;
+    for (var category in this._categories) {
+        var categoryGraph = new WebInspector.TimelineCategoryGraph(this._categories[category], i++ % 2);
+        this._categoryGraphs[category] = categoryGraph;
+        this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
+    }
+    this._overviewGrid.setScrollAndDividerTop(0, 0);
+
+    this._overviewWindowElement = document.createElement("div");
+    this._overviewWindowElement.id = "timeline-overview-window";
+    this._overviewWindowElement.addEventListener("mousedown", this._dragWindow.bind(this), false);
+    this._overviewGrid.element.appendChild(this._overviewWindowElement);
+
+    this._leftResizeElement = document.createElement("div");
+    this._leftResizeElement.className = "timeline-window-resizer";
+    this._leftResizeElement.style.left = 0;
+    this._overviewGrid.element.appendChild(this._leftResizeElement);
+    this._leftResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._leftResizeElement), false);
+
+    this._rightResizeElement = document.createElement("div");
+    this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
+    this._rightResizeElement.style.right = 0;
+    this._overviewGrid.element.appendChild(this._rightResizeElement);
+    this._rightResizeElement.addEventListener("mousedown", this._resizeWindow.bind(this, this._rightResizeElement), false);
+
+    this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
+
+    var separatorElement = document.createElement("div");
+    separatorElement.id = "timeline-overview-separator";
+    this.element.appendChild(separatorElement);
+
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+}
+
+
+WebInspector.TimelineOverviewPane.prototype = {
+    _onCheckboxClicked: function (category, event) {
+        if (event.target.checked)
+            category.hidden = false;
+        else
+            category.hidden = true;
+        this._categoryGraphs[category.name].dimmed = !event.target.checked;
+        this.dispatchEventToListeners("filter changed");
+    },
+
+    update: function(records)
+    {
+        // Clear summary bars.
+        var timelines = {};
+        for (var category in this._categories) {
+            timelines[category] = [];
+            this._categoryGraphs[category].clearChunks();
+        }
+
+        function forAllRecords(recordsArray, callback)
+        {
+            if (!recordsArray)
+                return;
+            for (var i = 0; i < recordsArray.length; ++i) {
+                callback(recordsArray[i]);
+                forAllRecords(recordsArray[i].children, callback);
+            }
+        }
+
+        // Create sparse arrays with 101 cells each to fill with chunks for a given category.
+        this._overviewCalculator.reset();
+        forAllRecords(records, this._overviewCalculator.updateBoundaries.bind(this._overviewCalculator));
+
+        function markTimeline(record)
+        {
+            var percentages = this._overviewCalculator.computeBarGraphPercentages(record);
+
+            var end = Math.round(percentages.end);
+            var categoryName = record.category.name;
+            for (var j = Math.round(percentages.start); j <= end; ++j)
+                timelines[categoryName][j] = true;
+        }
+        forAllRecords(records, markTimeline.bind(this));
+
+        // Convert sparse arrays to continuous segments, render graphs for each.
+        for (var category in this._categories) {
+            var timeline = timelines[category];
+            window.timelineSaved = timeline;
+            var chunkStart = -1;
+            for (var j = 0; j < 101; ++j) {
+                if (timeline[j]) {
+                    if (chunkStart === -1)
+                        chunkStart = j;
+                } else {
+                    if (chunkStart !== -1) {
+                        this._categoryGraphs[category].addChunk(chunkStart, j);
+                        chunkStart = -1;
+                    }
+                }
+            }
+            if (chunkStart !== -1) {
+                this._categoryGraphs[category].addChunk(chunkStart, 100);
+                chunkStart = -1;
+            }
+        }
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+    },
+
+    setSidebarWidth: function(width)
+    {
+        this._overviewSidebarElement.style.width = width + "px";
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._overviewGrid.element.style.left = width + "px";
+    },
+
+    reset: function()
+    {
+        this._overviewCalculator.reset();
+        this._overviewGrid.updateDividers(true, this._overviewCalculator);
+        this.windowLeft = 0.0;
+        this.windowRight = 1.0;
+    },
+
+    _resizeWindow: function(resizeElement, event)
+    {
+        WebInspector.elementDragStart(resizeElement, this._windowResizeDragging.bind(this, resizeElement), this._endWindowDragging.bind(this), event, "col-resize");
+    },
+
+    _windowResizeDragging: function(resizeElement, event)
+    {
+        if (resizeElement === this._leftResizeElement)
+            this._resizeWindowLeft(event.pageX - this._overviewGrid.element.offsetLeft);
+        else
+            this._resizeWindowRight(event.pageX - this._overviewGrid.element.offsetLeft);
+        event.preventDefault();
+    },
+
+    _dragWindow: function(event)
+    {
+        WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
+            this._leftResizeElement.offsetLeft, this._rightResizeElement.offsetLeft), this._endWindowDragging.bind(this), event, "ew-resize");
+    },
+
+    _windowDragging: function(startX, windowLeft, windowRight, event)
+    {
+        var delta = event.pageX - startX;
+        var start = windowLeft + delta;
+        var end = windowRight + delta;
+        var windowSize = windowRight - windowLeft;
+
+        if (start < 0) {
+            start = 0;
+            end = windowSize;
+        }
+
+        if (end > this._overviewGrid.element.clientWidth) {
+            end = this._overviewGrid.element.clientWidth;
+            start = end - windowSize;
+        }
+        this._setWindowPosition(start, end);
+
+        event.preventDefault();
+    },
+
+    _resizeWindowLeft: function(start)
+    {
+        // Glue to edge.
+        if (start < 10)
+            start = 0;
+        this._setWindowPosition(start, null);
+    },
+
+    _resizeWindowRight: function(end)
+    {
+        // Glue to edge.
+        if (end > this._overviewGrid.element.clientWidth - 10)
+            end = this._overviewGrid.element.clientWidth;
+        this._setWindowPosition(null, end);
+    },
+
+    _setWindowPosition: function(start, end)
+    {
+        if (typeof start === "number") {
+            if (start > this._rightResizeElement.offsetLeft - 4)
+                start = this._rightResizeElement.offsetLeft - 4;
+
+            this.windowLeft = start / this._overviewGrid.element.clientWidth;
+            this._leftResizeElement.style.left = this.windowLeft * 100 + "%";
+            this._overviewWindowElement.style.left = this.windowLeft * 100 + "%";
+        }
+        if (typeof end === "number") {
+            if (end < this._leftResizeElement.offsetLeft + 12)
+                end = this._leftResizeElement.offsetLeft + 12;
+
+            this.windowRight = end / this._overviewGrid.element.clientWidth;
+            this._rightResizeElement.style.left = this.windowRight * 100 + "%";
+        }
+        this._overviewWindowElement.style.width = (this.windowRight - this.windowLeft) * 100 + "%";
+        this.dispatchEventToListeners("window changed");
+    },
+
+    _endWindowDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+    }
+}
+
+WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.Object.prototype;
+
+
+WebInspector.TimelineOverviewCalculator = function()
+{
+    this._uiString = WebInspector.UIString.bind(WebInspector);
+}
+
+WebInspector.TimelineOverviewCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
+        return {start: start, end: end};
+    },
+
+    reset: function()
+    {
+        delete this.minimumBoundary;
+        delete this.maximumBoundary;
+    },
+
+    updateBoundaries: function(record)
+    {
+        if (typeof this.minimumBoundary === "undefined" || record.startTime < this.minimumBoundary) {
+            this.minimumBoundary = record.startTime;
+            return true;
+        }
+        if (typeof this.maximumBoundary === "undefined" || record.endTime > this.maximumBoundary) {
+            this.maximumBoundary = record.endTime;
+            return true;
+        }
+        return false;
+    },
+
+    get boundarySpan()
+    {
+        return this.maximumBoundary - this.minimumBoundary;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, this._uiString);
+    }
+}
+
+
+WebInspector.TimelineCategoryTreeElement = function(category, onCheckboxClicked)
+{
+    this._category = category;
+    this._onCheckboxClicked = onCheckboxClicked;
+    // Pass an empty title, the title gets made later in onattach.
+    TreeElement.call(this, "", null, false);
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype = {
+    onattach: function()
+    {
+        this.listItemElement.removeChildren();
+        this.listItemElement.addStyleClass("timeline-category-tree-item");
+        this.listItemElement.addStyleClass("timeline-category-" + this._category.name);
+
+        var label = document.createElement("label");
+
+        var checkElement = document.createElement("input");
+        checkElement.type = "checkbox";
+        checkElement.className = "timeline-category-checkbox";
+        checkElement.checked = true;
+        checkElement.addEventListener("click", this._onCheckboxClicked);
+        label.appendChild(checkElement);
+
+        var typeElement = document.createElement("span");
+        typeElement.className = "type";
+        typeElement.textContent = this._category.title;
+        label.appendChild(typeElement);
+
+        this.listItemElement.appendChild(label);
+    }
+}
+
+WebInspector.TimelineCategoryTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.TimelineCategoryGraph = function(category, isEven)
+{
+    this._category = category;
+
+    this._graphElement = document.createElement("div");
+    this._graphElement.className = "timeline-graph-side timeline-overview-graph-side" + (isEven ? " even" : "");
+
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area timeline-category-" + category.name;
+    this._graphElement.appendChild(this._barAreaElement);
+}
+
+WebInspector.TimelineCategoryGraph.prototype = {
+    get graphElement()
+    {
+        return this._graphElement;
+    },
+
+    addChunk: function(start, end)
+    {
+        var chunk = document.createElement("div");
+        chunk.className = "timeline-graph-bar";
+        this._barAreaElement.appendChild(chunk);
+        chunk.style.setProperty("left", start + "%");
+        chunk.style.setProperty("width", (end - start) + "%");
+    },
+
+    clearChunks: function()
+    {
+        this._barAreaElement.removeChildren();
+    },
+
+    set dimmed(dimmed)
+    {
+        if (dimmed)
+            this._barAreaElement.removeStyleClass("timeline-category-" + this._category.name);
+        else
+            this._barAreaElement.addStyleClass("timeline-category-" + this._category.name);
+    }
+}
diff --git a/WebCore/inspector/front-end/TimelinePanel.js b/WebCore/inspector/front-end/TimelinePanel.js
index df63a0b..ac36fa5 100644
--- a/WebCore/inspector/front-end/TimelinePanel.js
+++ b/WebCore/inspector/front-end/TimelinePanel.js
@@ -30,19 +30,56 @@
 
 WebInspector.TimelinePanel = function()
 {
-    WebInspector.AbstractTimelinePanel.call(this);
-
+    WebInspector.Panel.call(this);
     this.element.addStyleClass("timeline");
 
-    this.createInterface();
-    this.summaryBar.element.id = "timeline-summary";
-    this.itemsGraphsElement.id = "timeline-graphs";
+    this._overviewPane = new WebInspector.TimelineOverviewPane(this.categories);
+    this._overviewPane.addEventListener("window changed", this._scheduleRefresh, this);
+    this._overviewPane.addEventListener("filter changed", this._refresh, this);
+    this.element.appendChild(this._overviewPane.element);
 
-    this._createStatusbarButtons();
+    this._sidebarBackgroundElement = document.createElement("div");
+    this._sidebarBackgroundElement.className = "sidebar timeline-sidebar-background";
+    this.element.appendChild(this._sidebarBackgroundElement);
+
+    this._containerElement = document.createElement("div");
+    this._containerElement.id = "timeline-container";
+    this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
+    this.element.appendChild(this._containerElement);
+
+    this.createSidebar(this._containerElement, this._containerElement);
+    var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
+    itemsTreeElement.expanded = true;
+    this.sidebarTree.appendChild(itemsTreeElement);
+
+    this._sidebarListElement = document.createElement("div");
+    this.sidebarElement.appendChild(this._sidebarListElement);
+
+    this._containerContentElement = document.createElement("div");
+    this._containerContentElement.id = "resources-container-content";
+    this._containerElement.appendChild(this._containerContentElement);
+
+    this._timelineGrid = new WebInspector.TimelineGrid();
+    this._itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
+    this._itemsGraphsElement.id = "timeline-graphs";
+    this._containerContentElement.appendChild(this._timelineGrid.element);
+
+    this._topGapElement = document.createElement("div");
+    this._topGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._topGapElement);
 
-    this.calculator = new WebInspector.TimelineCalculator();
+    this._graphRowsElement = document.createElement("div");
+    this._itemsGraphsElement.appendChild(this._graphRowsElement);
 
-    this.filter(this.filterAllElement, false);
+    this._bottomGapElement = document.createElement("div");
+    this._bottomGapElement.className = "timeline-gap";
+    this._itemsGraphsElement.appendChild(this._bottomGapElement);
+
+    this._createStatusbarButtons();
+
+    this._records = [];
+    this._sendRequestRecords = {};
+    this._calculator = new WebInspector.TimelineCalculator();
 }
 
 WebInspector.TimelinePanel.prototype = {
@@ -64,20 +101,12 @@ WebInspector.TimelinePanel.prototype = {
             this._categories = {
                 loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
                 scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
-                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"),
-                other: new WebInspector.TimelineCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
+                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)")
             };
         }
         return this._categories;
     },
 
-    populateSidebar: function()
-    {
-        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
-        this.itemsTreeElement.expanded = true;
-        this.sidebarTree.appendChild(this.itemsTreeElement);
-    },
-
     _createStatusbarButtons: function()
     {
         this.toggleTimelineButton = new WebInspector.StatusBarButton("", "record-profile-status-bar-item");
@@ -87,6 +116,14 @@ WebInspector.TimelinePanel.prototype = {
         this.clearButton.addEventListener("click", this.reset.bind(this), false);
     },
 
+    _toggleTimelineButtonClicked: function()
+    {
+        if (this.toggleTimelineButton.toggled)
+            InspectorBackend.stopTimelineProfiler();
+        else
+            InspectorBackend.startTimelineProfiler();
+    },
+
     timelineWasStarted: function()
     {
         this.toggleTimelineButton.toggled = true;
@@ -99,7 +136,14 @@ WebInspector.TimelinePanel.prototype = {
 
     addRecordToTimeline: function(record)
     {
+        this._innerAddRecordToTimeline(record, this._records);
+        this._scheduleRefresh();
+    },
+
+    _innerAddRecordToTimeline: function(record, collection)
+    {
         var formattedRecord = this._formatRecord(record);
+
         // Glue subsequent records with same category and title together if they are closer than 100ms to each other.
         if (this._lastRecord && (!record.children || !record.children.length) &&
                 this._lastRecord.category == formattedRecord.category &&
@@ -108,40 +152,25 @@ WebInspector.TimelinePanel.prototype = {
                 formattedRecord.startTime - this._lastRecord.endTime < 0.1) {
             this._lastRecord.endTime = formattedRecord.endTime;
             this._lastRecord.count++;
-            this.refreshItem(this._lastRecord);
         } else {
-            this.addItem(formattedRecord);
-
-            for (var i = 0; record.children && i < record.children.length; ++i)
-                this.addRecordToTimeline(record.children[i]);
+            collection.push(formattedRecord);
+            for (var i = 0; record.children && i < record.children.length; ++i) {
+                if (!formattedRecord.children)
+                    formattedRecord.children = [];
+                var formattedChild = this._innerAddRecordToTimeline(record.children[i], formattedRecord.children);
+                formattedChild.parent = formattedRecord;
+            }
             this._lastRecord = record.children && record.children.length ? null : formattedRecord;
         }
-    },
-
-    createItemTreeElement: function(item)
-    {
-        return new WebInspector.TimelineRecordTreeElement(item);
-    },
-
-    createItemGraph: function(item)
-    {
-        return new WebInspector.TimelineGraph(item);
-    },
-
-    _toggleTimelineButtonClicked: function()
-    {
-        if (InspectorController.timelineProfilerEnabled())
-            InspectorController.stopTimelineProfiler();
-        else
-            InspectorController.startTimelineProfiler();
+        return formattedRecord;
     },
 
     _formatRecord: function(record)
     {
+        var recordTypes = WebInspector.TimelineAgent.RecordType;
         if (!this._recordStyles) {
             this._recordStyles = {};
-            var recordTypes = WebInspector.TimelineAgent.RecordType;
-            this._recordStyles[recordTypes.DOMDispatch] = { title: WebInspector.UIString("DOM Event"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: this.categories.scripting };
             this._recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
             this._recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
             this._recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
@@ -151,13 +180,16 @@ WebInspector.TimelinePanel.prototype = {
             this._recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
             this._recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
             this._recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
-            this._recordStyles[recordTypes.EvaluateScriptTag] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
-            this._recordStyles["Other"] = { title: WebInspector.UIString("Other"), icon: 0, category: this.categories.other };
+            this._recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.MarkTimeline] = { title: WebInspector.UIString("Mark"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: this.categories.loading };
+            this._recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
+            this._recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
         }
 
         var style = this._recordStyles[record.type];
         if (!style)
-            style = this._recordStyles["Other"];
+            style = this._recordStyles[recordTypes.EventDispatch];
 
         var formattedRecord = {};
         formattedRecord.category = style.category;
@@ -166,119 +198,278 @@ WebInspector.TimelinePanel.prototype = {
         formattedRecord.data = record.data;
         formattedRecord.count = 1;
         formattedRecord.type = record.type;
-        formattedRecord.details = this._getRecordDetails(record);
         formattedRecord.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : formattedRecord.startTime;
+        formattedRecord.record = record;
+
+        // Make resource receive record last since request was sent; make finish record last since response received.
+        if (record.type === WebInspector.TimelineAgent.RecordType.ResourceSendRequest) {
+            this._sendRequestRecords[record.data.identifier] = formattedRecord;
+        } else if (record.type === WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse) {
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
+                sendRequestRecord._responseReceivedFormattedTime = formattedRecord.startTime;
+                formattedRecord.startTime = sendRequestRecord.startTime;
+                sendRequestRecord.details = this._getRecordDetails(record);
+            }
+        } else if (record.type === WebInspector.TimelineAgent.RecordType.ResourceFinish) {
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            if (sendRequestRecord) // False for main resource.
+                formattedRecord.startTime = sendRequestRecord._responseReceivedFormattedTime;
+        }
+        formattedRecord.details = this._getRecordDetails(record);
+
         return formattedRecord;
     },
-    
+
     _getRecordDetails: function(record)
     {
         switch (record.type) {
-        case WebInspector.TimelineAgent.RecordType.DOMDispatch:
-            return record.data.type;
+        case WebInspector.TimelineAgent.RecordType.EventDispatch:
+            return record.data ? record.data.type : "";
+        case WebInspector.TimelineAgent.RecordType.Paint:
+            return record.data.width + "\u2009\u00d7\u2009" + record.data.height;
         case WebInspector.TimelineAgent.RecordType.TimerInstall:
         case WebInspector.TimelineAgent.RecordType.TimerRemove:
         case WebInspector.TimelineAgent.RecordType.TimerFire:
             return record.data.timerId;
         case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
         case WebInspector.TimelineAgent.RecordType.XHRLoad:
-        case WebInspector.TimelineAgent.RecordType.EvaluateScriptTag:
-            return record.data.url;
+        case WebInspector.TimelineAgent.RecordType.EvaluateScript:
+        case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
+            return WebInspector.displayNameForURL(record.data.url);
+        case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
+        case WebInspector.TimelineAgent.RecordType.ResourceFinish:
+            var sendRequestRecord = this._sendRequestRecords[record.data.identifier];
+            return sendRequestRecord ? WebInspector.displayNameForURL(sendRequestRecord.data.url) : "";
+        case WebInspector.TimelineAgent.RecordType.MarkTimeline:
+            return record.data.message;
         default:
             return "";
         }
     },
 
+    setSidebarWidth: function(width)
+    {
+        WebInspector.Panel.prototype.setSidebarWidth.call(this, width);
+        this._sidebarBackgroundElement.style.width = width + "px";
+        this._overviewPane.setSidebarWidth(width);
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._containerContentElement.style.left = width + "px";
+        this._scheduleRefresh();
+        this._overviewPane.updateMainViewWidth(width);
+    },
+
+    resize: function() {
+        this._scheduleRefresh();
+    },
+
     reset: function()
     {
-        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
         this._lastRecord = null;
-    }
-}
+        this._sendRequestRecords = {};
+        this._overviewPane.reset();
+        this._records = [];
+        this._refresh();
+    },
 
-WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
 
+        if (this._needsRefresh)
+            this._refresh();
+    },
 
-WebInspector.TimelineCategory = function(name, title, color)
-{
-    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
-}
+    _onScroll: function(event)
+    {
+        var scrollTop = this._containerElement.scrollTop;
+        var dividersTop = Math.max(0, scrollTop);
+        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
+        this._scheduleRefresh(true);
+    },
 
-WebInspector.TimelineCategory.prototype = {
-}
+    _scheduleRefresh: function(immediate)
+    {
+        if (this._needsRefresh)
+            return;
+        this._needsRefresh = true;
+
+        if (this.visible && !("_refreshTimeout" in this))
+            this._refreshTimeout = setTimeout(this._refresh.bind(this), immediate ? 0 : 100);
+    },
 
-WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
+    _refresh: function()
+    {
+        this._needsRefresh = false;
+        if ("_refreshTimeout" in this) {
+            clearTimeout(this._refreshTimeout);
+            delete this._refreshTimeout;
+        }
+        this._overviewPane.update(this._records);
+        this._refreshRecords();
+    },
 
+    _refreshRecords: function()
+    {
+        this._calculator.windowLeft = this._overviewPane.windowLeft;
+        this._calculator.windowRight = this._overviewPane.windowRight;
+        this._calculator.reset();
+
+        for (var i = 0; i < this._records.length; ++i)
+            this._calculator.updateBoundaries(this._records[i]);
+
+        var recordsInWindow = [];
+        for (var i = 0; i < this._records.length; ++i) {
+            var record = this._records[i];
+            var percentages = this._calculator.computeBarGraphPercentages(record);
+            if (percentages.start < 100 && percentages.end >= 0 && !record.category.hidden)
+                this._addToRecordsWindow(record, recordsInWindow);
+        }
 
-WebInspector.TimelineRecordTreeElement = function(record)
-{
-    this._record = record;
+        // Calculate the visible area.
+        var visibleTop = this._containerElement.scrollTop;
+        var visibleBottom = visibleTop + this._containerElement.clientHeight;
+
+        // Define row height, should be in sync with styles for timeline graphs.
+        const rowHeight = 18;
+        const expandOffset = 15;
+
+        // Convert visible area to visible indexes. Always include top-level record for a visible nested record.
+        var startIndex = Math.max(0, Math.floor(visibleTop / rowHeight) - 1);
+        while (startIndex > 0 && recordsInWindow[startIndex].parent)
+            startIndex--;
+        var endIndex = Math.min(recordsInWindow.length, Math.ceil(visibleBottom / rowHeight));
+        while (endIndex < recordsInWindow.length - 1 && recordsInWindow[startIndex].parent)
+            endIndex++;
+
+        // Resize gaps first.
+        const top = (startIndex * rowHeight) + "px";
+        this._topGapElement.style.height = top;
+        this.sidebarElement.style.top = top;
+        this.sidebarResizeElement.style.top = top;
+        this._bottomGapElement.style.height = (recordsInWindow.length - endIndex) * rowHeight + "px";
+
+        // Update visible rows.
+        var listRowElement = this._sidebarListElement.firstChild;
+        var graphRowElement = this._graphRowsElement.firstChild;
+        var width = this._graphRowsElement.offsetWidth;
+        var scheduleRefreshCallback = this._scheduleRefresh.bind(this, true);
+        for (var i = startIndex; i < endIndex; ++i) {
+            var record = recordsInWindow[i];
+            var isEven = !(i % 2);
+
+            if (!listRowElement) {
+                listRowElement = new WebInspector.TimelineRecordListRow().element;
+                this._sidebarListElement.appendChild(listRowElement);
+            }
+            if (!graphRowElement) {
+                graphRowElement = new WebInspector.TimelineRecordGraphRow(this._itemsGraphsElement, scheduleRefreshCallback, rowHeight).element;
+                this._graphRowsElement.appendChild(graphRowElement);
+            }
+
+            listRowElement.listRow.update(record, isEven);
+            graphRowElement.graphRow.update(record, isEven, this._calculator, width, expandOffset);
+
+            listRowElement = listRowElement.nextSibling;
+            graphRowElement = graphRowElement.nextSibling;
+        }
 
-    // Pass an empty title, the title gets made later in onattach.
-    TreeElement.call(this, "", null, false);
-}
+        // Remove extra rows.
+        while (listRowElement) {
+            var nextElement = listRowElement.nextSibling;
+            listRowElement.listRow.dispose();
+            listRowElement = nextElement;
+        }
+        while (graphRowElement) {
+            var nextElement = graphRowElement.nextSibling;
+            graphRowElement.graphRow.dispose();
+            graphRowElement = nextElement;
+        }
+
+        // Reserve some room for expand / collapse controls to the left for records that start at 0ms.
+        var timelinePaddingLeft = this._calculator.windowLeft === 0 ? expandOffset : 0;
+        this._timelineGrid.updateDividers(true, this._calculator, timelinePaddingLeft);
+        this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
+    },
 
-WebInspector.TimelineRecordTreeElement.prototype = {
-    onattach: function()
-    {
-        this.listItemElement.removeChildren();
-        this.listItemElement.addStyleClass("timeline-tree-item");
-        this.listItemElement.addStyleClass("timeline-category-" + this._record.category.name);
-
-        var iconElement = document.createElement("span");
-        iconElement.className = "timeline-tree-icon";
-        this.listItemElement.appendChild(iconElement);
-
-        this.typeElement = document.createElement("span");
-        this.typeElement.className = "type";
-        this.typeElement.textContent = this._record.title;
-        this.listItemElement.appendChild(this.typeElement);
-
-        if (this._record.details) {
-            var separatorElement = document.createElement("span");
-            separatorElement.className = "separator";
-            separatorElement.textContent = " ";
-
-            var dataElement = document.createElement("span");
-            dataElement.className = "data";
-            dataElement.textContent = "(" + this._record.details + ")";
-            dataElement.addStyleClass("dimmed");
-            this.listItemElement.appendChild(separatorElement);
-            this.listItemElement.appendChild(dataElement);
+    _addToRecordsWindow: function(record, recordsWindow)
+    {
+        recordsWindow.push(record);
+        if (!record.collapsed) {
+            var index = recordsWindow.length;
+            for (var i = 0; record.children && i < record.children.length; ++i)
+                this._addToRecordsWindow(record.children[i], recordsWindow);
+            record.visibleChildrenCount = recordsWindow.length - index;
         }
     },
 
-    refresh: function()
+    _adjustScrollPosition: function(totalHeight)
     {
-        if (this._record.count > 1)
-            this.typeElement.textContent = this._record.title + " x " + this._record.count;
+        // Prevent the container from being scrolled off the end.
+        if ((this._containerElement.scrollTop + this._containerElement.offsetHeight) > totalHeight + 1)
+            this._containerElement.scrollTop = (totalHeight - this._containerElement.offsetHeight);
     }
 }
 
-WebInspector.TimelineRecordTreeElement.prototype.__proto__ = TreeElement.prototype;
+WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+}
 
 
 WebInspector.TimelineCalculator = function()
 {
-    WebInspector.AbstractTimelineCalculator.call(this);
+    this.windowLeft = 0.0;
+    this.windowRight = 1.0;
+    this._uiString = WebInspector.UIString.bind(WebInspector);
 }
 
 WebInspector.TimelineCalculator.prototype = {
     computeBarGraphPercentages: function(record)
     {
-        var start = ((record.startTime - this.minimumBoundary) / this.boundarySpan) * 100;
-        var end = ((record.endTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var end = (record.endTime - this.minimumBoundary) / this.boundarySpan * 100;
         return {start: start, end: end};
     },
 
-    computePercentageFromEventTime: function(eventTime)
+    get minimumBoundary()
+    {
+        if (typeof this._minimumBoundary === "number")
+            return this._minimumBoundary;
+
+        if (typeof this.windowLeft === "number")
+            this._minimumBoundary = this._absoluteMinimumBoundary + this.windowLeft * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        else
+            this._minimumBoundary = this._absoluteMinimumBoundary;
+        return this._minimumBoundary;
+    },
+
+    get maximumBoundary()
     {
-        return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        if (typeof this._maximumBoundary === "number")
+            return this._maximumBoundary;
+
+        if (typeof this.windowLeft === "number")
+            this._maximumBoundary = this._absoluteMinimumBoundary + this.windowRight * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        else
+            this._maximumBoundary = this._absoluteMaximumBoundary;
+        return this._maximumBoundary;
     },
 
-    computeBarGraphLabels: function(record)
+    reset: function()
     {
-        return {tooltip: record.title};
+        delete this._absoluteMinimumBoundary;
+        delete this._absoluteMaximumBoundary;
+        delete this._minimumBoundary;
+        delete this._maximumBoundary;
     },
 
     updateBoundaries: function(record)
@@ -287,76 +478,153 @@ WebInspector.TimelineCalculator.prototype = {
 
         var lowerBound = record.startTime;
 
-        if (typeof this.minimumBoundary === "undefined" || lowerBound < this.minimumBoundary) {
-            this.minimumBoundary = lowerBound;
+        if (typeof this._absoluteMinimumBoundary === "undefined" || lowerBound < this._absoluteMinimumBoundary) {
+            this._absoluteMinimumBoundary = lowerBound;
+            delete this._minimumBoundary;
             didChange = true;
         }
 
         var upperBound = record.endTime;
-        if (typeof this.maximumBoundary === "undefined" || upperBound > this.maximumBoundary) {
-            this.maximumBoundary = upperBound;
+        if (typeof this._absoluteMaximumBoundary === "undefined" || upperBound > this._absoluteMaximumBoundary) {
+            this._absoluteMaximumBoundary = upperBound;
+            delete this._maximumBoundary;
             didChange = true;
         }
 
         return didChange;
     },
 
-    formatValue: function(value)
+    get boundarySpan()
     {
-        return Number.secondsToString(value, WebInspector.UIString.bind(WebInspector));
+        return this.maximumBoundary - this.minimumBoundary;
     },
 
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value + this.minimumBoundary - this._absoluteMinimumBoundary, this._uiString);
+    }
 }
 
-WebInspector.TimelineCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
-
-WebInspector.TimelineGraph = function(record)
+WebInspector.TimelineRecordListRow = function()
 {
-    this.record = record;
+    this.element = document.createElement("div");
+    this.element.listRow = this;
+    var iconElement = document.createElement("span");
+    iconElement.className = "timeline-tree-icon";
+    this.element.appendChild(iconElement);
 
-    this._graphElement = document.createElement("div");
-    this._graphElement.className = "timeline-graph-side";
+    this._typeElement = document.createElement("span");
+    this._typeElement.className = "type";
+    this.element.appendChild(this._typeElement);
 
-    this._barAreaElement = document.createElement("div");
-    this._barAreaElement.className = "timeline-graph-bar-area hidden";
-    this._graphElement.appendChild(this._barAreaElement);
+    var separatorElement = document.createElement("span");
+    separatorElement.className = "separator";
+    separatorElement.textContent = " ";
 
-    this._barElement = document.createElement("div");
-    this._barElement.className = "timeline-graph-bar";
-    this._barAreaElement.appendChild(this._barElement);
+    this._dataElement = document.createElement("span");
+    this._dataElement.className = "data dimmed";
+
+    this._repeatCountElement = document.createElement("span");
+    this._repeatCountElement.className = "count";
 
-    this._graphElement.addStyleClass("timeline-category-" + record.category.name);
+    this.element.appendChild(separatorElement);
+    this.element.appendChild(this._dataElement);
+    this.element.appendChild(this._repeatCountElement);
 }
 
-WebInspector.TimelineGraph.prototype = {
-    get graphElement()
+WebInspector.TimelineRecordListRow.prototype = {
+    update: function(record, isEven)
     {
-        return this._graphElement;
-    },
+        this.element.className = "timeline-tree-item timeline-category-" + record.category.name + (isEven ? " even" : "");
+        this._typeElement.textContent = record.title;
 
-    refreshLabelPositions: function()
-    {
+        if (record.details) {
+            this._dataElement.textContent = "(" + record.details + ")";
+            this._dataElement.title = record.details;
+        } else {
+            this._dataElement.textContent = "";
+            this._dataElement.title = "";
+        }
+
+        if (record.count > 1)
+            this._repeatCountElement.textContent = "\u2009\u00d7\u2009" + record.count;
+        else
+            this._repeatCountElement.textContent = "";
     },
 
-    refresh: function(calculator)
+    dispose: function()
     {
-        var percentages = calculator.computeBarGraphPercentages(this.record);
-        var labels = calculator.computeBarGraphLabels(this.record);
+        this.element.parentElement.removeChild(this.element);
+    }
+}
 
-        this._percentages = percentages;
 
-        this._barAreaElement.removeStyleClass("hidden");
+WebInspector.TimelineRecordGraphRow = function(graphContainer, refreshCallback, rowHeight)
+{
+    this.element = document.createElement("div");
+    this.element.graphRow = this;
 
-        if (!this._graphElement.hasStyleClass("timeline-category-" + this.record.category.name)) {
-            this._graphElement.removeMatchingStyleClasses("timeline-category-\\w+");
-            this._graphElement.addStyleClass("timeline-category-" + this.record.category.name);
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area";
+    this.element.appendChild(this._barAreaElement);
+
+    this._barElement = document.createElement("div");
+    this._barElement.className = "timeline-graph-bar";
+    this._barAreaElement.appendChild(this._barElement);
+
+    this._expandElement = document.createElement("div");
+    this._expandElement.className = "timeline-expandable";
+    graphContainer.appendChild(this._expandElement);
+
+    var leftBorder = document.createElement("div");
+    leftBorder.className = "timeline-expandable-left";
+    this._expandElement.appendChild(leftBorder);
+
+    this._expandElement.addEventListener("click", this._onClick.bind(this));
+    this._refreshCallback = refreshCallback;
+    this._rowHeight = rowHeight;
+}
+
+WebInspector.TimelineRecordGraphRow.prototype = {
+    update: function(record, isEven, calculator, clientWidth, expandOffset)
+    {
+        this._record = record;
+        this.element.className = "timeline-graph-side timeline-category-" + record.category.name + (isEven ? " even" : "");
+        var percentages = calculator.computeBarGraphPercentages(record);
+        var left = percentages.start / 100 * clientWidth;
+        var width = (percentages.end - percentages.start) / 100 * clientWidth;
+        this._barElement.style.left = (left + expandOffset) + "px";
+        this._barElement.style.width = width + "px";
+
+        if (record.visibleChildrenCount) {
+            this._expandElement.style.top = this.element.offsetTop + "px";
+            this._expandElement.style.left = left + "px";
+            this._expandElement.style.width = Math.max(12, width + 25) + "px";
+            if (!record.collapsed) {
+                this._expandElement.style.height = (record.visibleChildrenCount + 1) * this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-expanded");
+                this._expandElement.removeStyleClass("timeline-expandable-collapsed");
+            } else {
+                this._expandElement.style.height = this._rowHeight + "px";
+                this._expandElement.addStyleClass("timeline-expandable-collapsed");
+                this._expandElement.removeStyleClass("timeline-expandable-expanded");
+            }
+            this._expandElement.removeStyleClass("hidden");
+        } else {
+            this._expandElement.addStyleClass("hidden");
         }
+    },
 
-        this._barElement.style.setProperty("left", percentages.start + "%");
-        this._barElement.style.setProperty("right", (100 - percentages.end) + "%");
+    _onClick: function(event)
+    {
+        this._record.collapsed = !this._record.collapsed;
+        this._refreshCallback();
+    },
 
-        var tooltip = (labels.tooltip || "");
-        this._barElement.title = tooltip;
+    dispose: function()
+    {
+        this.element.parentElement.removeChild(this.element);
+        this._expandElement.parentElement.removeChild(this._expandElement);
     }
 }
diff --git a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
index 1b07883..bfcc25e 100644
--- a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -82,6 +82,7 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             return;
 
         this._save();
+        profileDataGrideNode.savePosition();
 
         this.children = [profileDataGrideNode];
         this.totalTime = profileDataGrideNode.totalTime;
@@ -102,6 +103,16 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             this.sort(this.lastComparator, true);
     },
 
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children[0].restorePosition();
+
+        WebInspector.ProfileDataGridTree.prototype.restore.call(this);
+    },
+
     _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge,
 
     _sharedPopulate: WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate
diff --git a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 96a20ab..4804897 100644
--- a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -67,6 +67,8 @@ WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.Side
 
 WebInspector.WatchExpressionsSection = function()
 {
+    this._watchObjectGroupId = "watch-group";
+
     WebInspector.ObjectPropertiesSection.call(this);
 
     this.watchExpressions = this.loadSavedExpressions();
@@ -75,8 +77,6 @@ WebInspector.WatchExpressionsSection = function()
     this.editable = true;
     this.expanded = true;
     this.propertiesElement.addStyleClass("watch-expressions");
-
-    this._watchObjectGroupId = "watch-group";
 }
 
 WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
@@ -112,11 +112,22 @@ WebInspector.WatchExpressionsSection.prototype = {
             // method to get all the properties refreshed at once.
             properties.push(property);
             
-            if (properties.length == propertyCount)
+            if (properties.length == propertyCount) {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+
+                // check to see if we just added a new watch expression,
+                // which will always be the last property
+                if (this._newExpressionAdded) {
+                    delete this._newExpressionAdded;
+
+                    treeElement = this.findAddedTreeElement();
+                    if (treeElement)
+                        treeElement.startEditing();
+                }
+            }
         }
 
-        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
+        InspectorBackend.releaseWrapperObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
@@ -150,14 +161,9 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     addExpression: function()
     {
+        this._newExpressionAdded = true;
         this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
         this.update();
-
-        // After update(), the new empty expression to be edited
-        // will be in the tree, but we have to find it.
-        treeElement = this.findAddedTreeElement();
-        if (treeElement)
-            treeElement.startEditing();
     },
 
     updateExpression: function(element, value)
@@ -177,7 +183,7 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     loadSavedExpressions: function()
     {
-        var json = InspectorController.setting("watchExpressions");
+        var json = InspectorFrontendHost.setting("watchExpressions");
         if (!json)
             return [];
 
@@ -198,7 +204,7 @@ WebInspector.WatchExpressionsSection.prototype = {
                 toSave.push(this.watchExpressions[i]);
 
         var json = JSON.stringify({expressions: toSave});
-        InspectorController.setSetting("watchExpressions", json);
+        InspectorFrontendHost.setSetting("watchExpressions", json);
 
         return toSave.length;
     }
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index a1d671e..eb299fc 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -9,7 +9,9 @@
     <file>CallStackSidebarPane.js</file>
     <file>ChangesView.js</file>
     <file>Color.js</file>
+    <file>ConsolePanel.js</file>
     <file>ConsoleView.js</file>
+    <file>ContextMenu.js</file>
     <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
@@ -17,7 +19,6 @@
     <file>DataGrid.js</file>
     <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
-    <file>DOMStorageDataGrid.js</file>
     <file>DOMStorageItemsView.js</file>
     <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
@@ -28,6 +29,8 @@
     <file>InjectedScript.js</file>
     <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
+    <file>InspectorBackendStub.js</file>
+    <file>InspectorFrontendHostStub.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
     <file>Object.js</file>
@@ -61,6 +64,8 @@
     <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
+    <file>TimelineGrid.js</file>
+    <file>TimelineOverviewPane.js</file>
     <file>TimelinePanel.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
@@ -75,6 +80,7 @@
     <file>Images/closeButtons.png</file>
     <file>Images/consoleButtonGlyph.png</file>
     <file>Images/cookie.png</file>
+    <file>Images/consoleIcon.png</file>
     <file>Images/database.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
@@ -161,6 +167,15 @@
     <file>Images/statusbarResizerVertical.png</file>
     <file>Images/storageIcon.png</file>
     <file>Images/successGreenDot.png</file>
+    <file>Images/timelineBarBlue.png</file>
+    <file>Images/timelineBarGray.png</file>
+    <file>Images/timelineBarGreen.png</file>
+    <file>Images/timelineBarOrange.png</file>
+    <file>Images/timelineBarPurple.png</file>
+    <file>Images/timelineBarRed.png</file>
+    <file>Images/timelineBarYellow.png</file>
+    <file>Images/timelineCheckmarks.png</file>
+    <file>Images/timelineDots.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -168,6 +183,7 @@
     <file>Images/timelineHollowPillPurple.png</file>
     <file>Images/timelineHollowPillRed.png</file>
     <file>Images/timelineHollowPillYellow.png</file>
+    <file>Images/timelineIcon.png</file>
     <file>Images/timelinePillBlue.png</file>
     <file>Images/timelinePillGray.png</file>
     <file>Images/timelinePillGreen.png</file>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 78ab23d..7cae8b2 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -94,7 +94,7 @@ body.attached #toolbar {
     padding-left: 0;
 }
 
-body.attached.platform-qt #toolbar {
+body.attached.port-qt #toolbar {
     cursor: auto;
 }
 
@@ -215,6 +215,10 @@ body.attached #search-results-matches {
     background-image: url(Images/profilesIcon.png);
 }
 
+.toolbar-item.console .toolbar-icon {
+    background-image: url(Images/consoleIcon.png);
+}
+
 #close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
@@ -237,7 +241,7 @@ body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right
     display: none;
 }
 
-body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+body.attached.port-qt .toolbar-item.close-left, body.attached.port-qt .toolbar-item.close-right {
     display: none;
 }
 
@@ -392,7 +396,7 @@ body.detached #dock-status-bar-item .glyph {
     -webkit-mask-image: url(Images/dockButtonGlyph.png);
 }
 
-body.platform-qt #dock-status-bar-item {
+body.port-qt #dock-status-bar-item {
     display: none
 }
 
@@ -1432,7 +1436,7 @@ body.inactive .placard.selected {
 }
 
 .event-bars .event-bar .header .subtitle {
-    color: rgba(90, 90, 90, 0.742188);
+    color: rgba(90, 90, 90, 0.75);
 }
 
 .event-bars .event-bar .header::before {
@@ -1777,8 +1781,8 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
 .sidebar {
     position: absolute;
     top: 0;
+    min-height: 100%;
     left: 0;
-    bottom: 0;
     width: 200px;
     overflow-y: auto;
     overflow-x: hidden;
@@ -1957,6 +1961,7 @@ body.inactive .sidebar {
 .data-grid td {
     vertical-align: top;
     height: 12px;
+    line-height: 12px;
     padding: 2px 4px;
     white-space: nowrap;
     border-right: 1px solid #aaa;
@@ -2413,9 +2418,14 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
-#resources-filter {
+#resources-filter, #console-filter.console-filter-top {
     background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
     border-bottom: 1px solid rgb(64%, 64%, 64%);
+    width: 100%;
+}
+
+#console-messages.console-filter-top {
+    margin-top: 23px;
 }
 
 #console-filter {
@@ -2589,7 +2599,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #resources-dividers-label-bar {
     position: absolute;
-    top: 93px;
+    top: 0;
     left: 0px;
     right: 0;
     background-color: rgba(255, 255, 255, 0.8);
@@ -2740,6 +2750,10 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: block;
 }
 
+.console-user-command-result {
+    display: block;
+}
+
 .resources-graph-bar.waiting {
     opacity: 0.35;
 }
@@ -2857,7 +2871,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 .sidebar-resizer-vertical {
     position: absolute;
     top: 0;
-    bottom: 0;
+    min-height: 100%;
     width: 5px;
     z-index: 500;
     cursor: col-resize;
@@ -3266,20 +3280,148 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 
 /* Timeline Style */
 
-#timeline-summary {
+#timeline-overview-panel {
     position: absolute;
     top: 0;
     left: 0;
-    width: 0;
-    height: 0;
+    right: 0;
+    height: 80px;
+}
+
+.timeline-sidebar-background {
+    top: 90px;
+    bottom: 0;
+}
+
+.timeline .sidebar {
+    overflow-y: hidden;
+    z-index: 100;
+}
+
+#timeline-overview-separator {
+    position: absolute;
+    top: 80px;
+    left: 0;
+    right: 0;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(253, 253, 253)), to(rgb(213, 213, 213)));
+    border-top: 1px solid rgb(140, 140, 140);
+    border-bottom: 1px solid rgb(115, 115, 115);
+    height: 10px;
+}
+
+#timeline-overview-sidebar {
+    position: absolute;
+    width: 200px;
+    top: 0px;
+    bottom: 0px;
+    left: 0px;
+    padding-top: 1px;
+    background: -webkit-gradient(linear, 0% 0%, 0% 100%, from(rgb(242, 242, 242)), to(rgb(209, 209, 209)));
+    border-right: 1px solid rgb(163, 163, 163);
+}
+
+#timeline-overview-grid {
+    position: absolute;
+    top: 0px;
+    bottom: 0px;
+    left: 200px;
+    right: 0px;
+    background-color: rgb(224, 224, 224);
+}
+
+#timeline-overview-window {
+    background-color: white;
+    position: absolute;
+    left: 0;
+    right: 0;
+    top: 0;
+    bottom: 0;
+    z-index: 150;
+}
+
+.timeline-window-resizer {
+    position: absolute;
+    top: 35px;
+    bottom: 15px;
+    width: 5px;
+    margin-left: -3px;
+    margin-right: -2px;
+    background-color: rgb(153, 153, 153);
+    z-index: 500;
+    cursor: col-resize;
+    -webkit-border-radius: 2px;
+    -webkit-box-shadow: white 1px 0 0, white -1px 0 0, white 0 1px 0, white 0 -1px 0;
+}
+
+#timeline-overview-grid #resources-graphs {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 80px;
+}
+
+#timeline-container {
+    position: absolute;
+    top: 90px;
+    left: 0;
+    bottom: 0;
+    right: 0;
+    border-right: 0 none transparent;
+    overflow-y: auto;
+    overflow-x: hidden;
 }
 
 .timeline-clear-status-bar-item .glyph {
     -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
 }
 
+.timeline-category-tree-item {
+    height: 20px;
+    line-height: 20px;
+    padding-left: 6px;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+    font-weight: bold;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox {
+    width: 10px;
+    height: 11px;
+    margin: 0 3px 0 5px;
+    padding: 0;
+    background-image: url(Images/timelineCheckmarks.png);
+    background-repeat: no-repeat;
+    background-position: 0 -66px;
+    vertical-align: -1px;
+    -webkit-appearance: none;
+}
+
+.timeline-category-tree-item .timeline-category-checkbox:checked {
+    background-position-x: -10px;
+}
+
+.timeline-category-tree-item.timeline-category-loading .timeline-category-checkbox {
+    background-position-y: 0;
+}
+
+.timeline-category-tree-item.timeline-category-scripting .timeline-category-checkbox {
+    background-position-y: -33px;
+}
+
+.timeline-category-tree-item.timeline-category-rendering .timeline-category-checkbox {
+    background-position-y: -11px;
+}
+
+.timeline-category-tree-item:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
 .timeline-tree-item {
     height: 18px;
+    line-height: 15px;
+    padding-right: 5px;
     padding-left: 10px;
     padding-top: 2px;
     white-space: nowrap;
@@ -3287,10 +3429,44 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     overflow: hidden;
 }
 
+.timeline-expandable {
+    position: absolute;
+    border-left: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-left {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    width: 3px;
+    border-top: 1px solid rgb(163, 163, 163);
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.timeline-expandable-collapsed {
+    background-image: url(Images/disclosureTriangleSmallRightBlack.png);
+    background-position-x: 1px;
+    background-position-y: 2px;
+    background-repeat: no-repeat;
+}
+
+.timeline-expandable-expanded {
+    background-image: url(Images/disclosureTriangleSmallDownBlack.png);
+    background-position-x: 1px;
+    background-position-y: 3px;
+    background-repeat: no-repeat;
+}
+
 .timeline-tree-item .type {
     padding-left: 14px;
 }
 
+.timeline-tree-item .count {
+    font-family: Helvetica, Arial, sans-serif;
+    font-weight: bold;
+}
+
 .timeline-tree-item .timeline-tree-icon {
     background-image: url(Images/timelineDots.png);
     margin-top: 2px;
@@ -3299,7 +3475,7 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     position: absolute;
 }
 
-.timeline-tree-item:nth-of-type(2n) {
+.timeline-tree-item.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
@@ -3307,14 +3483,12 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     color: rgba(0, 0, 0, 0.7);
 }
 
-.timeline-category-loading, .timeline-category-scripting, .timeline-category-rendering {
-    display: none;
-}
-
-.filter-all .timeline-category-loading, .filter-loading .timeline-category-loading,
-.filter-all .timeline-category-scripting, .filter-scripting .timeline-category-scripting,
-.filter-all .timeline-category-rendering, .filter-rendering .timeline-category-rendering {
-    display: list-item;
+#timeline-overview-graphs {
+    position: absolute;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    top: 20px;
 }
 
 #timeline-graphs {
@@ -3333,29 +3507,42 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     margin-top: 0px;
     border-top: 1px solid transparent;
     overflow: hidden;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side {
+    height: 20px;
+    z-index: 170;
+    pointer-events: none;
+}
+
+.timeline-overview-graph-side .timeline-graph-bar {
+    height: 13px;
 }
 
 .timeline-graph-bar-area {
     position: absolute;
     top: 0;
     bottom: 0;
-    right: 8px;
-    left: 9px;
+    right: 0;
+    left: 3px;
+    pointer-events: none;
 }
 
 .timeline-graph-bar {
     position: absolute;
     top: 0;
     bottom: 0;
-    margin: auto -5px;
+    margin: auto -2px;
     border-width: 4px 4px 5px;
     height: 9px;
-    min-width: 7px;
+    min-width: 5px;
     opacity: 0.8;
     -webkit-border-image: url(Images/timelineBarGray.png) 4 4 5 4;
+    pointer-events: none;
 }
 
-.timeline-graph-side:nth-of-type(2n) {
+.timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
 
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index 04ab07a..77c7760 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -34,8 +34,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
-    <script type="text/javascript" src="InspectorControllerStub.js"></script>
+    <script type="text/javascript" src="InspectorBackendStub.js"></script>
+    <script type="text/javascript" src="InspectorFrontendHostStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
+    <script type="text/javascript" src="ContextMenu.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
     <script type="text/javascript" src="Popup.js"></script>
@@ -46,6 +48,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
+    <script type="text/javascript" src="TimelineGrid.js"></script>    
     <script type="text/javascript" src="AbstractTimelinePanel.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
@@ -53,7 +56,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
-    <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
     <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
@@ -80,6 +82,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ScriptsPanel.js"></script>
     <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
+    <script type="text/javascript" src="ConsolePanel.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
     <script type="text/javascript" src="SourceView.js"></script>
@@ -97,6 +100,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
+    <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
@@ -109,7 +113,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
-        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item toggled"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
+        <div id="main-status-bar" class="status-bar"><div id="anchored-status-bar-items"><button id="dock-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><button id="changes-status-bar-item" class="status-bar-item hidden"></button><div id="count-items"><div id="changes-count" class="hidden"></div><div id="error-warning-count" class="hidden"></div></div></div></div>
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index c24d589..3f21f4f 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -46,10 +46,57 @@ var Preferences = {
     resourcesLargeRows: true
 }
 
+function preloadImages()
+{
+    (new Image()).src = "Images/clearConsoleButtonGlyph.png";
+    (new Image()).src = "Images/consoleButtonGlyph.png";
+    (new Image()).src = "Images/dockButtonGlyph.png";
+    (new Image()).src = "Images/enableOutlineButtonGlyph.png";
+    (new Image()).src = "Images/enableSolidButtonGlyph.png";
+    (new Image()).src = "Images/excludeButtonGlyph.png";
+    (new Image()).src = "Images/focusButtonGlyph.png";
+    (new Image()).src = "Images/largerResourcesButtonGlyph.png";
+    (new Image()).src = "Images/nodeSearchButtonGlyph.png";
+    (new Image()).src = "Images/pauseOnExceptionButtonGlyph.png";
+    (new Image()).src = "Images/percentButtonGlyph.png";
+    (new Image()).src = "Images/recordButtonGlyph.png";
+    (new Image()).src = "Images/recordToggledButtonGlyph.png";
+    (new Image()).src = "Images/reloadButtonGlyph.png";
+    (new Image()).src = "Images/undockButtonGlyph.png";
+}
+
+preloadImages();
+
 var WebInspector = {
     resources: {},
     resourceURLMap: {},
+    cookieDomains: {},
     missingLocalizedStrings: {},
+    pendingDispatches: 0,
+
+    // RegExp groups:
+    // 1 - scheme
+    // 2 - hostname
+    // 3 - ?port
+    // 4 - ?path
+    // 5 - ?fragment
+    URLRegExp: /^(http[s]?|file):\/\/([^\/:]+)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
+
+    get platform()
+    {
+        if (!("_platform" in this))
+            this._platform = InspectorFrontendHost.platform();
+
+        return this._platform;
+    },
+
+    get port()
+    {
+        if (!("_port" in this))
+            this._port = InspectorFrontendHost.port();
+
+        return this._port;
+    },
 
     get previousFocusElement()
     {
@@ -126,41 +173,43 @@ var WebInspector = {
 
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
-                InspectorController.storeLastActivePanel(panelName);
+                InspectorBackend.storeLastActivePanel(panelName);
         }
     },
 
     _createPanels: function()
     {
-        var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+        var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
         if (hiddenPanels.indexOf("elements") === -1)
             this.panels.elements = new WebInspector.ElementsPanel();
         if (hiddenPanels.indexOf("resources") === -1)
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
+        if (hiddenPanels.indexOf("timeline") === -1)
+            this.panels.timeline = new WebInspector.TimelinePanel();
         if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
         }
-        if (hiddenPanels.indexOf("timeline") === -1 && hiddenPanels.indexOf("timeline") === -1)
-            this.panels.timeline = new WebInspector.TimelinePanel();
 
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
             this.panels.storage = new WebInspector.StoragePanel();
+        if (hiddenPanels.indexOf("console") === -1)
+            this.panels.console = new WebInspector.ConsolePanel();
     },
 
     _loadPreferences: function()
     {
-        var colorFormat = InspectorController.setting("color-format");
+        var colorFormat = InspectorFrontendHost.setting("color-format");
         if (colorFormat)
             Preferences.colorFormat = colorFormat;
 
-        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        var eventListenersFilter = InspectorFrontendHost.setting("event-listeners-filter");
         if (eventListenersFilter)
             Preferences.eventListenersFilter = eventListenersFilter;
 
-        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        var resourcesLargeRows = InspectorFrontendHost.setting("resources-large-rows");
         if (typeof resourcesLargeRows !== "undefined")
             Preferences.resourcesLargeRows = resourcesLargeRows;
     },
@@ -183,12 +232,12 @@ var WebInspector = {
         var body = document.body;
 
         if (x) {
-            InspectorController.attach();
+            InspectorFrontendHost.attach();
             body.removeStyleClass("detached");
             body.addStyleClass("attached");
             dockToggleButton.title = WebInspector.UIString("Undock into separate window.");
         } else {
-            InspectorController.detach();
+            InspectorFrontendHost.detach();
             body.removeStyleClass("attached");
             body.addStyleClass("detached");
             dockToggleButton.title = WebInspector.UIString("Dock to main window.");
@@ -357,10 +406,10 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
+            InspectorBackend.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
-            InspectorController.hideDOMNodeHighlight();
+            InspectorBackend.hideDOMNodeHighlight();
             this.showingDOMNodeHighlight = false;
         }
     }
@@ -368,11 +417,12 @@ var WebInspector = {
 
 WebInspector.loaded = function()
 {
-    var platform = InspectorController.platform();
+    var platform = WebInspector.platform;
     document.body.addStyleClass("platform-" + platform);
+    var port = WebInspector.port;
+    document.body.addStyleClass("port-" + port);
 
     this._loadPreferences();
-    this.pendingDispatches = 0;
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -429,11 +479,9 @@ WebInspector.loaded = function()
     document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
-    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
+    document.addEventListener("contextmenu", this.contextMenuEventFired.bind(this), true);
 
     var mainPanelsElement = document.getElementById("main-panels");
-    mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
-    mainPanelsElement.handleKeyUpEvent = this.mainKeyUp.bind(this);
     mainPanelsElement.handleCopyEvent = this.mainCopy.bind(this);
 
     // Focus the mainPanelsElement in a timeout so it happens after the initial focus,
@@ -461,23 +509,24 @@ WebInspector.loaded = function()
 
     var searchField = document.getElementById("search");
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
+    searchField.addEventListener("mousedown", this.searchFieldManualFocus.bind(this), false); // when the search field is manually selected
 
     toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
     document.getElementById("close-button-left").addEventListener("click", this.close, true);
     document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
-    InspectorController.loaded();
+    InspectorFrontendHost.loaded();
 }
 
 var windowLoaded = function()
 {
-    var localizedStringsURL = InspectorController.localizedStringsURL();
+    var localizedStringsURL = InspectorFrontendHost.localizedStringsURL();
     if (localizedStringsURL) {
         var localizedStringsScriptElement = document.createElement("script");
         localizedStringsScriptElement.addEventListener("load", WebInspector.loaded.bind(WebInspector), false);
         localizedStringsScriptElement.type = "text/javascript";
         localizedStringsScriptElement.src = localizedStringsURL;
-        document.getElementsByTagName("head").item(0).appendChild(localizedStringsScriptElement);
+        document.head.appendChild(localizedStringsScriptElement);
     } else
         WebInspector.loaded();
 
@@ -504,13 +553,14 @@ WebInspector.dispatch = function() {
 
 WebInspector.windowUnload = function(event)
 {
-    InspectorController.windowUnloading();
+    InspectorFrontendHost.windowUnloading();
 }
 
 WebInspector.windowResize = function(event)
 {
     if (this.currentPanel && this.currentPanel.resize)
         this.currentPanel.resize();
+    this.drawer.resize();
 }
 
 WebInspector.windowFocused = function(event)
@@ -543,7 +593,7 @@ WebInspector.setAttachedWindow = function(attached)
 
 WebInspector.close = function(event)
 {
-    InspectorController.closeWindow();
+    InspectorFrontendHost.closeWindow();
 }
 
 WebInspector.documentClick = function(event)
@@ -588,20 +638,28 @@ WebInspector.documentClick = function(event)
 
 WebInspector.documentKeyDown = function(event)
 {
-    if (!this.currentFocusElement)
-        return;
-    if (this.currentFocusElement.handleKeyEvent)
-        this.currentFocusElement.handleKeyEvent(event);
-    else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "KeyDown"])
-        WebInspector[this.currentFocusElement.id + "KeyDown"](event);
+    if (this.currentFocusElement) {
+        if (this.currentFocusElement.handleKeyEvent)
+            this.currentFocusElement.handleKeyEvent(event);
+        else if (this.currentFocusElement.id && this.currentFocusElement.id.length && WebInspector[this.currentFocusElement.id + "KeyDown"])
+            WebInspector[this.currentFocusElement.id + "KeyDown"](event);
+        if (event.handled)
+            return;
+    }
+
+    if (this.currentPanel && this.currentPanel.handleKeyEvent)
+        this.currentPanel.handleKeyEvent(event);
 
     if (!event.handled) {
-        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var isMac = WebInspector.isMac();
 
         switch (event.keyIdentifier) {
             case "U+001B": // Escape key
-                this.drawer.visible = !this.drawer.visible;
                 event.preventDefault();
+                if (this.drawer.fullPanel)
+                    return;
+
+                this.drawer.visible = !this.drawer.visible;
                 break;
 
             case "U+0046": // F key
@@ -675,9 +733,15 @@ WebInspector.documentKeyDown = function(event)
 
 WebInspector.documentKeyUp = function(event)
 {
-    if (!this.currentFocusElement || !this.currentFocusElement.handleKeyUpEvent)
-        return;
-    this.currentFocusElement.handleKeyUpEvent(event);
+    if (this.currentFocusElement) {
+        if (this.currentFocusElement.handleKeyUpEvent)
+            this.currentFocusElement.handleKeyUpEvent(event);
+        if (event.handled)
+            return;
+    }
+
+    if (this.currentPanel && this.currentPanel.handleKeyUpEvent)
+        this.currentPanel.handleKeyUpEvent(event);
 }
 
 WebInspector.documentCanCopy = function(event)
@@ -701,53 +765,43 @@ WebInspector.documentCopy = function(event)
         WebInspector[this.currentFocusElement.id + "Copy"](event);
 }
 
-WebInspector.contextMenu = function(event)
+WebInspector.contextMenuEventFired = function(event)
 {
     if (event.handled || event.target.hasStyleClass("popup-glasspane"))
         event.preventDefault();
 }
 
-WebInspector.mainKeyDown = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleKeyEvent)
-        this.currentPanel.handleKeyEvent(event);
-}
-
-WebInspector.mainKeyUp = function(event)
-{
-    if (this.currentPanel && this.currentPanel.handleKeyUpEvent)
-        this.currentPanel.handleKeyUpEvent(event);
-}
-
 WebInspector.mainCopy = function(event)
 {
     if (this.currentPanel && this.currentPanel.handleCopyEvent)
         this.currentPanel.handleCopyEvent(event);
 }
 
-WebInspector.animateStyle = function(animations, duration, callback, complete)
+WebInspector.animateStyle = function(animations, duration, callback)
 {
-    if (complete === undefined)
-        complete = 0;
-    var slice = (1000 / 30); // 30 frames per second
+    var interval;
+    var complete = 0;
+
+    const intervalDuration = (1000 / 30); // 30 frames per second.
+    const animationsLength = animations.length;
+    const propertyUnit = {opacity: ""};
+    const defaultUnit = "px";
 
-    var defaultUnit = "px";
-    var propertyUnit = {opacity: ""};
+    function cubicInOut(t, b, c, d)
+    {
+        if ((t/=d/2) < 1) return c/2*t*t*t + b;
+        return c/2*((t-=2)*t*t + 2) + b;
+    }
 
-    for (var i = 0; i < animations.length; ++i) {
+    // Pre-process animations.
+    for (var i = 0; i < animationsLength; ++i) {
         var animation = animations[i];
-        var element = null;
-        var start = null;
-        var current = null;
-        var end = null;
-        var key = null;
+        var element = null, start = null, end = null, key = null;
         for (key in animation) {
             if (key === "element")
                 element = animation[key];
             else if (key === "start")
                 start = animation[key];
-            else if (key === "current")
-                current = animation[key];
             else if (key === "end")
                 end = animation[key];
         }
@@ -755,49 +809,54 @@ WebInspector.animateStyle = function(animations, duration, callback, complete)
         if (!element || !end)
             continue;
 
-        var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
         if (!start) {
+            var computedStyle = element.ownerDocument.defaultView.getComputedStyle(element);
             start = {};
             for (key in end)
                 start[key] = parseInt(computedStyle.getPropertyValue(key));
             animation.start = start;
-        } else if (complete == 0)
+        } else
             for (key in start)
                 element.style.setProperty(key, start[key] + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+    }
 
-        if (!current) {
-            current = {};
-            for (key in start)
-                current[key] = start[key];
-            animation.current = current;
-        }
-
-        function cubicInOut(t, b, c, d)
-        {
-            if ((t/=d/2) < 1) return c/2*t*t*t + b;
-            return c/2*((t-=2)*t*t + 2) + b;
+    function animateLoop()
+    {
+        // Advance forward.
+        complete += intervalDuration;
+        var next = complete + intervalDuration;
+
+        // Make style changes.
+        for (var i = 0; i < animationsLength; ++i) {
+            var animation = animations[i];
+            var element = animation.element;
+            var start = animation.start;
+            var end = animation.end;
+            if (!element || !end)
+                continue;
+
+            var style = element.style;
+            for (key in end) {
+                var endValue = end[key];
+                if (next < duration) {
+                    var startValue = start[key];
+                    var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
+                    style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+                } else
+                    style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
+            }
         }
 
-        var style = element.style;
-        for (key in end) {
-            var startValue = start[key];
-            var currentValue = current[key];
-            var endValue = end[key];
-            if ((complete + slice) < duration) {
-                var delta = (endValue - startValue) / (duration / slice);
-                var newValue = cubicInOut(complete, startValue, endValue - startValue, duration);
-                style.setProperty(key, newValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-                current[key] = newValue;
-            } else {
-                style.setProperty(key, endValue + (key in propertyUnit ? propertyUnit[key] : defaultUnit));
-            }
+        // End condition.
+        if (complete >= duration) {
+            clearInterval(interval);
+            if (callback)
+                callback();
         }
     }
 
-    if (complete < duration)
-        setTimeout(WebInspector.animateStyle, slice, animations, duration, callback, complete + slice);
-    else if (callback)
-        callback();
+    interval = setInterval(animateLoop, intervalDuration);
+    return interval;
 }
 
 WebInspector.updateSearchLabel = function()
@@ -817,11 +876,12 @@ WebInspector.updateSearchLabel = function()
 WebInspector.toggleAttach = function()
 {
     this.attached = !this.attached;
+    this.drawer.resize();
 }
 
 WebInspector.toolbarDragStart = function(event)
 {
-    if ((!WebInspector.attached && InspectorController.platform() !== "mac-leopard") || InspectorController.platform() == "qt")
+    if ((!WebInspector.attached && WebInspector.platform !== "mac-leopard") || WebInspector.port == "qt")
         return;
 
     var target = event.target;
@@ -855,14 +915,14 @@ WebInspector.toolbarDrag = function(event)
     if (WebInspector.attached) {
         var height = window.innerHeight - (event.screenY - toolbar.lastScreenY);
 
-        InspectorController.setAttachedWindowHeight(height);
+        InspectorFrontendHost.setAttachedWindowHeight(height);
     } else {
         var x = event.screenX - toolbar.lastScreenX;
         var y = event.screenY - toolbar.lastScreenY;
 
         // We cannot call window.moveBy here because it restricts the movement
         // of the window at the edges.
-        InspectorController.moveByUnrestricted(x, y);
+        InspectorFrontendHost.moveWindowBy(x, y);
     }
 
     toolbar.lastScreenX = event.screenX;
@@ -925,6 +985,11 @@ WebInspector.showScriptsPanel = function()
     this.currentPanel = this.panels.scripts;
 }
 
+WebInspector.showTimelinePanel = function()
+{
+    this.currentPanel = this.panels.timeline;
+}
+
 WebInspector.showProfilesPanel = function()
 {
     this.currentPanel = this.panels.profiles;
@@ -935,11 +1000,17 @@ WebInspector.showStoragePanel = function()
     this.currentPanel = this.panels.storage;
 }
 
+WebInspector.showConsolePanel = function()
+{
+    this.currentPanel = this.panels.console;
+}
+
 WebInspector.addResource = function(identifier, payload)
 {
     var resource = new WebInspector.Resource(
         payload.requestHeaders,
         payload.requestURL,
+        payload.documentURL,
         payload.host,
         payload.path,
         payload.lastPathComponent,
@@ -956,6 +1027,10 @@ WebInspector.addResource = function(identifier, payload)
 
     if (this.panels.resources)
         this.panels.resources.addResource(resource);
+
+    var match = payload.documentURL.match(/^(http[s]?|file):\/\/([\/]*[^\/]+)/i);
+    if (match)
+        this.addCookieDomain(match[1].toLowerCase() === "file" ? "" : match[2]);
 }
 
 WebInspector.clearConsoleMessages = function()
@@ -1021,7 +1096,7 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
-        
+
         if (payload.loadEventTime) {
             // This loadEventTime is for the main resource, and we want to show it
             // for all resources on this page. This means we want to set it as a member
@@ -1029,7 +1104,7 @@ WebInspector.updateResource = function(identifier, payload)
             if (this.panels.resources)
                 this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
         }
-        
+
         if (payload.domContentEventTime) {
             // This domContentEventTime is for the main resource, so it should go in
             // the resources panel for the same reasons as above.
@@ -1055,6 +1130,8 @@ WebInspector.removeResource = function(identifier)
 
 WebInspector.addDatabase = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var database = new WebInspector.Database(
         payload.id,
         payload.domain,
@@ -1065,12 +1142,20 @@ WebInspector.addDatabase = function(payload)
 
 WebInspector.addCookieDomain = function(domain)
 {
-    if (this.panels.storage)
-        this.panels.storage.addCookieDomain(domain);
+    // Eliminate duplicate domains from the list.
+    if (domain in this.cookieDomains)
+        return;
+    this.cookieDomains[domain] = true;
+
+    if (!this.panels.storage)
+        return;
+    this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
 {
+    if (!this.panels.storage)
+        return;
     var domStorage = new WebInspector.DOMStorage(
         payload.id,
         payload.host,
@@ -1080,6 +1165,8 @@ WebInspector.addDOMStorage = function(payload)
 
 WebInspector.updateDOMStorage = function(storageId)
 {
+    if (!this.panels.storage)
+        return;
     this.panels.storage.updateDOMStorage(storageId);
 }
 
@@ -1160,6 +1247,7 @@ WebInspector.reset = function()
 
     this.resources = {};
     this.resourceURLMap = {};
+    this.cookieDomains = {};
     this.hoveredDOMNode = null;
 
     delete this.mainResource;
@@ -1202,23 +1290,23 @@ WebInspector.log = function(message)
 {
     // remember 'this' for setInterval() callback
     var self = this;
-    
+
     // return indication if we can actually log a message
     function isLogAvailable()
     {
         return WebInspector.ConsoleMessage && WebInspector.ObjectProxy && self.console;
     }
-    
+
     // flush the queue of pending messages
     function flushQueue()
     {
         var queued = WebInspector.log.queued;
-        if (!queued) 
+        if (!queued)
             return;
-            
+
         for (var i = 0; i < queued.length; ++i)
             logMessage(queued[i]);
-        
+
         delete WebInspector.log.queued;
     }
 
@@ -1228,26 +1316,26 @@ WebInspector.log = function(message)
     {
         if (!isLogAvailable())
             return;
-            
+
         clearInterval(WebInspector.log.interval);
         delete WebInspector.log.interval;
-        
+
         flushQueue();
     }
-    
+
     // actually log the message
     function logMessage(message)
     {
         var repeatCount = 1;
         if (message == WebInspector.log.lastMessage)
             repeatCount = WebInspector.log.repeatCount + 1;
-    
+
         WebInspector.log.lastMessage = message;
         WebInspector.log.repeatCount = repeatCount;
-        
+
         // ConsoleMessage expects a proxy object
         message = new WebInspector.ObjectProxy(null, [], 0, message, false);
-        
+
         // post the message
         var msg = new WebInspector.ConsoleMessage(
             WebInspector.ConsoleMessage.MessageSource.Other,
@@ -1258,20 +1346,20 @@ WebInspector.log = function(message)
             null,
             repeatCount,
             message);
-    
+
         self.console.addMessage(msg);
     }
-    
+
     // if we can't log the message, queue it
     if (!isLogAvailable()) {
         if (!WebInspector.log.queued)
             WebInspector.log.queued = [];
-            
+
         WebInspector.log.queued.push(message);
-        
+
         if (!WebInspector.log.interval)
             WebInspector.log.interval = setInterval(flushQueueIfAvailable, 1000);
-        
+
         return;
     }
 
@@ -1284,7 +1372,7 @@ WebInspector.log = function(message)
 
 WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
+    this.panels.profiles.addProfileHeader(profile);
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
@@ -1383,7 +1471,7 @@ WebInspector.showResourceForURL = function(url, line, preferredPanel)
 WebInspector.linkifyStringAsFragment = function(string)
 {
     var container = document.createDocumentFragment();
-    var linkStringRegEx = new RegExp("(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}://|www\\.)[\\w$\\-_+*'=\\|/\\\\(){}[\\]%@&#~,:;.!?]{2,}[\\w$\\-_+*=\\|/\\\\({%@&#~]");
+    var linkStringRegEx = /(?:[a-zA-Z][a-zA-Z0-9+.-]{2,}:\/\/|www\.)[\w$\-_+*'=\|\/\\(){}[\]%@&#~,:;.!?]{2,}[\w$\-_+*=\|\/\\({%@&#~]/;
 
     while (string) {
         var linkString = linkStringRegEx.exec(string);
@@ -1411,12 +1499,13 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileForURL = function(url) {
+WebInspector.showProfileForURL = function(url)
+{
     WebInspector.showProfilesPanel();
     WebInspector.panels.profiles.showProfileForURL(url);
 }
 
-WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal, tooltipText)
 {
     if (!linkText)
         linkText = url;
@@ -1426,18 +1515,18 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     var a = document.createElement("a");
     a.href = url;
     a.className = classes;
-    a.title = url;
+    a.title = tooltipText || url;
     a.target = "_blank";
     a.textContent = linkText;
 
     return a;
 }
 
-WebInspector.linkifyURL = function(url, linkText, classes, isExternal)
+WebInspector.linkifyURL = function(url, linkText, classes, isExternal, tooltipText)
 {
     // Use the DOM version of this function so as to avoid needing to escape attributes.
     // FIXME:  Get rid of linkifyURL entirely.
-    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal).outerHTML;
+    return WebInspector.linkifyURLAsNode(url, linkText, classes, isExternal, tooltipText).outerHTML;
 }
 
 WebInspector.addMainEventListeners = function(doc)
@@ -1447,8 +1536,33 @@ WebInspector.addMainEventListeners = function(doc)
     doc.addEventListener("click", this.documentClick.bind(this), true);
 }
 
+WebInspector.searchFieldManualFocus = function(event)
+{
+    this.currentFocusElement = event.target;
+    this._previousFocusElement = event.target;
+}
+
 WebInspector.searchKeyDown = function(event)
 {
+    // Escape Key will clear the field and clear the search results
+    if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Esc) {
+        event.preventDefault();
+        // When search was selected manually and is currently blank, we'd like Esc stay unhandled
+        // and hit console drawer handler.
+        event.handled = !(this.previousFocusElement === event.target && event.target.value === "");
+        event.target.value = "";
+
+        this.performSearch(event);
+        this.currentFocusElement = this.previousFocusElement;
+        if (this.currentFocusElement === event.target)
+            this.currentFocusElement.select();
+        return false;
+    } else if (event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Backspace ||
+               event.keyCode === WebInspector.KeyboardShortcut.KeyCodes.Delete) {
+        event.handled = true;
+        return false;
+    }
+
     if (!isEnterKey(event))
         return false;
 
@@ -1558,7 +1672,7 @@ WebInspector.UIString = function(string)
         string = window.localizedStrings[string];
     else {
         if (!(string in this.missingLocalizedStrings)) {
-            if (!WebInspector.InspectorControllerStub)
+            if (!WebInspector.InspectorBackendStub)
                 console.error("Localized string \"" + string + "\" not found.");
             this.missingLocalizedStrings[string] = true;
         }
@@ -1570,6 +1684,14 @@ WebInspector.UIString = function(string)
     return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
 }
 
+WebInspector.isMac = function()
+{
+    if (!("_isMac" in this))
+        this._isMac = WebInspector.platform.indexOf("mac-") === 0;
+
+    return this._isMac;
+}
+
 WebInspector.isBeingEdited = function(element)
 {
     return element.__editing;
@@ -1645,6 +1767,8 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         if (isEnterKey(event)) {
             editingCommitted.call(element);
             event.preventDefault();
+            event.stopPropagation();
+            event.handled = true;
         } else if (event.keyCode === 27) { // Escape key
             editingCancelled.call(element);
             event.preventDefault();
diff --git a/WebCore/inspector/front-end/inspectorSyntaxHighlight.css b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
index 2cbb3c5..e3e3074 100644
--- a/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
+++ b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -26,33 +26,29 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-.webkit-css-comment { 
-    color: rgb(0, 116, 0);
-}
+ .webkit-css-comment { 
+     color: rgb(0, 116, 0);
+ }
 
-.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
-    color: rgb(7, 144, 154);
-}
+ .webkit-css-url, .webkit-css-color, .webkit-css-string, .webkit-css-keyword {
+     color: rgb(7, 144, 154);
+ }
 
-.webkit-css-number {
-    color: rgb(50, 0, 255);
-}
+ .webkit-css-number {
+     color: rgb(50, 0, 255);
+ }
 
-.webkit-css-property, .webkit-css-at-rule {
-    color: rgb(200, 0, 0);
-}
+ .webkit-css-property, .webkit-css-at-rule {
+     color: rgb(200, 0, 0);
+ }
 
-.webkit-css-url {
-    color: rgb(0, 0, 0);
-}
-
-.webkit-css-selector {
-    color: rgb(0, 0, 0);
-}
+ .webkit-css-selector {
+     rgb(0, 0, 0);
+ }
 
-.webkit-css-pseudo-class {
-    color: rgb(128, 128, 128);
-}
+ .webkit-css-important {
+     color: rgb(200, 0, 180);
+ }
 
 .webkit-javascript-comment {
     color: rgb(0, 116, 0);
diff --git a/WebCore/inspector/front-end/treeoutline.js b/WebCore/inspector/front-end/treeoutline.js
index ecc322b..2cde151 100644
--- a/WebCore/inspector/front-end/treeoutline.js
+++ b/WebCore/inspector/front-end/treeoutline.js
@@ -624,7 +624,7 @@ TreeElement.treeElementDoubleClicked = function(event)
         return;
 
     if (element.treeElement.ondblclick)
-        element.treeElement.ondblclick(element.treeElement, event);
+        element.treeElement.ondblclick.call(element.treeElement, event);
     else if (element.treeElement.hasChildren && !element.treeElement.expanded)
         element.treeElement.expand();
 }
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index e9d185f..04c9032 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -147,13 +147,18 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
 
 Element.prototype.removeStyleClass = function(className) 
 {
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case first.
     if (this.className === className) {
         this.className = "";
         return;
     }
 
-    this.removeMatchingStyleClasses(className.escapeForRegExp());
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return;
+
+    var newClassName = " " + this.className + " ";
+    this.className = newClassName.replace(" " + className + " ", " ");
 }
 
 Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
@@ -173,11 +178,15 @@ Element.prototype.hasStyleClass = function(className)
 {
     if (!className)
         return false;
-    // Test for the simple case before using a RegExp.
+    // Test for the simple case
     if (this.className === className)
         return true;
-    var regex = new RegExp("(^|\\s)" + className.escapeForRegExp() + "($|\\s)");
-    return regex.test(this.className);
+
+    var index = this.className.indexOf(className);
+    if (index === -1)
+        return false;
+    var toTest = " " + this.className + " ";
+    return toTest.indexOf(" " + className + " ", index) !== -1;
 }
 
 Element.prototype.positionAt = function(x, y)
@@ -222,8 +231,7 @@ Element.prototype.query = function(query)
 
 Element.prototype.removeChildren = function()
 {
-    while (this.firstChild) 
-        this.removeChild(this.firstChild);        
+    this.innerHTML = "";
 }
 
 Element.prototype.isInsertionCaretInside = function()
@@ -342,7 +350,7 @@ String.prototype.trimWhitespace = function()
 
 String.prototype.trimURL = function(baseURLDomain)
 {
-    var result = this.replace(new RegExp("^http[s]?:\/\/", "i"), "");
+    var result = this.replace(/^https?:\/\//i, "");
     if (baseURLDomain)
         result = result.replace(new RegExp("^" + baseURLDomain.escapeForRegExp(), "i"), "");
     return result;
@@ -542,6 +550,9 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     if (!formatterFunction)
         formatterFunction = String.sprintf;
 
+    if (seconds === 0)
+        return "0";
+
     var ms = seconds * 1000;
     if (higherResolution && ms < 1000)
         return formatterFunction("%.3fms", ms);
@@ -822,3 +833,7 @@ function isEnterKey(event) {
     // Check if in IME.
     return event.keyCode !== 229 && event.keyIdentifier === "Enter";
 }
+
+function isFnKey(event) {
+    return event.keyCode >= 112 && event.keyCode <= 123;
+}
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 05d24fc..66ca1b1 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -46,7 +46,7 @@ class PurgeableBuffer;
 // A resource that is held in the cache. Classes who want to use this object should derive
 // from CachedResourceClient, to get the function calls in case the requested data has arrived.
 // This class also does the actual communication with the loader to obtain the resource from the network.
-class CachedResource {
+class CachedResource : public Noncopyable {
     friend class Cache;
     friend class InspectorResource;
     
diff --git a/WebCore/loader/CrossOriginAccessControl.cpp b/WebCore/loader/CrossOriginAccessControl.cpp
index f0f8b6a..7a21280 100644
--- a/WebCore/loader/CrossOriginAccessControl.cpp
+++ b/WebCore/loader/CrossOriginAccessControl.cpp
@@ -100,6 +100,10 @@ bool passesAccessControlCheck(const ResourceResponse& response, bool includeCred
     if (accessControlOriginString == "*" && !includeCredentials)
         return true;
 
+    // A sandboxed frame has a unique origin (for same-origin purposes).
+    if (securityOrigin->isSandboxed(SandboxOrigin))
+        return false;
+
     RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
     if (!accessControlOrigin->isSameSchemeHostPort(securityOrigin))
         return false;
diff --git a/WebCore/loader/DocLoader.h b/WebCore/loader/DocLoader.h
index fdc1776..06d8a47 100644
--- a/WebCore/loader/DocLoader.h
+++ b/WebCore/loader/DocLoader.h
@@ -47,7 +47,7 @@ class ImageLoader;
 class KURL;
 
 // The DocLoader manages the loading of scripts/images/stylesheets for a single document.
-class DocLoader
+class DocLoader : public Noncopyable
 {
 friend class Cache;
 friend class ImageLoader;
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 5ca6e58..e8c3652 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -203,7 +203,7 @@ const KURL& DocumentLoader::url() const
     return request().url();
 }
 
-void DocumentLoader::replaceRequestURLForAnchorScroll(const KURL& url)
+void DocumentLoader::replaceRequestURLForSameDocumentNavigation(const KURL& url)
 {
     m_originalRequestCopy.setURL(url);
     m_request.setURL(url);
diff --git a/WebCore/loader/DocumentLoader.h b/WebCore/loader/DocumentLoader.h
index 1fa2b65..b8e659c 100644
--- a/WebCore/loader/DocumentLoader.h
+++ b/WebCore/loader/DocumentLoader.h
@@ -90,7 +90,7 @@ namespace WebCore {
         const KURL& responseURL() const;
         const String& responseMIMEType() const;
         
-        void replaceRequestURLForAnchorScroll(const KURL&);
+        void replaceRequestURLForSameDocumentNavigation(const KURL&);
         bool isStopping() const { return m_isStopping; }
         void stopLoading(DatabasePolicy = DatabasePolicyStop);
         void setCommitted(bool committed) { m_committed = committed; }
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index 64b1a22..7eb7f1c 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -41,7 +41,7 @@
 namespace WebCore {
     class Document;
     class KURL;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index 5fcd4cd..c6ae799 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -80,6 +80,8 @@ public:
     virtual bool canTakeFocus(FocusDirection) { return false; }
     virtual void takeFocus(FocusDirection) { }
 
+    virtual void focusedNodeChanged(Node*) { }
+
     virtual Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) { return 0; }
     virtual void show() { }
 
@@ -204,6 +206,9 @@ public:
     virtual void dispatchDidCancelClientRedirect() { }
     virtual void dispatchWillPerformClientRedirect(const KURL&, double, double) { }
     virtual void dispatchDidChangeLocationWithinPage() { }
+    virtual void dispatchDidPushStateWithinPage() { }
+    virtual void dispatchDidReplaceStateWithinPage() { }
+    virtual void dispatchDidPopStateWithinPage() { }
     virtual void dispatchWillClose() { }
     virtual void dispatchDidReceiveIcon() { }
     virtual void dispatchDidStartProvisionalLoad() { }
@@ -283,8 +288,13 @@ public:
     virtual void updateGlobalHistory() { }
     virtual void updateGlobalHistoryRedirectLinks() { }
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
+<<<<<<< HEAD:WebCore/loader/EmptyClients.h
     virtual void dispatchDidAddBackForwardItem(HistoryItem*) const  { }
     virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const { }
+=======
+    virtual void dispatchDidAddBackForwardItem(HistoryItem*) const { }
+    virtual void dispatchDidRemoveBackForwardItem(HistoryItem*) const { };
+>>>>>>> webkit.org at r51976:WebCore/loader/EmptyClients.h
     virtual void dispatchDidChangeBackForwardIndex() const { }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
@@ -298,7 +308,7 @@ public:
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
-    virtual void windowObjectCleared() { }
+    virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) { }
     virtual void documentElementAvailable() { }
     virtual void didPerformFirstNavigation() const { }
 
@@ -484,20 +494,12 @@ public:
     virtual void hideHighlight() { }
     virtual void inspectedURLChanged(const String&) { }
 
-    virtual void populateSetting(const String&, InspectorController::Setting&) { }
-    virtual void storeSetting(const String&, const InspectorController::Setting&) { }
-    virtual void removeSetting(const String&) { }
+    virtual void populateSetting(const String&, String*) { }
+    virtual void storeSetting(const String&, const String&) { }
 
     virtual void inspectorWindowObjectCleared() { }
 };
 
-class EmptyPluginHalterClient : public PluginHalterClient
-{
-public:
-    virtual bool shouldHaltPlugin(Node*) const { return false; }
-    virtual bool enabled() const { return false; }
-};
-
 }
 
 #endif // EmptyClients_h
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index 98b8e61..22399b0 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -203,6 +203,7 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
     , m_suppressOpenerInNewFrame(false)
+    , m_sandboxFlags(SandboxAll)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -235,6 +236,9 @@ void FrameLoader::init()
     m_frame->document()->cancelParsing();
     m_creatingInitialEmptyDocument = false;
     m_didCallImplicitClose = true;
+
+    // Propagate sandbox attributes to this Frameloader and its descendants.
+    updateSandboxFlags();
 }
 
 void FrameLoader::setDefersLoading(bool defers)
@@ -452,6 +456,9 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     if (u.isEmpty())
         return;
 
+    if (isSandboxed(SandboxForms))
+        return;
+
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         m_frame->script()->executeIfJavaScriptURL(u, false, false);
@@ -530,7 +537,10 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
                 if (m_frame->domWindow()) {
                     if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
                         m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(eventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 #ifndef ANDROID_PAGE_CACHE_UNLOAD
+=======
+>>>>>>> webkit.org at r51976:WebCore/loader/FrameLoader.cpp
                     if (!m_frame->document()->inPageCache())
 #endif
                         m_frame->domWindow()->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), m_frame->domWindow()->document());
@@ -624,8 +634,8 @@ KURL FrameLoader::iconURL()
     KURL url;
     url.setProtocol(m_URL.protocol());
     url.setHost(m_URL.host());
-    if (int port = m_URL.port())
-        url.setPort(port);
+    if (m_URL.hasPort())
+        url.setPort(m_URL.port());
     url.setPath("/favicon.ico");
     return url;
 }
@@ -759,7 +769,7 @@ void FrameLoader::receivedFirstData()
     begin(m_workingURL, false);
 
     dispatchDidCommitLoad();
-    dispatchWindowObjectAvailable();
+    dispatchDidClearWindowObjectsInAllWorlds();
     
     if (m_documentLoader) {
         String ptitle = m_documentLoader->title();
@@ -848,7 +858,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
     if (dispatch)
-        dispatchWindowObjectAvailable();
+        dispatchDidClearWindowObjectsInAllWorlds();
     
     updateFirstPartyForCookies();
 
@@ -1285,14 +1295,18 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
         if (!settings || !settings->arePluginsEnabled() || 
             (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
             return false;
+        if (isSandboxed(SandboxPlugins))
+            return false;
         return loadPlugin(renderer, completedURL, mimeType, paramNames, paramValues, useFallback);
     }
 
     ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
     HTMLPlugInElement* element = static_cast<HTMLPlugInElement*>(renderer->node());
-    
-    // FIXME: OK to always make a new frame? When does the old frame get removed?
-    return loadSubframe(element, completedURL, frameName, m_outgoingReferrer);
+
+    // If the plug-in element already contains a subframe, requestFrame will re-use it. Otherwise,
+    // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
+    // in the widget to be torn down.
+    return requestFrame(element, completedURL, frameName);
 }
 
 bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
@@ -1730,52 +1744,70 @@ void FrameLoader::setFirstPartyForCookies(const KURL& url)
         child->loader()->setFirstPartyForCookies(url);
 }
 
-class HashChangeEventTask : public ScriptExecutionContext::Task {
-public:
-    static PassRefPtr<HashChangeEventTask> create(PassRefPtr<Document> document)
-    {
-        return adoptRef(new HashChangeEventTask(document));
-    }
-    
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        ASSERT_UNUSED(context, context->isDocument());
-        m_document->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
-    }
-    
-private:
-    HashChangeEventTask(PassRefPtr<Document> document)
-        : m_document(document)
-    {
-        ASSERT(m_document);
-    }
-    
-    RefPtr<Document> m_document;
-};
-
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
-void FrameLoader::scrollToAnchor(const KURL& url)
-{
-    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
-    if (equalIgnoringFragmentIdentifier(url, m_URL) && !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
-        Document* currentDocument = frame()->document();
-        currentDocument->postTask(HashChangeEventTask::create(currentDocument));
+void FrameLoader::loadInSameDocument(const KURL& url, SerializedScriptValue* stateObject, bool isNewNavigation)
+{
+    // If we have a state object, we cannot also be a new navigation.
+    ASSERT(!stateObject || (stateObject && !isNewNavigation));
+
+    // Update the data source's request with the new URL to fake the URL change
+    m_frame->document()->setURL(url);
+    documentLoader()->replaceRequestURLForSameDocumentNavigation(url);
+    if (isNewNavigation && !shouldTreatURLAsSameAsCurrent(url) && !stateObject) {
+        // NB: must happen after replaceRequestURLForSameDocumentNavigation(), since we add 
+        // based on the current request. Must also happen before we openURL and displace the 
+        // scroll position, since adding the BF item will save away scroll state.
+        
+        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
+        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
+        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
+        // though its load is not yet done.  I think this all works out OK, for one because
+        // we have already saved away the scroll and doc state for the long slow load,
+        // but it's not an obvious case.
+
+        history()->updateBackForwardListForFragmentScroll();
     }
     
+    bool hashChange = equalIgnoringFragmentIdentifier(url, m_URL) && url.fragmentIdentifier() != m_URL.fragmentIdentifier();
     m_URL = url;
-    history()->updateForAnchorScroll();
+    history()->updateForSameDocumentNavigation();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
-    m_frame->eventHandler()->stopAutoscrollTimer();
-    started();
-    if (FrameView* view = m_frame->view())
-        view->scrollToFragment(m_URL);
-
+    if (hashChange)
+        m_frame->eventHandler()->stopAutoscrollTimer();
+    
     // It's important to model this as a load that starts and immediately finishes.
     // Otherwise, the parent frame may think we never finished loading.
+    started();
+    
+    if (hashChange) {
+        if (FrameView* view = m_frame->view())
+            view->scrollToFragment(m_URL);
+    }
+    
     m_isComplete = false;
     checkCompleted();
+
+    if (isNewNavigation) {
+        // This will clear previousItem from the rest of the frame tree that didn't
+        // doing any loading. We need to make a pass on this now, since for anchor nav
+        // we'll not go through a real load and reach Completed state.
+        checkLoadComplete();
+    }
+
+    if (stateObject) {
+        m_frame->document()->statePopped(stateObject);
+        m_client->dispatchDidPopStateWithinPage();
+    }
+    
+    if (hashChange) {
+        m_frame->document()->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
+        m_client->dispatchDidChangeLocationWithinPage();
+    }
+    
+    // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
+    m_client->didFinishLoad();
 }
 
 bool FrameLoader::isComplete() const
@@ -2256,6 +2288,10 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (m_frame == targetFrame)
         return true;
 
+    // A sandboxed frame can only navigate itself and its descendants.
+    if (isSandboxed(SandboxNavigation) && !targetFrame->tree()->isDescendantOf(m_frame))
+        return false;
+
     // Let a frame navigate the top-level window that contains it.  This is
     // important to allow because it lets a site "frame-bust" (escape from a
     // frame created by another web site).
@@ -2957,8 +2993,8 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 // delegate callback.
                 if (pdl == m_provisionalDocumentLoader)
                     clearProvisionalLoad();
-                else if (m_provisionalDocumentLoader) {
-                    KURL unreachableURL = m_provisionalDocumentLoader->unreachableURL();
+                else if (activeDocumentLoader()) {
+                    KURL unreachableURL = activeDocumentLoader()->unreachableURL();
                     if (!unreachableURL.isEmpty() && unreachableURL == pdl->request().url())
                         shouldReset = false;
                 }
@@ -3339,10 +3375,16 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
     ResourceRequest initialRequest = request;
     initialRequest.setTimeoutInterval(10);
     
+    // Use the original request's cache policy for two reasons:
+    // 1. For POST requests, we mutate the cache policy for the main resource,
+    //    but we do not want this to apply to subresources
+    // 2. Delegates that modify the cache policy using willSendRequest: should
+    //    not affect any other resources. Such changes need to be done
+    //    per request.
     if (initialRequest.isConditional())
         initialRequest.setCachePolicy(ReloadIgnoringCacheData);
     else
-        initialRequest.setCachePolicy(documentLoader()->request().cachePolicy());
+        initialRequest.setCachePolicy(originalRequest().cachePolicy());
     
     if (!referrer.isEmpty())
         initialRequest.setHTTPReferrer(referrer);
@@ -3423,12 +3465,12 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
         return;
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
     KURL url = request.url();
     
     m_documentLoader->replaceRequestURLForAnchorScroll(url);
@@ -3464,6 +3506,10 @@ void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequ
  
     m_client->dispatchDidChangeLocationWithinPage();
     m_client->didFinishLoad();
+=======
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;    
+    loadInSameDocument(request.url(), 0, !isRedirect);
+>>>>>>> webkit.org at r51976:WebCore/loader/FrameLoader.cpp
 }
 
 bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url)
@@ -3738,14 +3784,51 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-// Loads content into this frame, as specified by history item
+void FrameLoader::navigateWithinDocument(HistoryItem* item)
+{
+    ASSERT(!item->document() || item->document() == m_frame->document());
+
+    // Save user view state to the current history item here since we don't do a normal load.
+    // FIXME: Does form state need to be saved here too?
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
+    if (FrameView* view = m_frame->view())
+        view->setWasScrolledByUser(false);
+
+    history()->setCurrentItem(item);
+        
+    // loadInSameDocument() actually changes the URL and notifies load delegates of a "fake" load
+    loadInSameDocument(item->url(), item->stateObject(), false);
+
+    // Restore user view state from the current history item here since we don't do a normal load.
+    // Even though we just manually set the current history item, this ASSERT verifies nothing 
+    // inside of loadInSameDocument() caused it to change.
+    ASSERT(history()->currentItem() == item);
+    history()->restoreScrollPositionAndViewState();
+}
+
 // FIXME: This function should really be split into a couple pieces, some of
 // which should be methods of HistoryController and some of which should be
 // methods of FrameLoader.
-void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+void FrameLoader::navigateToDifferentDocument(HistoryItem* item, FrameLoadType loadType)
 {
-    if (!m_frame->page())
-        return;
+    // Remember this item so we can traverse any child items as child frames load
+    history()->setProvisionalItem(item);
+    
+    // Check if we'll be using the page cache.  We only use the page cache
+    // if one exists and it is less than _backForwardCacheExpirationInterval
+    // seconds old.  If the cache is expired it gets flushed here.
+    if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
+        // FIXME: 1800 should not be hardcoded, it should come from
+        // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
+        // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
+        if (currentTime() - cachedPage->timeStamp() <= 1800) {
+            loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
+            return;
+        }
+        
+        LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
+        pageCache()->remove(item);
+    }
 
     KURL itemURL = item->url();
     KURL itemOriginalURL = item->originalURL();
@@ -3754,138 +3837,96 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         currentURL = documentLoader()->url();
     RefPtr<FormData> formData = item->formData();
 
-    // Are we navigating to an anchor within the page?
-    // Note if we have child frames we do a real reload, since the child frames might not
-    // match our current frame structure, or they might not have the right content.  We could
-    // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form or navigating from
-    // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
+    bool addedExtraFields = false;
+    ResourceRequest request(itemURL);
 
-#if ENABLE(WML)
-    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
-    if (frameContainsWMLContent(m_frame))
-        shouldScroll = false;
-#endif
-
-    if (shouldScroll) {
-        // Must do this maintenance here, since we don't go through a real page reload
-        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
-
-        history()->setCurrentItem(item);
-
-        // FIXME: Form state might need to be saved here too.
-
-        // We always call scrollToAnchor here, even if the URL doesn't have an
-        // anchor fragment. This is so we'll keep the WebCore Frame's URL up-to-date.
-        scrollToAnchor(item->url());
+    if (!item->referrer().isNull())
+        request.setHTTPReferrer(item->referrer());
     
-        // must do this maintenance here, since we don't go through a real page reload
-        history()->restoreScrollPositionAndViewState();
+    // If this was a repost that failed the page cache, we might try to repost the form.
+    NavigationAction action;
+    if (formData) {
+        formData->generateFiles(m_frame->page()->chrome()->client());
+
+        request.setHTTPMethod("POST");
+        request.setHTTPBody(formData);
+        request.setHTTPContentType(item->formContentType());
+        RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
+        addHTTPOriginIfNeeded(request, securityOrigin->toString());
+
+        // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
+        // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
+        addedExtraFields = true;
         
-        // Fake the URL change by updating the data source's request.  This will no longer
-        // be necessary if we do the better fix described above.
-        documentLoader()->replaceRequestURLForAnchorScroll(itemURL);
-
-        m_client->dispatchDidChangeLocationWithinPage();
+        // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
+        // We want to know this before talking to the policy delegate, since it affects whether 
+        // we show the DoYouReallyWantToRepost nag.
+        //
+        // This trick has a small bug (3123893) where we might find a cache hit, but then
+        // have the item vanish when we try to use it in the ensuing nav.  This should be
+        // extremely rare, but in that case the user will get an error on the navigation.
         
-        // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
-        m_client->didFinishLoad();
+        if (ResourceHandle::willLoadFromCache(request, m_frame))
+            action = NavigationAction(itemURL, loadType, false);
+        else {
+            request.setCachePolicy(ReloadIgnoringCacheData);
+            action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
+        }
     } else {
-        // Remember this item so we can traverse any child items as child frames load
-        history()->setProvisionalItem(item);
-
-        bool inPageCache = false;
-        
-        // Check if we'll be using the page cache.  We only use the page cache
-        // if one exists and it is less than _backForwardCacheExpirationInterval
-        // seconds old.  If the cache is expired it gets flushed here.
-        if (RefPtr<CachedPage> cachedPage = pageCache()->get(item)) {
-            double interval = currentTime() - cachedPage->timeStamp();
-            
-            // FIXME: 1800 should not be hardcoded, it should come from
-            // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
-            // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
-            if (interval <= 1800) {
-                loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
-                inPageCache = true;
-            } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
-                pageCache()->remove(item);
-            }
+        switch (loadType) {
+            case FrameLoadTypeReload:
+            case FrameLoadTypeReloadFromOrigin:
+                request.setCachePolicy(ReloadIgnoringCacheData);
+                break;
+            case FrameLoadTypeBack:
+            case FrameLoadTypeBackWMLDeckNotAccessible:
+            case FrameLoadTypeForward:
+            case FrameLoadTypeIndexedBackForward:
+                if (!itemURL.protocolIs("https"))
+                    request.setCachePolicy(ReturnCacheDataElseLoad);
+                break;
+            case FrameLoadTypeStandard:
+            case FrameLoadTypeRedirectWithLockedBackForwardList:
+                break;
+            case FrameLoadTypeSame:
+            default:
+                ASSERT_NOT_REACHED();
         }
-        
-        if (!inPageCache) {
-            bool addedExtraFields = false;
-            ResourceRequest request(itemURL);
 
-            if (!item->referrer().isNull())
-                request.setHTTPReferrer(item->referrer());
-            
-            // If this was a repost that failed the page cache, we might try to repost the form.
-            NavigationAction action;
-            if (formData) {
-                
-                formData->generateFiles(m_frame->page()->chrome()->client());
+        action = NavigationAction(itemOriginalURL, loadType, false);
+    }
+    
+    if (!addedExtraFields)
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
 
-                request.setHTTPMethod("POST");
-                request.setHTTPBody(formData);
-                request.setHTTPContentType(item->formContentType());
-                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
-                addHTTPOriginIfNeeded(request, securityOrigin->toString());
-        
-                // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
-                // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
-                addedExtraFields = true;
-                
-                // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
-                // We want to know this before talking to the policy delegate, since it affects whether 
-                // we show the DoYouReallyWantToRepost nag.
-                //
-                // This trick has a small bug (3123893) where we might find a cache hit, but then
-                // have the item vanish when we try to use it in the ensuing nav.  This should be
-                // extremely rare, but in that case the user will get an error on the navigation.
-                
-                if (ResourceHandle::willLoadFromCache(request, m_frame))
-                    action = NavigationAction(itemURL, loadType, false);
-                else {
-                    request.setCachePolicy(ReloadIgnoringCacheData);
-                    action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
-                }
-            } else {
-                switch (loadType) {
-                    case FrameLoadTypeReload:
-                    case FrameLoadTypeReloadFromOrigin:
-                        request.setCachePolicy(ReloadIgnoringCacheData);
-                        break;
-                    case FrameLoadTypeBack:
-                    case FrameLoadTypeBackWMLDeckNotAccessible:
-                    case FrameLoadTypeForward:
-                    case FrameLoadTypeIndexedBackForward:
-                        if (itemURL.protocol() != "https")
-                            request.setCachePolicy(ReturnCacheDataElseLoad);
-                        break;
-                    case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedBackForwardList:
-                        break;
-                    case FrameLoadTypeSame:
-                    default:
-                        ASSERT_NOT_REACHED();
-                }
+    loadWithNavigationAction(request, action, false, loadType, 0);
+}
 
-                action = NavigationAction(itemOriginalURL, loadType, false);
-            }
-            
-            if (!addedExtraFields)
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
+// Loads content into this frame, as specified by history item
+void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+{
+    // We do same-document navigation in the following cases:
+    // - The HistoryItem has a history state object
+    // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
+    //   and the URLs in the frame tree match the history item for fragment scrolling.
+    bool sameDocumentNavigation = (!item->formData() && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item)) || item->document() == m_frame->document();
 
-            loadWithNavigationAction(request, action, false, loadType, 0);
-        }
-    }
+#if ENABLE(WML)
+    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
+    // FIXME: Why do WML decks have this different behavior?
+    // Are WML decks incompatible with HTML5 pushState/replaceState which require inter-document history navigations?
+    // Should this new API be disabled for WML pages, or does WML need to update their mechanism to act like normal loads?
+    // If scroll-to-anchor navigations were broken for WML and required them to have different loading behavior, then  
+    // state object loads are certainly also broken for them.
+    if (frameContainsWMLContent(m_frame))
+        sameDocumentNavigation = false;
+#endif
+
+    if (sameDocumentNavigation)
+        navigateWithinDocument(item);
+    else
+        navigateToDifferentDocument(item, loadType);
 }
 
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
@@ -3955,15 +3996,28 @@ void FrameLoader::dispatchDocumentElementAvailable()
     m_client->documentElementAvailable();
 }
 
-void FrameLoader::dispatchWindowObjectAvailable()
+void FrameLoader::dispatchDidClearWindowObjectsInAllWorlds()
 {
-    // FIXME: should this be isolated-worlds-aware?
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(mainThreadNormalWorld()))
+    if (!m_frame->script()->isEnabled())
         return;
 
-    m_client->windowObjectCleared();
+    Vector<DOMWrapperWorld*> worlds;
+    ScriptController::getAllWorlds(worlds);
+    for (size_t i = 0; i < worlds.size(); ++i)
+        dispatchDidClearWindowObjectInWorld(worlds[i]);
+}
+
+void FrameLoader::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
+{
+    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(world))
+        return;
+
+    m_client->dispatchDidClearWindowObjectInWorld(world);
 
 #if ENABLE(INSPECTOR)
+    if (world != mainThreadNormalWorld())
+        return;
+
     if (Page* page = m_frame->page()) {
         if (InspectorController* inspector = page->inspectorController())
             inspector->inspectedWindowScriptObjectCleared(m_frame);
@@ -3973,6 +4027,25 @@ void FrameLoader::dispatchWindowObjectAvailable()
 #endif
 }
 
+void FrameLoader::updateSandboxFlags()
+{
+    SandboxFlags flags = SandboxNone;
+    if (Frame* parentFrame = m_frame->tree()->parent())
+        flags |= parentFrame->loader()->sandboxFlags();
+    if (HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement())
+        flags |= ownerElement->sandboxFlags();
+
+    if (m_sandboxFlags == flags)
+        return;
+        
+    m_sandboxFlags = flags;
+
+    m_frame->document()->updateSandboxFlags();
+
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->updateSandboxFlags();
+ }
+
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 31351a3..875736f 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -52,6 +52,7 @@ class AuthenticationChallenge;
 class CachedFrameBase;
 class CachedPage;
 class CachedResource;
+class DOMWrapperWorld;
 class Document;
 class DocumentLoader;
 class Event;
@@ -74,6 +75,7 @@ class ScriptSourceCode;
 class ScriptString;
 class ScriptValue;
 class SecurityOrigin;
+class SerializedScriptValue;
 class SharedBuffer;
 class SubstituteData;
 class TextResourceDecoder;
@@ -250,9 +252,15 @@ public:
 
     PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-    void dispatchWindowObjectAvailable();
+    void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*);
+    void dispatchDidClearWindowObjectsInAllWorlds();
     void dispatchDocumentElementAvailable();
 
+    void ownerElementSandboxFlagsChanged() { updateSandboxFlags(); }
+    
+    bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+    SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
+
     // Mixed content related functions.
     static bool isMixedContent(SecurityOrigin* context, const KURL&);
     void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
@@ -347,6 +355,9 @@ private:
     bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
     
+    void navigateWithinDocument(HistoryItem*);
+    void navigateToDifferentDocument(HistoryItem*, FrameLoadType);
+    
     bool loadProvisionalItemFromCachedPage();
     void cachePageForHistoryItem(HistoryItem*);
     void pageHidden();
@@ -428,7 +439,7 @@ private:
 
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-    void scrollToAnchor(const KURL&);
+    void loadInSameDocument(const KURL&, SerializedScriptValue* stateObject, bool isNewNavigation);
 
     void provisionalLoadStarted();
 
@@ -444,6 +455,8 @@ private:
 
     bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
+    void updateSandboxFlags();
+    
     Frame* m_frame;
     FrameLoaderClient* m_client;
 
@@ -515,6 +528,8 @@ private:
     bool m_loadingFromCachedPage;
     bool m_suppressOpenerInNewFrame;
     
+    SandboxFlags m_sandboxFlags;
+
 #ifndef NDEBUG
     bool m_didDispatchDidCommitLoad;
 #endif
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index 7d988f1..434e163 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -47,6 +47,7 @@ namespace WebCore {
     class AuthenticationChallenge;
     class CachedFrame;
     class Color;
+    class DOMWrapperWorld;
     class DocumentLoader;
     class Element;
     class FormState;
@@ -64,7 +65,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptString;
     class SecurityOrigin;
@@ -116,6 +117,9 @@ namespace WebCore {
         virtual void dispatchDidCancelClientRedirect() = 0;
         virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate) = 0;
         virtual void dispatchDidChangeLocationWithinPage() = 0;
+        virtual void dispatchDidPushStateWithinPage() = 0;
+        virtual void dispatchDidReplaceStateWithinPage() = 0;
+        virtual void dispatchDidPopStateWithinPage() = 0;
         virtual void dispatchWillClose() = 0;
         virtual void dispatchDidReceiveIcon() = 0;
         virtual void dispatchDidStartProvisionalLoad() = 0;
@@ -225,7 +229,7 @@ namespace WebCore {
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
-        virtual void windowObjectCleared() = 0;
+        virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) = 0;
         virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
 
@@ -252,6 +256,10 @@ namespace WebCore {
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
         virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
+
+        virtual void didChangeScrollOffset() { }
+
+        virtual bool allowJavaScript(bool enabledPerSettings) { return enabledPerSettings; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index e7d51c7..af3dde4 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -92,6 +92,18 @@ namespace WebCore {
         SendReferrer,
         NoReferrer
     };
+    
+    enum SandboxFlag {
+        SandboxNone = 0,
+        SandboxNavigation = 1,
+        SandboxPlugins = 1 << 1,
+        SandboxOrigin = 1 << 2,
+        SandboxForms = 1 << 3,
+        SandboxScripts = 1 << 4,
+        SandboxAll = -1 // Mask with all bits set to 1.
+    };
+
+    typedef int SandboxFlags;
 }
 
 #endif
diff --git a/WebCore/loader/HistoryController.cpp b/WebCore/loader/HistoryController.cpp
index 501640a..d30b231 100644
--- a/WebCore/loader/HistoryController.cpp
+++ b/WebCore/loader/HistoryController.cpp
@@ -402,7 +402,7 @@ void HistoryController::updateForCommit()
     }
 }
 
-void HistoryController::updateForAnchorScroll()
+void HistoryController::updateForSameDocumentNavigation()
 {
     if (m_frame->loader()->url().isEmpty())
         return;
@@ -624,4 +624,39 @@ void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
     page->backForwardList()->addItem(item);
 }
 
+void HistoryController::pushState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    Page* page = m_frame->page();
+    ASSERT(page);
+
+    // Get a HistoryItem tree for the current frame tree.
+    RefPtr<HistoryItem> item = createItemTree(m_frame, false);
+    
+    // Override data in the target item to reflect the pushState() arguments.
+    HistoryItem* targetItem = item->targetItem();
+    ASSERT(targetItem->isTargetItem());
+    targetItem->setDocument(m_frame->document());
+    targetItem->setTitle(title);
+    targetItem->setStateObject(stateObject);
+    targetItem->setURLString(urlString);
+    
+    page->backForwardList()->pushStateItem(item.release());
+}
+
+void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObject, const String& title, const String& urlString)
+{
+    Page* page = m_frame->page();
+    ASSERT(page);
+    HistoryItem* current = page->backForwardList()->currentItem();
+    ASSERT(current);
+    
+    ASSERT(!current->document() || current->document() == m_frame->document());
+    current->setDocument(m_frame->document());
+    
+    if (!urlString.isEmpty())
+        current->setURLString(urlString);
+    current->setTitle(title);
+    current->setStateObject(stateObject);
+}
+
 } // namespace WebCore
diff --git a/WebCore/loader/HistoryController.h b/WebCore/loader/HistoryController.h
index 4ecae69..7c4a1ac 100644
--- a/WebCore/loader/HistoryController.h
+++ b/WebCore/loader/HistoryController.h
@@ -39,6 +39,7 @@ namespace WebCore {
 
 class Frame;
 class HistoryItem;
+class SerializedScriptValue;
 
 class HistoryController : public Noncopyable {
 public:
@@ -65,7 +66,7 @@ public:
     void updateForRedirectWithLockedBackForwardList();
     void updateForClientRedirect();
     void updateForCommit();
-    void updateForAnchorScroll();
+    void updateForSameDocumentNavigation();
     void updateForFrameLoadCompleted();
 
     HistoryItem* currentItem() const { return m_currentItem.get(); }
@@ -75,6 +76,9 @@ public:
     HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
     void setProvisionalItem(HistoryItem*);
 
+    void pushState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+    void replaceState(PassRefPtr<SerializedScriptValue>, const String& title, const String& url);
+
 private:
     PassRefPtr<HistoryItem> createItem(bool useOriginal);
     PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index cdc31bc..e09d574 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class ImageEventSender {
+class ImageEventSender : public Noncopyable {
 public:
     ImageEventSender(const AtomicString& eventType);
 
diff --git a/WebCore/loader/MainResourceLoader.h b/WebCore/loader/MainResourceLoader.h
index d3f411b..1d5be45 100644
--- a/WebCore/loader/MainResourceLoader.h
+++ b/WebCore/loader/MainResourceLoader.h
@@ -40,7 +40,7 @@
 namespace WebCore {
 
     class FormState;
-    struct ResourceRequest;
+    class ResourceRequest;
 
     class MainResourceLoader : public ResourceLoader {
     public:
diff --git a/WebCore/loader/ProgressTracker.cpp b/WebCore/loader/ProgressTracker.cpp
index e682b9b..0c9f2fb 100644
--- a/WebCore/loader/ProgressTracker.cpp
+++ b/WebCore/loader/ProgressTracker.cpp
@@ -47,7 +47,7 @@ static const double finalProgressValue = 0.9; // 1.0 - initialProgressValue
 
 static const int progressItemDefaultEstimatedLength = 1024 * 16;
 
-struct ProgressItem {
+struct ProgressItem : Noncopyable {
     ProgressItem(long long length) 
         : bytesReceived(0)
         , estimatedLength(length) { }
@@ -176,8 +176,10 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     // FIXME: Can this ever happen?
     if (!item)
         return;
+
+    RefPtr<Frame> frame = m_originatingProgressFrame;
     
-    m_originatingProgressFrame->loader()->client()->willChangeEstimatedProgress();
+    frame->loader()->client()->willChangeEstimatedProgress();
     
     unsigned bytesReceived = length;
     double increment, percentOfRemainingBytes;
@@ -189,7 +191,7 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
         item->estimatedLength = item->bytesReceived * 2;
     }
     
-    int numPendingOrLoadingRequests = m_originatingProgressFrame->loader()->numPendingOrLoadingRequests(true);
+    int numPendingOrLoadingRequests = frame->loader()->numPendingOrLoadingRequests(true);
     estimatedBytesForPendingRequests = progressItemDefaultEstimatedLength * numPendingOrLoadingRequests;
     remainingBytes = ((m_totalPageAndResourceBytesToLoad + estimatedBytesForPendingRequests) - m_totalBytesReceived);
     if (remainingBytes > 0)  // Prevent divide by 0.
@@ -199,8 +201,8 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     
     // For documents that use WebCore's layout system, treat first layout as the half-way point.
     // FIXME: The hasHTMLView function is a sort of roundabout way of asking "do you use WebCore's layout system".
-    bool useClampedMaxProgress = m_originatingProgressFrame->loader()->client()->hasHTMLView()
-        && !m_originatingProgressFrame->loader()->firstLayoutDone();
+    bool useClampedMaxProgress = frame->loader()->client()->hasHTMLView()
+        && !frame->loader()->firstLayoutDone();
     double maxProgressValue = useClampedMaxProgress ? 0.5 : finalProgressValue;
     increment = (maxProgressValue - m_progressValue) * percentOfRemainingBytes;
     m_progressValue += increment;
@@ -221,14 +223,14 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
             if (m_progressValue == 1)
                 m_finalProgressChangedSent = true;
             
-            m_originatingProgressFrame->loader()->client()->postProgressEstimateChangedNotification();
+            frame->loader()->client()->postProgressEstimateChangedNotification();
 
             m_lastNotifiedProgressValue = m_progressValue;
             m_lastNotifiedProgressTime = now;
         }
     }
     
-    m_originatingProgressFrame->loader()->client()->didChangeEstimatedProgress();
+    frame->loader()->client()->didChangeEstimatedProgress();
 }
 
 void ProgressTracker::completeProgress(unsigned long identifier)
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
index c0d78ae..f2202cc 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -39,11 +39,12 @@
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "HTMLFormElement.h"
+#include "Page.h"
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
-struct ScheduledRedirection {
+struct ScheduledRedirection : Noncopyable {
     enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
     const Type type;
@@ -171,7 +172,7 @@ bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
     
     for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
         Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+        if (!ancestor->loader()->isComplete() || (document && document->processingLoadEvent()))
             return true;
     }
     return false;
diff --git a/WebCore/loader/Request.h b/WebCore/loader/Request.h
index 07d1b82..1e02d77 100644
--- a/WebCore/loader/Request.h
+++ b/WebCore/loader/Request.h
@@ -30,7 +30,7 @@ namespace WebCore {
     class CachedResource;
     class DocLoader;
 
-    class Request {
+    class Request : public Noncopyable {
     public:
         Request(DocLoader*, CachedResource*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
         ~Request();
diff --git a/WebCore/loader/ResourceLoadNotifier.cpp b/WebCore/loader/ResourceLoadNotifier.cpp
index 4cddd01..9280434 100644
--- a/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/WebCore/loader/ResourceLoadNotifier.cpp
@@ -96,6 +96,11 @@ void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceE
 
     if (!error.isNull())
         m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFailLoading(loader->identifier(), error);
+#endif
 }
 
 void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
@@ -126,7 +131,7 @@ void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsig
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+        page->inspectorController()->willSendRequest(identifier, request, redirectResponse);
 #endif
 }
 
@@ -136,7 +141,7 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+        page->inspectorController()->didReceiveResponse(identifier, r);
 #endif
 }
 
@@ -146,7 +151,7 @@ void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loade
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+        page->inspectorController()->didReceiveContentLength(identifier, length);
 #endif
 }
 
@@ -156,7 +161,7 @@ void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsi
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
+        page->inspectorController()->didFinishLoading(identifier);
 #endif
 }
 
diff --git a/WebCore/loader/ResourceLoadNotifier.h b/WebCore/loader/ResourceLoadNotifier.h
index b09d7be..23e4246 100644
--- a/WebCore/loader/ResourceLoadNotifier.h
+++ b/WebCore/loader/ResourceLoadNotifier.h
@@ -41,7 +41,7 @@ class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
 class ScriptString;
-struct ResourceRequest;
+class ResourceRequest;
 
 class ResourceLoadNotifier : public Noncopyable {
 public:
diff --git a/WebCore/loader/SubresourceLoader.h b/WebCore/loader/SubresourceLoader.h
index 0fce930..1a94c73 100644
--- a/WebCore/loader/SubresourceLoader.h
+++ b/WebCore/loader/SubresourceLoader.h
@@ -33,7 +33,7 @@
  
 namespace WebCore {
 
-    struct ResourceRequest;
+    class ResourceRequest;
     class SubresourceLoaderClient;
     
     class SubresourceLoader : public ResourceLoader {
diff --git a/WebCore/loader/SubresourceLoaderClient.h b/WebCore/loader/SubresourceLoaderClient.h
index acf8e6a..76fde47 100644
--- a/WebCore/loader/SubresourceLoaderClient.h
+++ b/WebCore/loader/SubresourceLoaderClient.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class AuthenticationChallenge;
 class ResourceError;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SubresourceLoader;
     
diff --git a/WebCore/loader/ThreadableLoader.h b/WebCore/loader/ThreadableLoader.h
index a52bfad..f41a774 100644
--- a/WebCore/loader/ThreadableLoader.h
+++ b/WebCore/loader/ThreadableLoader.h
@@ -38,7 +38,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
diff --git a/WebCore/loader/ThreadableLoaderClient.h b/WebCore/loader/ThreadableLoaderClient.h
index 93a8e86..b8a6584 100644
--- a/WebCore/loader/ThreadableLoaderClient.h
+++ b/WebCore/loader/ThreadableLoaderClient.h
@@ -36,7 +36,7 @@ namespace WebCore {
     class ResourceError;
     class ResourceResponse;
 
-    class ThreadableLoaderClient {
+    class ThreadableLoaderClient : public Noncopyable {
     public:
         virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 230c77d..86083f5 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -47,7 +47,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class WorkerContext;
     class WorkerLoaderProxy;
     struct CrossThreadResourceResponseData;
@@ -94,7 +94,7 @@ namespace WebCore {
         //    thread do "ThreadableLoaderClientWrapper::ref" (automatically inside of the cross thread copy
         //    done in createCallbackTask), so the ThreadableLoaderClientWrapper instance is there until all
         //    tasks are executed.
-        class MainThreadBridge : ThreadableLoaderClient {
+        class MainThreadBridge : public ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
             MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
diff --git a/WebCore/loader/appcache/ApplicationCache.h b/WebCore/loader/appcache/ApplicationCache.h
index d1444c0..08e2dd3 100644
--- a/WebCore/loader/appcache/ApplicationCache.h
+++ b/WebCore/loader/appcache/ApplicationCache.h
@@ -42,7 +42,7 @@ class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
 
-struct ResourceRequest;
+class ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 1a223ce..7398ef4 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -622,7 +622,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
         ASSERT(newestManifest);
     
         if (!m_manifestResource || // The resource will be null if HTTP response was 304 Not Modified.
-            newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
+            (newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size()))) {
 
             m_completionType = NoUpdate;
             m_manifestResource = 0;
@@ -947,9 +947,9 @@ void ApplicationCacheGroup::scheduleReachedMaxAppCacheSizeCallback()
 
 class CallCacheListenerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
+    static PassOwnPtr<CallCacheListenerTask> create(PassRefPtr<DocumentLoader> loader, ApplicationCacheHost::EventID eventID)
     {
-        return adoptRef(new CallCacheListenerTask(loader, eventID));
+        return new CallCacheListenerTask(loader, eventID);
     }
 
     virtual void performTask(ScriptExecutionContext* context)
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index 236013d..9c355de 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -45,7 +45,7 @@ namespace WebCore {
     class KURL;
     class ResourceLoader;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class SubstituteData;
 #if PLATFORM(CHROMIUM)
@@ -57,7 +57,7 @@ namespace WebCore {
     class ApplicationCacheStorage;
 #endif
 
-    class ApplicationCacheHost {
+    class ApplicationCacheHost : public Noncopyable {
     public:
         // The Status numeric values are specified in the HTML5 spec.
         enum Status {
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.h b/WebCore/loader/appcache/ApplicationCacheStorage.h
index 1348aa9..aaa5c9c 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -44,7 +44,7 @@ class KURL;
 template <class T>
 class StorageIDJournal;
 
-class ApplicationCacheStorage {
+class ApplicationCacheStorage : public Noncopyable {
 public:
     void setCacheDirectory(const String&);
     const String& cacheDirectory() const;
diff --git a/WebCore/loader/archive/ArchiveFactory.cpp b/WebCore/loader/archive/ArchiveFactory.cpp
index 1322dbb..d09b064 100644
--- a/WebCore/loader/archive/ArchiveFactory.cpp
+++ b/WebCore/loader/archive/ArchiveFactory.cpp
@@ -29,12 +29,13 @@
 #include "config.h"
 #include "ArchiveFactory.h"
 
-#if PLATFORM(CF)
-#include "LegacyWebArchive.h"
-#endif
 #include "MIMETypeRegistry.h"
 #include "PlatformString.h"
 
+#if PLATFORM(CF) && !PLATFORM(QT)
+#include "LegacyWebArchive.h"
+#endif
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
@@ -55,14 +56,14 @@ static ArchiveMIMETypesMap& archiveMIMETypes()
 {
     DEFINE_STATIC_LOCAL(ArchiveMIMETypesMap, mimeTypes, ());
     static bool initialized = false;
-    
+
     if (initialized)
         return mimeTypes;
-    
-#if PLATFORM(CF)
+
+#if PLATFORM(CF) && !PLATFORM(QT)
     mimeTypes.set("application/x-webarchive", archiveFactoryCreate<LegacyWebArchive>);
 #endif
-        
+
     initialized = true;
     return mimeTypes;
 }
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index eb606d8..c98a2f0 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -71,6 +71,27 @@ Loader::~Loader()
     ASSERT_NOT_REACHED();
 }
     
+static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
+{
+    switch (type) {
+    case CachedResource::CSSStyleSheet:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        return ResourceRequest::TargetIsStyleSheet;
+    case CachedResource::Script: 
+        return ResourceRequest::TargetIsScript;
+    case CachedResource::FontResource:
+        return ResourceRequest::TargetIsFontResource;
+    case CachedResource::ImageResource:
+        return ResourceRequest::TargetIsImage;
+    }
+    return ResourceRequest::TargetIsSubresource;
+}
+
 Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 {
 #if REQUEST_MANAGEMENT_ENABLED
@@ -301,6 +322,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         requestsPending.removeFirst();
         
         ResourceRequest resourceRequest(request->cachedResource()->url());
+        resourceRequest.setTargetType(cachedResourceTypeToTargetType(request->cachedResource()->type()));
         
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
@@ -377,7 +399,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     docLoader->checkForPendingPreloads();
 
 #if REQUEST_DEBUG
-    KURL u(resource->url());
+    KURL u(ParsedURLString, resource->url());
     printf("HOST %s COUNT %d RECEIVED %s\n", u.host().latin1().data(), m_requestsLoading.size(), resource->url().latin1().data());
 #endif
     servePendingRequests();
diff --git a/WebCore/manual-tests/autocompletion-fire-onchange.html b/WebCore/manual-tests/autocompletion-fire-onchange.html
new file mode 100644
index 0000000..c6ba288
--- /dev/null
+++ b/WebCore/manual-tests/autocompletion-fire-onchange.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+<script>
+// This test case is based on the test case http://data.ici-bas.fr/chromiumissue10879/.
+window.changed = false;
+function checkForChange()
+{
+    if (!location.search)
+        return true;
+        
+    if (!window.changed && document.getElementById("field").value != "")
+        log("FAIL");
+    else
+        log("PASS");
+    return false;
+}
+
+function log(msg)
+{
+    document.getElementById("log").appendChild(document.createTextNode(msg + "\n"));
+}
+</script>
+</head>
+<body>
+<p id="description">This test verifies that on autocompletion the 'onchange' event is fired.</p>
+<p>Steps to reproduce:</p>
+<ol>
+  <li>In the input field, type the word &quot;apple&quot; (without quotes). Then click the button Submit or hit the return/enter 
+  key on your keyboard</li>
+  <li>Once the page reloads, in the input field, type &quot;ap&quot; (without quotes) and let the browser autocomplete the word (or select 
+  &quot;apple&quot; from the autocompletion drop-down list contextual menu). Then click the button Submit or hit the return/enter 
+  key on your keyboard.</li>
+</ol>
+<form method="get" onsubmit="return checkForChange()">
+    <p><input type="text" name="field" id="field" value="" onchange="window.changed = true"/></p>
+    <p><input type="submit" value="Submit"/></p>
+</form>
+<pre id="log"></pre>
+</body>
+</html>
diff --git a/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html b/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html
new file mode 100644
index 0000000..4612cd6
--- /dev/null
+++ b/WebCore/manual-tests/inspector/bp-in-named-eval-after-reload.html
@@ -0,0 +1,65 @@
+<style>code{background-color: #ffc;}</style>
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=31375">Bug 31375</a> - Web Inspector: breakpoints in named evals are not restored after a reload</b>
+
+<ul>
+<li><p>open this page with Web Inspector
+<li><p>switch to the Scripts panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+<ul>
+<li>(program): f1.js
+<li>(program): f2.js
+<li>bp-in-named-eval-after-reload.html
+</ul>
+<li><p>In <code>(program) f1.js</code>, set a breakpoint on the first
+executable line of the function <code>f1()</code>, the invocation of <code>doNothing()</code>.
+<li><p>In <code>(program) f2.js</code>, set a breakpoint on the first
+executable line of the function <code>f2()</code>, the invocation of <code>doNothing()</code>.
+<li><p>click this button: <input id=button type=button value="click me">
+<li><p>debugger should stop in the <code>f1()</code> function.
+<li><p>resume the debugger
+<li><p>debugger should stop in the <code>f2()</code> function (the function in <code>(program) f2.js</code>)
+<li><p>resume the debugger
+<li><p>switch to the web page, reload the web page, switch back to web inspector
+<li><p>in the breakpoints sidebar panel, click on the two breakpoints listed
+and the source for those functions should be shown in the source panel, and
+the previous breakpoint markers should be visible
+<li><p>click the "click me" button above, again
+<li><p>debugger should stop in the <code>f1()</code> function.
+<li><p>resume the debugger
+<li><p>debugger should stop in the <code>f2()</code> function.
+<li><p>resume the debugger
+</ul>
+
+<p>Note that without the fix in <a href="https://bugs.webkit.org/show_bug.cgi?id=31375">Bug 31375</a>,
+the breakpoints won't work after reloading the page.
+
+<script>
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+eval([
+    "function f1() {",
+    "   doNothing();",
+    "   console.log(new Date() + ':  f1() called');",
+    "}",
+    "//@sourceURL=f1.js"
+].join("\n"));
+
+f2 = Function([
+    "",
+    "   doNothing();",
+    "   console.log(new Date() + ':  f2() called');",
+    "//@sourceURL=f2.js"
+].join("\n"));
+
+var button = document.getElementById("button");
+
+button.addEventListener("click", clickHandler, false);
+
+function clickHandler() {
+    f1();
+    f2();
+}
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html b/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html
new file mode 100644
index 0000000..df089d5
--- /dev/null
+++ b/WebCore/manual-tests/inspector/debugger-shortcuts-with-console-opened.html
@@ -0,0 +1,16 @@
+<script>
+function testFunction()
+{
+    showAlert();
+}
+
+function showAlert()
+{
+    alert("Test completed.");
+}
+</script>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=31252">Bug 31252: Web Inspector: Debugger shortcuts (F8, F10, F11) have no effect if the Console view is open</a>.</p>
+<p>To test, open the Inspector and start a debugging session. Open the Console view (press Esc or click the "Show console" button in the status bar) and make sure it is focused (the cursor is blinking in the text prompt.)
+Set a breakpoint inside testFunction() (on the showAlert() call) and press F8. Now click the Test button in the page. The execution should stop on an HTML line containing <b>onclick="testFunction()"</b>. Press F8. The execution should stop on the breakpoint.
+Press F11, F10, F11 sequentially. You should see the "Test completed." alert dialog ONLY after the last keypress.</p>
+<button onclick="testFunction()">Test</button><br><br>
diff --git a/WebCore/manual-tests/inspector/hidden-evals.html b/WebCore/manual-tests/inspector/hidden-evals.html
new file mode 100644
index 0000000..c507bcd
--- /dev/null
+++ b/WebCore/manual-tests/inspector/hidden-evals.html
@@ -0,0 +1,118 @@
+
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30212">Bug 30212</a> - Each JS execution in console adds extra item into "scripts" combo</b>
+
+<p>The following manual test creates functions via <tt>eval()</tt> and the 
+<tt>Function()</tt> constructor, some functions are named using the 
+<code>//@sourceURL=</code> directive, some aren't.  Some contain
+<tt>debugger</tt> commands, some don't.
+
+<p>The functions named <tt>f_named_X</tt> are 'named' via the 
+<code>//@sourceURL=</code> directive, the ones named <tt>f_unnamed_X</tt>
+are not.  The 'named' functions should show up in the Scripts select element used 
+to select a resource/script to view, the 'unnamed' ones should not.
+
+<ul>
+<li><p>open this page with Web Inspector
+<li><p>switch to the Scripts panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+<ul>
+<li>(program): f_named_1.eval
+<li>(program): f_named_2.eval
+<li>(program): f_named_3.eval
+<li>hidden-evals.html
+</ul>
+<li><p>click this button: <input id=button type=button value="click me">
+<li><p>debugger should stop in the <code>clickHandler</code> function
+<li><p>at this point, start stepping <b>into</b> the code
+<li><p>you should be able to step into functions <code>f_unnamed_1()</code>
+and <code>f_unnamed_2()</code>.  There are no resource/scripts in the 
+select element that contain these functions, until you actually are paused 
+in them.  At that point, entries for these functions will be in the select element,
+named: "(program)".  After pausing in both functions, there will be two "(program)"
+entries.
+<li><p>you should be able to use the next/prev buttons (to the left of the select element)
+to switch to other resources/scripts that have been opened, including the ones
+containing these functions
+<li><p>you should be able to click on the functions that exist in the 'hidden'
+resources from the Call Stack, and be shown the source; click around the
+stack trace entries to verify
+<li><p>rather than stepping into the <code>f_named_3()</code> call, press the
+resume button
+<li><p>the debugger should stop in <code>f_named_3()</code> because of the
+<code>debugger</code> command
+<li><p>rather than stepping into the <code>f_unnamed_3()</code> call, press the
+resume button
+<li><p>the debugger should stop in <code>f_unnamed_3()</code> because of the
+<code>debugger</code> command.  At this point, a third "(program)" entry for
+this function is added to the select element.
+</ul>
+
+<script>
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+eval([
+    "function f_named_1() {",
+    "   doNothing();",
+    "   return 'named_1';",
+    "}",
+    "//@sourceURL=f_named_1.eval"
+].join("\n"));
+
+eval([
+    "function f_unnamed_1() {",
+    "   doNothing();",
+    "   return 'unnamed_1';",
+    "}"
+].join("\n"));
+
+f_named_2 = Function([
+    "",
+    "   doNothing();",
+    "   return 'named_2';",
+    "//@sourceURL=f_named_2.eval"
+].join("\n"));
+
+f_unnamed_2 = Function([
+    "",
+    "   doNothing();",
+    "   return 'unnamed_2';"
+].join("\n"));
+
+f_named_3 = Function([
+    "",
+    "   debugger;",
+    "   doNothing();",
+    "   return 'named_3';",
+    "//@sourceURL=f_named_3.eval"
+].join("\n"));
+
+f_unnamed_3 = Function([
+    "",
+    "   debugger;",
+    "   doNothing();",
+    "   return 'unnamed_3';"
+].join("\n"));
+
+var button = document.getElementById("button");
+
+button.addEventListener("click", clickHandler, false);
+
+function clickHandler() {
+    debugger;
+    f_named_1();
+    f_unnamed_1();
+    f_named_2();
+    f_unnamed_2();
+    
+    // press "resume" at this point
+    console.log("press resume before calling f_named_3()");
+    f_named_3();
+    
+    // press "resume" at this point
+    console.log("press resume before calling f_unnamed_3()");
+    f_unnamed_3();
+}
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/inspector/remember-last-script.html b/WebCore/manual-tests/inspector/remember-last-script.html
new file mode 100644
index 0000000..52e7f02
--- /dev/null
+++ b/WebCore/manual-tests/inspector/remember-last-script.html
@@ -0,0 +1,42 @@
+<style>code{background-color: #ffc;}</style>
+<p><b>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=27552">Bug 27552</a> - remember last script displayed in Scripts panel</b>
+
+<ul>
+<li><p>open this page with Web Inspector, switch to the <b>Scripts</b> panel, enabling debug if required
+<li><p>the available scripts in the select element should be:
+    <ul>
+        <li><b>(program): f1.js</b>
+        <li><b>remember-last-script.html</b>
+    </ul>
+<li><p>select <b>(program): f1.js</b> so the source is available
+<li><p>switch to the <b>Resources</b> panel
+<li><p>close Web Inspector
+<li><p>Repeat the following several times.  Each time, <b>(program): f1.js</b>
+should be the selected script:
+    <ul>
+    <li>open Web Inspector, switch to the <b>Scripts</b> panel, then close Web Inspector
+    </ul>
+<li><p>open Web Inspector, switch to the <b>Scripts</b> panel
+<li><p>select <b>remember-last-script.html</b> so the source is available
+<li><p>Repeat the following several times.  Each time, <b>remember-last-script.html</b>
+should be the selected script:
+    <ul>
+    <li>open Web Inspector, switch to the <b>Scripts</b> panel, then close Web Inspector
+    </ul>
+</ul>    
+
+<script>
+
+f1 = Function([
+    "",
+    "   doNothing();",
+    "//@sourceURL=f1.js"
+].join("\n"));
+
+function doNothing() { /* allows multi-line functions, easier to debug */ };
+
+doNothing();
+f1();
+
+</script>
+<!-- End -->
diff --git a/WebCore/manual-tests/plugins/windowed.html b/WebCore/manual-tests/plugins/windowed.html
index 4020408..808a0ad 100644
--- a/WebCore/manual-tests/plugins/windowed.html
+++ b/WebCore/manual-tests/plugins/windowed.html
@@ -22,6 +22,15 @@
     }
 </style>
 <script>
+    function testVisibility() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        if (flashPlugin.style.display == 'none') {
+            flashPlugin.style.display = 'block';
+        } else {
+            flashPlugin.style.display = 'none';
+        }
+    }
+
     function testResize() {
         var flashPlugin = document.getElementById('flashPlugin');
         flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
@@ -66,6 +75,9 @@
 
     <div style="clear:both"/>
 
+    <input type="checkbox" name="visibilityCheckBox"> Verify if the flash toggles visibility
+            <input type="button" id="visibilityButton" value="Test Visibility" onClick="testVisibility()"/><br/>
+
     <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
             <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
 
diff --git a/WebCore/manual-tests/plugins/windowless.html b/WebCore/manual-tests/plugins/windowless.html
index b553526..1020abb 100644
--- a/WebCore/manual-tests/plugins/windowless.html
+++ b/WebCore/manual-tests/plugins/windowless.html
@@ -22,6 +22,15 @@
     }
 </style>
 <script>
+    function testVisibility() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        if (flashPlugin.style.display == 'none') {
+            flashPlugin.style.display = 'block';
+        } else {
+            flashPlugin.style.display = 'none';
+        }
+    }
+
     function testResize() {
         var flashPlugin = document.getElementById('flashPlugin');
         flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
@@ -67,6 +76,9 @@
 
     <div style="clear:both"/>
 
+    <input type="checkbox" name="visibilityCheckBox"> Verify if the flash toggles visibility
+            <input type="button" id="visibilityButton" value="Test Visibility" onClick="testVisibility()"/><br/>
+
     <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
             <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
 
diff --git a/WebCore/manual-tests/qt/qtplugin.html b/WebCore/manual-tests/qt/qtplugin.html
index b2dbf3c..631ce63 100644
--- a/WebCore/manual-tests/qt/qtplugin.html
+++ b/WebCore/manual-tests/qt/qtplugin.html
@@ -1,14 +1,24 @@
 <html>
 <body>
 Image:<br/>
- <img src="http://labs.trolltech.com/skins/trolltech_labs/categories/internet.png" width="80" height="80"/>
+ <img src="qrc:/webkit/inspector/Images/largerResourcesButtonGlyph.png" width="80" height="80"/>
  <br/>
+
+<!-- visible progressbar -->
+<div>
 QT progress bar:
-<br/>
-<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar" height=30></object>
+<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar1" height=30></object>
+</div>
+
+<!-- should not be visible -->
+<div style="visibility: hidden;">
+You should not see this:
+<object type="application/x-qt-plugin" classid="QProgressBar" name="progressbar2" height=30></object>
+</div>
+
 <script>
 function display(){
- if (++document.progressbar.value != 100)
+ if (++document.progressbar1.value != 100)
 setTimeout("display()", 50)
 }
 display();
diff --git a/WebCore/manual-tests/user-drag-with-decorations.html b/WebCore/manual-tests/user-drag-with-decorations.html
new file mode 100644
index 0000000..1878d11
--- /dev/null
+++ b/WebCore/manual-tests/user-drag-with-decorations.html
@@ -0,0 +1,7 @@
+This tests that we don't include overflow decorations from our ancestor nodes in the drag image for -webkit-user-drag: element.  To perform this test drag the green square below.  The drag image should not contain any parts of the scrollbar graphics visible on the page.
+
+<div style="height:100px; width:100px;overflow:scroll;">
+    <div style="-webkit-user-drag:element;position:absolute; background: rgba(0,128,0,0.5); height:100px; width:100px;">
+        Drag me!
+    </div>
+</div>
\ No newline at end of file
diff --git a/WebCore/manual-tests/webgl/SpinningBox.html b/WebCore/manual-tests/webgl/SpinningBox.html
index 203d7bd..e68711c 100644
--- a/WebCore/manual-tests/webgl/SpinningBox.html
+++ b/WebCore/manual-tests/webgl/SpinningBox.html
@@ -45,7 +45,7 @@
             gl.box = makeBox(gl);
 
             // color array
-            var colors = new CanvasUnsignedByteArray(
+            var colors = new WebGLUnsignedByteArray(
                 [  0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,     // v0-v1-v2-v3 front
                    1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,     // v0-v3-v4-v5 right
                    0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,     // v0-v5-v6-v1 top
diff --git a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
index f35727f..90fcb3f 100644
--- a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
+++ b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
@@ -33,7 +33,7 @@
         void load(in CanvasMatrix4 matrix);                 // copy the values from the passed matrix
         void load(in sequence<float> array);                // copy 16 floats into the matrix
         sequence<float> getAsArray();                       // return the matrix as an array of 16 floats
-        CanvasFloatArray getAsCanvasFloatArray();           // return the matrix as a CanvasFloatArray with 16 values
+        WebGLFloatArray getAsCanvasFloatArray();           // return the matrix as a WebGLFloatArray with 16 values
         void makeIdentity();                                // replace the matrix with identity
         void transpose();                                   // replace the matrix with its transpose
         void invert();                                      // replace the matrix with its inverse
@@ -141,7 +141,7 @@ CanvasMatrix4.prototype.getAsArray = function()
 
 CanvasMatrix4.prototype.getAsCanvasFloatArray = function()
 {
-    return new CanvasFloatArray(this.getAsArray());
+    return new WebGLFloatArray(this.getAsArray());
 }
 
 CanvasMatrix4.prototype.makeIdentity = function()
diff --git a/WebCore/manual-tests/webgl/resources/utils3d.js b/WebCore/manual-tests/webgl/resources/utils3d.js
index 0ffd7c4..58f520f 100644
--- a/WebCore/manual-tests/webgl/resources/utils3d.js
+++ b/WebCore/manual-tests/webgl/resources/utils3d.js
@@ -2,7 +2,7 @@
 // initWebGL
 //
 // Initialize the Canvas element with the passed name as a WebGL object and return the
-// CanvasRenderingContext3D. 
+// WebGLRenderingContext. 
 //
 // Load shaders with the passed names and create a program with them. Return this program 
 // in the 'program' property of the returned context.
@@ -43,7 +43,7 @@ function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth
     gl.linkProgram(gl.program);
 
     // Check the link status
-    var linked = gl.getProgrami(gl.program, gl.LINK_STATUS);
+    var linked = gl.getProgramParameter(gl.program, gl.LINK_STATUS);
     if (!linked) {
         // something went wrong with the link
         var error = gl.getProgramInfoLog (gl.program);
@@ -72,7 +72,7 @@ function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth
 // loadShader
 //
 // 'shaderId' is the id of a <script> element containing the shader source string.
-// Load this shader and return the CanvasShader object corresponding to it.
+// Load this shader and return the WebGLShader object corresponding to it.
 //
 function loadShader(ctx, shaderId)
 {
@@ -105,7 +105,7 @@ function loadShader(ctx, shaderId)
     ctx.compileShader(shader);
 
     // Check the compile status
-    var compiled = ctx.getShaderi(shader, ctx.COMPILE_STATUS);
+    var compiled = ctx.getShaderParameter(shader, ctx.COMPILE_STATUS);
     if (!compiled) {
         // Something went wrong during compilation; get the error
         var error = ctx.getShaderInfoLog(shader);
@@ -123,10 +123,10 @@ function loadShader(ctx, shaderId)
 // Create a box with vertices, normals and texCoords. Create VBOs for each as well as the index array.
 // Return an object with the following properties:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 // 
 function makeBox(ctx)
@@ -141,7 +141,7 @@ function makeBox(ctx)
     //  v2------v3
     //
     // vertex coords array
-    var vertices = new CanvasFloatArray(
+    var vertices = new WebGLFloatArray(
         [  1, 1, 1,  -1, 1, 1,  -1,-1, 1,   1,-1, 1,    // v0-v1-v2-v3 front
            1, 1, 1,   1,-1, 1,   1,-1,-1,   1, 1,-1,    // v0-v3-v4-v5 right
            1, 1, 1,   1, 1,-1,  -1, 1,-1,  -1, 1, 1,    // v0-v5-v6-v1 top
@@ -151,7 +151,7 @@ function makeBox(ctx)
     );
 
     // normal array
-    var normals = new CanvasFloatArray(
+    var normals = new WebGLFloatArray(
         [  0, 0, 1,   0, 0, 1,   0, 0, 1,   0, 0, 1,     // v0-v1-v2-v3 front
            1, 0, 0,   1, 0, 0,   1, 0, 0,   1, 0, 0,     // v0-v3-v4-v5 right
            0, 1, 0,   0, 1, 0,   0, 1, 0,   0, 1, 0,     // v0-v5-v6-v1 top
@@ -162,7 +162,7 @@ function makeBox(ctx)
 
 
     // texCoord array
-    var texCoords = new CanvasFloatArray(
+    var texCoords = new WebGLFloatArray(
         [  1, 1,   0, 1,   0, 0,   1, 0,    // v0-v1-v2-v3 front
            0, 1,   0, 0,   1, 0,   1, 1,    // v0-v3-v4-v5 right
            1, 0,   1, 1,   0, 1,   0, 0,    // v0-v5-v6-v1 top
@@ -172,7 +172,7 @@ function makeBox(ctx)
        );
 
     // index array
-    var indices = new CanvasUnsignedByteArray(
+    var indices = new WebGLUnsignedByteArray(
         [  0, 1, 2,   0, 2, 3,    // front
            4, 5, 6,   4, 6, 7,    // right
            8, 9,10,   8,10,11,    // top
@@ -214,10 +214,10 @@ function makeBox(ctx)
 // Sphere has vertices, normals and texCoords. Create VBOs for each as well as the index array.
 // Return an object with the following properties:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 // 
 function makeSphere(ctx, radius, lats, longs)
@@ -272,20 +272,20 @@ function makeSphere(ctx, radius, lats, longs)
     
     retval.normalObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(normalData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(normalData), ctx.STATIC_DRAW);
 
     retval.texCoordObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(texCoordData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(texCoordData), ctx.STATIC_DRAW);
 
     retval.vertexObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
-    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(geometryData), ctx.STATIC_DRAW);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new WebGLFloatArray(geometryData), ctx.STATIC_DRAW);
     
     retval.numIndices = indexData.length;
     retval.indexObject = ctx.createBuffer();
     ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
-    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexData), ctx.STREAM_DRAW);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedShortArray(indexData), ctx.STREAM_DRAW);
     
     return retval;
 }
@@ -297,10 +297,10 @@ function makeSphere(ctx, radius, lats, longs)
 // When the object load is complete, the 'loaded' property becomes true and the following 
 // properties are set:
 //
-//  normalObject        CanvasBuffer object for normals
-//  texCoordObject      CanvasBuffer object for texCoords
-//  vertexObject        CanvasBuffer object for vertices
-//  indexObject         CanvasBuffer object for indices
+//  normalObject        WebGLBuffer object for normals
+//  texCoordObject      WebGLBuffer object for texCoords
+//  vertexObject        WebGLBuffer object for vertices
+//  indexObject         WebGLBuffer object for indices
 //  numIndices          The number of indices in the indexObject
 //  
 function loadObj(ctx, url)
@@ -438,20 +438,20 @@ function doLoadObj(obj, text)
     // set the VBOs
     obj.normalObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.normalObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(normalArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(normalArray), obj.ctx.STATIC_DRAW);
 
     obj.texCoordObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.texCoordObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(textureArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(textureArray), obj.ctx.STATIC_DRAW);
 
     obj.vertexObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.vertexObject);
-    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new WebGLFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
     
     obj.numIndices = indexArray.length;
     obj.indexObject = obj.ctx.createBuffer();
     obj.ctx.bindBuffer(obj.ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
-    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
+    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new WebGLUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
     
     obj.loaded = true;
 }
@@ -459,7 +459,7 @@ function doLoadObj(obj, text)
 //
 // loadImageTexture
 //
-// Load the image at the passed url, place it in a new CanvasTexture object and return the CanvasTexture.
+// Load the image at the passed url, place it in a new WebGLTexture object and return the WebGLTexture.
 //
 function loadImageTexture(ctx, url)
 {
@@ -528,4 +528,3 @@ Framerate.prototype.snapshot = function()
         this.renderTime = newTime;
     }
 }
-
diff --git a/WebCore/notifications/Notification.cpp b/WebCore/notifications/Notification.cpp
index 8dd168f..ecb5799 100644
--- a/WebCore/notifications/Notification.cpp
+++ b/WebCore/notifications/Notification.cpp
@@ -48,6 +48,7 @@ Notification::Notification(const String& url, ScriptExecutionContext* context, E
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
@@ -67,6 +68,7 @@ Notification::Notification(const NotificationContents& contents, ScriptExecution
     , m_isShowing(false)
     , m_presenter(provider)
 {
+    ASSERT(m_presenter);
     if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
diff --git a/WebCore/notifications/NotificationCenter.cpp b/WebCore/notifications/NotificationCenter.cpp
index 69b0075..45d29cf 100644
--- a/WebCore/notifications/NotificationCenter.cpp
+++ b/WebCore/notifications/NotificationCenter.cpp
@@ -40,20 +40,6 @@
 
 namespace WebCore {
 
-#if USE(V8)
-static bool notificationCenterAvailable = false;
-
-void NotificationCenter::setIsAvailable(bool available)
-{
-    notificationCenterAvailable = available;
-}
-
-bool NotificationCenter::isAvailable()
-{
-    return notificationCenterAvailable;
-}
-#endif
-
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
     : ActiveDOMObject(context, this)
     , m_scriptExecutionContext(context)
@@ -61,11 +47,15 @@ NotificationCenter::NotificationCenter(ScriptExecutionContext* context, Notifica
 
 int NotificationCenter::checkPermission() 
 {
+    if (!presenter())
+        return NotificationPresenter::PermissionDenied;
     return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
+    if (!presenter())
+        return;
     m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
 }
 
diff --git a/WebCore/notifications/NotificationCenter.h b/WebCore/notifications/NotificationCenter.h
index 1084442..ae3dc02 100644
--- a/WebCore/notifications/NotificationCenter.h
+++ b/WebCore/notifications/NotificationCenter.h
@@ -47,19 +47,23 @@ namespace WebCore {
 
     class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
     public:
-#if USE(V8)
-        static void setIsAvailable(bool);
-        static bool isAvailable();
-#endif
         static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
 
         Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
         }
 
         Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
         {
+            if (!presenter()) {
+                ec = INVALID_STATE_ERR;
+                return 0;
+            }
             NotificationContents contents(iconURI, title, body);
             return Notification::create(contents, context(), ec, presenter());
         }
@@ -70,6 +74,8 @@ namespace WebCore {
         int checkPermission();
         void requestPermission(PassRefPtr<VoidCallback> callback);
 
+        void disconnectFrame() { m_notificationPresenter = 0; }
+
     private:
         NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
 
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index 7e14b3e..0b85535 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -154,6 +154,11 @@ void Chrome::takeFocus(FocusDirection direction) const
     m_client->takeFocus(direction);
 }
 
+void Chrome::focusedNodeChanged(Node* node) const
+{
+    m_client->focusedNodeChanged(node);
+}
+
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
@@ -309,6 +314,16 @@ bool Chrome::shouldInterruptJavaScript()
     return m_client->shouldInterruptJavaScript();
 }
 
+void Chrome::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerProtocolHandler(scheme, baseURL, url, title);
+}
+
+void Chrome::registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title)
+{
+    m_client->registerContentHandler(mimeType,  baseURL, url,  title);
+}
+
 IntRect Chrome::windowResizerRect() const
 {
     return m_client->windowResizerRect();
@@ -399,11 +414,6 @@ void Chrome::print(Frame* frame)
 
 void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-    // Defer loads in case the client method runs a new event loop that would
-    // otherwise cause the load to continue while we're in the middle of executing JavaScript.
-    PageGroupLoadDeferrer deferrer(m_page, true);
-
-    ASSERT(frame);
     m_client->requestGeolocationPermissionForFrame(frame, geolocation);
 }
 
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index c562f33..398548f 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class Geolocation;
     class HitTestResult;
     class IntRect;
+    class Node;
     class Page;
     class String;
 #if ENABLE(NOTIFICATIONS)
@@ -86,6 +87,8 @@ namespace WebCore {
         bool canTakeFocus(FocusDirection) const;
         void takeFocus(FocusDirection) const;
 
+        void focusedNodeChanged(Node*) const;
+
         Page* createWindow(Frame*, const FrameLoadRequest&, const WindowFeatures&) const;
         void show() const;
 
@@ -118,6 +121,9 @@ namespace WebCore {
         void setStatusbarText(Frame*, const String&);
         bool shouldInterruptJavaScript();
 
+        void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+        void registerContentHandler(const String& mimeType, const String& baseURL, const String& url, const String& title);
+
         IntRect windowResizerRect() const;
 
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
@@ -132,7 +138,7 @@ namespace WebCore {
 
         bool setCursor(PlatformCursorHandle);
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
         void focusNSView(NSView*);
 #endif
 
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 194f855..117953c 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -87,6 +87,8 @@ namespace WebCore {
         virtual bool canTakeFocus(FocusDirection) = 0;
         virtual void takeFocus(FocusDirection) = 0;
 
+        virtual void focusedNodeChanged(Node*) = 0;
+
         // The Frame pointer provides the ChromeClient with context about which
         // Frame wants to create the new Page.  Also, the newly created window
         // should not be shown to the user until the ChromeClient of the newly
@@ -125,6 +127,9 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual bool tabsToLinks() const = 0;
 
+        virtual void registerProtocolHandler(const String&, const String&, const String&, const String&) { }
+        virtual void registerContentHandler(const String&, const String&, const String&, const String&) { }
+
         virtual IntRect windowResizerRect() const = 0;
 
         // Methods used by HostWindow.
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 7d0f697..b1b091a 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -191,7 +191,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
 
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i) {
         String argAsString;
-        if (lastCaller.argumentAt(i).getString(argAsString))
+        if (lastCaller.argumentAt(i).getString(callStack->state(), argAsString))
             printf(" %s", argAsString.utf8().data());
     }
     printf("\n");
@@ -270,6 +270,23 @@ void Console::count(ScriptCallStack* callStack)
 #endif
 }
 
+void Console::markTimeline(ScriptCallStack* callStack)
+{
+#if ENABLE(INSPECTOR)
+    Page* page = this->page();
+    if (!page)
+        return;
+
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    String message;
+    getFirstArgumentAsString(callStack->state(), lastCaller, message);
+
+    page->inspectorController()->markTimeline(message);
+#else
+    UNUSED_PARAM(callStack);
+#endif
+}
+
 #if ENABLE(WML)
 String Console::lastWMLErrorMessage() const
 {
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 1b93a4a..ea3a161 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -95,6 +95,7 @@ namespace WebCore {
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
+        void markTimeline(ScriptCallStack*);
 #if ENABLE(WML)
         String lastWMLErrorMessage() const;
 #endif
diff --git a/WebCore/page/Console.idl b/WebCore/page/Console.idl
index 0e9f3dc..a31b605 100644
--- a/WebCore/page/Console.idl
+++ b/WebCore/page/Console.idl
@@ -44,14 +44,15 @@ module window {
         [CustomArgumentHandling] void trace();
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
+        [CustomArgumentHandling] void markTimeline();
 
 #if defined(ENABLE_WML) && ENABLE_WML
         [DontEnum] DOMString lastWMLErrorMessage();
 #endif
 
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-        [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
-        [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER || defined(V8_BINDING) && V8_BINDING
+        [Custom] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
+        [Custom] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
 #endif
 
         void time(in [ConvertUndefinedOrNullToNullString] DOMString title);
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 7d773ca..726dee9 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -31,6 +31,7 @@
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
+#include "ContextMenuSelectionHandler.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "DocumentLoader.h"
@@ -66,6 +67,7 @@ ContextMenuController::ContextMenuController(Page* page, ContextMenuClient* clie
     : m_page(page)
     , m_client(client)
     , m_contextMenu(0)
+    , m_selectionHandler(0)
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
@@ -79,13 +81,40 @@ ContextMenuController::~ContextMenuController()
 void ContextMenuController::clearContextMenu()
 {
     m_contextMenu.set(0);
+    if (m_selectionHandler)
+        m_selectionHandler->contextMenuCleared();
+    m_selectionHandler = 0;
 }
 
 void ContextMenuController::handleContextMenuEvent(Event* event)
 {
-    ASSERT(event->type() == eventNames().contextmenuEvent);
-    if (!event->isMouseEvent())
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu)
         return;
+    m_contextMenu->populate();
+    showContextMenu(event);
+}
+
+void ContextMenuController::showContextMenu(Event* event, Vector<ContextMenuItem>& items, PassRefPtr<ContextMenuSelectionHandler> selectionHandler)
+{
+    m_selectionHandler = selectionHandler;
+
+    m_contextMenu.set(createContextMenu(event));
+    if (!m_contextMenu) {
+        clearContextMenu();
+        return;
+    }
+    for (size_t i = 0; i < items.size(); ++i) {
+        ContextMenuItem& item = items[i];
+        m_contextMenu->appendItem(item);
+    }
+    showContextMenu(event);
+}
+
+ContextMenu* ContextMenuController::createContextMenu(Event* event)
+{
+   if (!event->isMouseEvent())
+        return 0;
     MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
     HitTestResult result(mouseEvent->absoluteLocation());
 
@@ -93,18 +122,18 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
         result = frame->eventHandler()->hitTestResultAtPoint(mouseEvent->absoluteLocation(), false);
 
     if (!result.innerNonSharedNode())
-        return;
+        return 0;
+    return new ContextMenu(result);
+}
 
-    m_contextMenu.set(new ContextMenu(result));
-    m_contextMenu->populate();
+void ContextMenuController::showContextMenu(Event* event)
+{
 #if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
 #endif
-
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
-
     event->setDefaultHandled();
 }
 
@@ -126,6 +155,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         return;
     }
 
+    if (item->action() >= ContextMenuItemBaseCustomTag) {
+        ASSERT(m_selectionHandler);
+        m_selectionHandler->contextMenuItemSelected(item);
+        return;
+    }
+
     HitTestResult result = m_contextMenu->hitTestResult();
     Frame* frame = result.innerNonSharedNode()->document()->frame();
     if (!frame)
diff --git a/WebCore/page/ContextMenuController.h b/WebCore/page/ContextMenuController.h
index 38095f6..d51bc70 100644
--- a/WebCore/page/ContextMenuController.h
+++ b/WebCore/page/ContextMenuController.h
@@ -28,12 +28,16 @@
 
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
     class ContextMenu;
     class ContextMenuClient;
     class ContextMenuItem;
+    class ContextMenuSelectionHandler;
     class Event;
     class Page;
 
@@ -48,12 +52,18 @@ namespace WebCore {
         void clearContextMenu();
 
         void handleContextMenuEvent(Event*);
+        void showContextMenu(Event*, Vector<ContextMenuItem>&, PassRefPtr<ContextMenuSelectionHandler>);
+
         void contextMenuItemSelected(ContextMenuItem*);
 
     private:
+        ContextMenu* createContextMenu(Event*);
+        void showContextMenu(Event*);
+
         Page* m_page;
         ContextMenuClient* m_client;
         OwnPtr<ContextMenu> m_contextMenu;
+        RefPtr<ContextMenuSelectionHandler> m_selectionHandler;
     };
 
 }
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebCore/page/ContextMenuSelectionHandler.h
index df52379..d5a6631 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebCore/page/ContextMenuSelectionHandler.h
@@ -28,31 +28,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
+#ifndef ContextMenuSelectionHandler_h
+#define ContextMenuSelectionHandler_h
 
-#include "ScriptState.h"
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+    class ContextMenuItem;
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+    class ContextMenuSelectionHandler : public RefCounted<ContextMenuSelectionHandler> {
+    public:
+        ContextMenuSelectionHandler() { }
+        virtual ~ContextMenuSelectionHandler() { };
 
-#if ENABLE(DATABASE)
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-#endif
-#if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-#endif
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+        virtual void contextMenuItemSelected(ContextMenuItem*) = 0;
+        virtual void contextMenuCleared() = 0;
+    };
 
 }
 
-#endif // ScriptObjectQuarantine_h
+#endif // ContextMenuSelectionHandler_h
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index 83bcb02..8971bb7 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -119,8 +119,7 @@ void DOMTimer::fired()
     timerNestingLevel = m_nestingLevel;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context);
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->willFireTimer(m_timeoutId);
 #endif
 
@@ -135,7 +134,7 @@ void DOMTimer::fired()
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
             timelineAgent->didFireTimer();
 #endif
         return;
@@ -149,7 +148,7 @@ void DOMTimer::fired()
 
     action->execute(context);
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
         timelineAgent->didFireTimer();
 #endif
     delete action;
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index 8452e55..757e32f 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -53,6 +53,7 @@
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Location.h"
 #include "Media.h"
 #include "MessageEvent.h"
@@ -459,6 +460,8 @@ void DOMWindow::clear()
 #endif
 
 #if ENABLE(NOTIFICATIONS)
+    if (m_notifications)
+        m_notifications->disconnectFrame();
     m_notifications = 0;
 #endif
 }
@@ -568,14 +571,14 @@ Storage* DOMWindow::sessionStorage() const
     Document* document = this->document();
     if (!document)
         return 0;
+    
+    if (!document->securityOrigin()->canAccessStorage())
+        return 0;
 
     Page* page = document->page();
     if (!page)
         return 0;
 
-    if (!page->settings()->sessionStorageEnabled())
-        return 0;
-
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
 #if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
@@ -593,6 +596,9 @@ Storage* DOMWindow::localStorage() const
     Document* document = this->document();
     if (!document)
         return 0;
+    
+    if (!document->securityOrigin()->canAccessStorage())
+        return 0;
         
     Page* page = document->page();
     if (!page)
@@ -625,9 +631,6 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    if (!page->settings()->experimentalNotificationsEnabled())
-        return 0;
-
     NotificationPresenter* provider = page->chrome()->notificationPresenter();
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
@@ -1112,13 +1115,15 @@ PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& v
     if (!m_frame)
         return 0;
 
-    Document* doc = m_frame->document();
+    Document* document = m_frame->document();
+    if (!document->securityOrigin()->canAccessDatabase())
+        return 0;
 
     Settings* settings = m_frame->settings();
     if (!settings || !settings->databasesEnabled())
         return 0;
 
-    return Database::openDatabase(doc, name, version, displayName, estimatedSize, ec);
+    return Database::openDatabase(document, name, version, displayName, estimatedSize, ec);
 }
 #endif
 
@@ -1304,6 +1309,15 @@ void DOMWindow::dispatchLoadEvent()
 #endif
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* DOMWindow::inspectorTimelineAgent() 
+{
+    if (frame() && frame()->page())
+        return frame()->page()->inspectorTimelineAgent();
+    return 0;
+}
+#endif
+
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
     RefPtr<EventTarget> protect = this;
@@ -1313,7 +1327,24 @@ bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget
     event->setCurrentTarget(this);
     event->setEventPhase(Event::AT_TARGET);
 
-    return fireEventListeners(event.get());
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    bool timelineAgentIsActive = timelineAgent && hasEventListeners(event->type());
+    if (timelineAgentIsActive)
+        timelineAgent->willDispatchEvent(*event);
+#endif
+
+    bool result = fireEventListeners(event.get());
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgentIsActive) {
+      timelineAgent = inspectorTimelineAgent();
+      if (timelineAgent)
+            timelineAgent->didDispatchEvent();
+    }
+#endif
+
+    return result;
 }
 
 void DOMWindow::removeAllEventListeners()
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 235c9a0..5e2d990 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -52,6 +52,7 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class History;
+    class InspectorTimelineAgent;
     class Location;
     class Media;
     class Navigator;
@@ -247,9 +248,13 @@ namespace WebCore {
         void dispatchLoadEvent();
 
         DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
@@ -258,13 +263,22 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
@@ -275,39 +289,30 @@ namespace WebCore {
         DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(popstate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
         DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitbeginfullscreen);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitendfullscreen);
+
 #if ENABLE(ORIENTATION_EVENTS)
         DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 #endif
@@ -359,6 +364,7 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
+        InspectorTimelineAgent* inspectorTimelineAgent();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index c7bcf82..c4b08c6 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -31,7 +31,6 @@ module window {
         CustomDefineSetter,
         CustomDeleteProperty,
         CustomGetOwnPropertySlot,
-        CustomGetPropertyAttributes,
         CustomGetPropertyNames,
         CustomLookupGetter,
         CustomLookupSetter,
@@ -157,7 +156,7 @@ module window {
         WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
 #if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-        readonly attribute DOMApplicationCache applicationCache;
+        readonly attribute [EnabledAtRuntime] DOMApplicationCache applicationCache;
 #endif    
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         [EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
@@ -259,6 +258,7 @@ module window {
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
+        attribute EventListener onpopstate;
         attribute EventListener onprogress;
         attribute EventListener onratechange;
         attribute EventListener onresize;
@@ -439,17 +439,17 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
-        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
+        attribute [Conditional=3D_CANVAS] WebGLRenderingContextConstructor WebGLRenderingContext;
         attribute TextMetricsConstructor TextMetrics;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLArrayBufferConstructor WebGLArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLByteArrayConstructor WebGLByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedByteArrayConstructor WebGLUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLShortArrayConstructor WebGLShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedShortArrayConstructor WebGLUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLIntArrayConstructor WebGLIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLUnsignedIntArrayConstructor WebGLUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] WebGLFloatArrayConstructor WebGLFloatArray; // Usable with new operator
 
         attribute EventConstructor Event;
         attribute BeforeLoadEventConstructor BeforeLoadEvent;
diff --git a/WebCore/page/DragController.h b/WebCore/page/DragController.h
index 9472589..3d59ebf 100644
--- a/WebCore/page/DragController.h
+++ b/WebCore/page/DragController.h
@@ -47,7 +47,7 @@ namespace WebCore {
     class Range;
     class SelectionController;
     
-    class DragController {
+    class DragController : public Noncopyable {
     public:
         DragController(Page*, DragClient*);
         ~DragController();
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 6a92aa8..8b6b602 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -213,6 +213,7 @@ void EventHandler::clear()
     m_frameSetBeingResized = 0;
 #if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+    m_shouldOnlyFireDragOverEvent = false;
 #endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
@@ -1520,6 +1521,35 @@ bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTa
     return me->defaultPrevented();
 }
 
+bool EventHandler::canHandleDragAndDropForTarget(DragAndDropHandleType type, Node* target, const PlatformMouseEvent& event, Clipboard* clipboard, bool* accepted)
+{
+    bool canHandle = false;
+    bool wasAccepted = false;
+
+    if (target->hasTagName(frameTag) || target->hasTagName(iframeTag)) {
+        Frame* frame = static_cast<HTMLFrameElementBase*>(target)->contentFrame();
+        if (frame) {
+            switch (type) {
+                case UpdateDragAndDrop:
+                    wasAccepted = frame->eventHandler()->updateDragAndDrop(event, clipboard);
+                    break;
+                case CancelDragAndDrop:
+                    frame->eventHandler()->cancelDragAndDrop(event, clipboard);
+                    break;
+                case PerformDragAndDrop:
+                    wasAccepted = frame->eventHandler()->performDragAndDrop(event, clipboard);
+                    break;
+            }
+        }
+    } else
+        canHandle = true;
+
+    if (accepted)
+        *accepted = wasAccepted;
+
+    return canHandle;
+}
+
 bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
@@ -1541,28 +1571,34 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // FIXME: this ordering was explicitly chosen to match WinIE. However,
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
+        //
+        // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // As per section 7.9.4 of the HTML 5 spec., we must always fire a drag event before firing a dragenter, dragleave, or dragover event.
+            if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
-        if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        if (m_dragTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+        
+        if (newTarget) {
+            // We do not explicitly call dispatchDragEvent here because it could ultimately result in the appearance that
+            // two dragover events fired. So, we mark that we should only fire a dragover event on the next call to this function.
+            m_shouldOnlyFireDragOverEvent = true;
         }
     } else {
-        if (newTarget) {
-            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
-            if (frame)
-                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
-            else
-                accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+        if (newTarget && canHandleDragAndDropForTarget(UpdateDragAndDrop, newTarget, event, clipboard, &accept)) {
+            // Note, when dealing with sub-frames, we may need to fire only a dragover event as a drag event may have been fired earlier.
+            if (!m_shouldOnlyFireDragOverEvent && dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
+                // for now we don't care if event handler cancels default behavior, since there is none
+                dispatchDragSrcEvent(eventNames().dragEvent, event);
+            }
+            accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+            m_shouldOnlyFireDragOverEvent = false;
         }
     }
     m_dragTarget = newTarget;
@@ -1572,13 +1608,10 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 
 void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            frame->eventHandler()->cancelDragAndDrop(event, clipboard);
-        else
-            dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
+    if (m_dragTarget && canHandleDragAndDropForTarget(CancelDragAndDrop, m_dragTarget.get(), event, clipboard)) {
+        if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
+            dispatchDragSrcEvent(eventNames().dragEvent, event);
+        dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
     }
     clearDragState();
 }
@@ -1586,14 +1619,8 @@ void EventHandler::cancelDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 bool EventHandler::performDragAndDrop(const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     bool accept = false;
-    if (m_dragTarget) {
-        Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                        ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
-        if (frame)
-            accept = frame->eventHandler()->performDragAndDrop(event, clipboard);
-        else
-            accept = dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
-    }
+    if (m_dragTarget && canHandleDragAndDropForTarget(PerformDragAndDrop, m_dragTarget.get(), event, clipboard, &accept))
+        dispatchDragEvent(eventNames().dropEvent, m_dragTarget.get(), event, clipboard);
     clearDragState();
     return accept;
 }
@@ -1602,6 +1629,7 @@ void EventHandler::clearDragState()
 {
     m_dragTarget = 0;
     m_capturingMouseEventsNode = 0;
+    m_shouldOnlyFireDragOverEvent = false;
 #if PLATFORM(MAC)
     m_sendingEventToSubview = false;
 #endif
@@ -1775,7 +1803,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
-#if !PLATFORM(GTK)
+#if !PLATFORM(GTK) && !(PLATFORM(CHROMIUM) && PLATFORM(LINUX))
 bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
 {
     return false;
@@ -2205,14 +2233,7 @@ bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
 }
-    
-void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
-{
-    if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML)
-        // for now we don't care if event handler cancels default behavior, since there is none
-        dispatchDragSrcEvent(eventNames().dragEvent, event);
-}
-    
+
 void EventHandler::dragSourceEndedAt(const PlatformMouseEvent& event, DragOperation operation)
 {
     if (dragState().m_dragSrc && dragState().m_dragSrcMayBeDHTML) {
@@ -2338,9 +2359,10 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
             // gather values from DHTML element, if it set any
             dragState().m_dragClipboard->sourceOperation(srcOp);
             
-            // Yuck, dragSourceMovedTo() can be called as a result of kicking off the drag with
-            // dragImage!  Because of that dumb reentrancy, we may think we've not started the
-            // drag when that happens.  So we have to assume it's started before we kick it off.
+            // Yuck, a draggedImage:moveTo: message can be fired as a result of kicking off the
+            // drag with dragImage!  Because of that dumb reentrancy, we may think we've not
+            // started the drag when that happens.  So we have to assume it's started before we
+            // kick it off.
             dragState().m_dragClipboard->setDragHasStarted();
         }
     }
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index d8cd3a2..0da44f2 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -33,7 +33,7 @@
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(MAC) && !defined(__OBJC__)
+#if PLATFORM(MAC) && !defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 class NSView;
 #endif
 
@@ -176,7 +176,6 @@ public:
 #if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
-    void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
 #endif
 
@@ -187,7 +186,7 @@ public:
     void sendResizeEvent();
     void sendScrollEvent();
     
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC) && defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     PassRefPtr<KeyboardEvent> currentKeyboardEvent() const;
 
     void mouseDown(NSEvent *);
@@ -211,7 +210,13 @@ public:
 
 private:
 #if ENABLE(DRAG_SUPPORT)
-    struct EventHandlerDragState {
+    enum DragAndDropHandleType {
+        UpdateDragAndDrop,
+        CancelDragAndDrop,
+        PerformDragAndDrop
+    };
+
+    struct EventHandlerDragState : Noncopyable {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
         bool m_dragSrcIsImage;
@@ -223,6 +228,8 @@ private:
     };
     static EventHandlerDragState& dragState();
     static const double TextDragDelay;
+
+    bool canHandleDragAndDropForTarget(DragAndDropHandleType, Node* target, const PlatformMouseEvent&, Clipboard*, bool* accepted = 0);
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
 #endif // ENABLE(DRAG_SUPPORT)
@@ -328,7 +335,7 @@ private:
 
     bool capturesDragging() const { return m_capturesDragging; }
 
-#if PLATFORM(MAC) && defined(__OBJC__)
+#if PLATFORM(MAC) && defined(__OBJC__) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *mouseDownViewIfStillGood();
 
     PlatformMouseEvent currentPlatformMouseEvent() const;
@@ -388,6 +395,7 @@ private:
 
 #if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+    bool m_shouldOnlyFireDragOverEvent;
 #endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
@@ -405,7 +413,7 @@ private:
 
     RefPtr<Node> m_previousWheelScrolledNode;
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
     int m_activationEventNumber;
diff --git a/WebCore/page/EventSource.h b/WebCore/page/EventSource.h
index 5b037a4..c7ff2c9 100644
--- a/WebCore/page/EventSource.h
+++ b/WebCore/page/EventSource.h
@@ -36,7 +36,6 @@
 
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
-#include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
diff --git a/WebCore/page/FocusController.h b/WebCore/page/FocusController.h
index 33debf1..d86408a 100644
--- a/WebCore/page/FocusController.h
+++ b/WebCore/page/FocusController.h
@@ -28,6 +28,7 @@
 
 #include "FocusDirection.h"
 #include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -37,7 +38,7 @@ namespace WebCore {
     class Node;
     class Page;
 
-    class FocusController {
+    class FocusController : public Noncopyable {
     public:
         FocusController(Page*);
 
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index b9bf94e..7e81b3d 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -82,6 +82,10 @@
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+#import <Carbon/Carbon.h>
+#endif
+
 #if USE(JSC)
 #include "JSDOMWindowShell.h"
 #include "runtime_root.h"
@@ -874,10 +878,10 @@ void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
         return;
     UserScriptMap::const_iterator end = userScripts->end();
     for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
-        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+        injectUserScriptsForWorld(it->first.get(), *it->second, injectionTime);
 }
 
-void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+void Frame::injectUserScriptsForWorld(DOMWrapperWorld* world, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
 {
     if (userScripts.isEmpty())
         return;
@@ -891,9 +895,8 @@ void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&
     for (unsigned i = 0; i < count; ++i) {
         UserScript* script = userScripts[i].get();
         if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
-            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+            m_script.evaluateInWorld(ScriptSourceCode(script->source(), script->url()), world);
     }
-    script()->evaluateInIsolatedWorld(worldID, sourceCode);
 }
 
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
@@ -919,13 +922,36 @@ bool Frame::isContentEditable() const
     return m_doc->inDesignMode();
 }
 
-#if !PLATFORM(MAC)
-
-void Frame::setUseSecureKeyboardEntry(bool)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+const short enableRomanKeyboardsOnly = -23;
+#endif
+void Frame::setUseSecureKeyboardEntry(bool enable)
 {
-}
-
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+    if (enable == IsSecureEventInputEnabled())
+        return;
+    if (enable) {
+        EnableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+        KeyScript(enableRomanKeyboardsOnly);
+#else
+        // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
+        // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
+        // after focusing a node.
+        CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
+        TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
+        CFRelease(inputSources);
+#endif
+    } else {
+        DisableSecureEventInput();
+#ifdef BUILDING_ON_TIGER
+        KeyScript(smKeyEnableKybds);
+#else
+        TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
+#endif
+    }
 #endif
+}
 
 void Frame::updateSecureKeyboardEntryIfActive()
 {
@@ -1244,7 +1270,7 @@ FloatRect Frame::selectionBounds(bool clipToVisibleContent) const
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }
 
-void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleContent) const
+void Frame::selectionTextRects(Vector<FloatRect>& rects, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent) const
 {
     RenderView* root = contentRenderer();
     if (!root)
@@ -1252,19 +1278,36 @@ void Frame::selectionTextRects(Vector<FloatRect>& rects, bool clipToVisibleConte
 
     RefPtr<Range> selectedRange = selection()->toNormalizedRange();
 
-    Vector<IntRect> intRects;
-    selectedRange->textRects(intRects, true);
-
-    unsigned size = intRects.size();
     FloatRect visibleContentRect = m_view->visibleContentRect();
-    for (unsigned i = 0; i < size; ++i)
-        if (clipToVisibleContent)
-            rects.append(intersection(intRects[i], visibleContentRect));
-        else
-            rects.append(intRects[i]);
+    
+    // FIMXE: we are appending empty rects to the list for those that fall outside visibleContentRect.
+    // We may not want to do that.
+    if (respectTransforms) {
+        Vector<FloatQuad> quads;
+        selectedRange->textQuads(quads, true);
+
+        unsigned size = quads.size();
+        for (unsigned i = 0; i < size; ++i) {
+            IntRect currRect = quads[i].enclosingBoundingBox();
+            if (clipToVisibleContent)
+                rects.append(intersection(currRect, visibleContentRect));
+            else
+                rects.append(currRect);
+        }
+    } else {
+        Vector<IntRect> intRects;
+        selectedRange->textRects(intRects, true);
+
+        unsigned size = intRects.size();
+        for (unsigned i = 0; i < size; ++i) {
+            if (clipToVisibleContent)
+                rects.append(intersection(intRects[i], visibleContentRect));
+            else
+                rects.append(intRects[i]);
+        }
+    }
 }
 
-
 // Scans logically forward from "start", including any child frames
 static HTMLFormElement *scanForForm(Node *start)
 {
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 6208bbd..ca9a6d4 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -131,7 +131,7 @@ namespace WebCore {
         void injectUserScripts(UserScriptInjectionTime);
 
     private:
-        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
+        void injectUserScriptsForWorld(DOMWrapperWorld*, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -274,7 +274,8 @@ namespace WebCore {
         void clearTypingStyle();
 
         FloatRect selectionBounds(bool clipToVisibleContent = true) const;
-        void selectionTextRects(Vector<FloatRect>&, bool clipToVisibleContent = true) const;
+        enum SelectionRectRespectTransforms { RespectTransforms = true, IgnoreTransforms = false };
+        void selectionTextRects(Vector<FloatRect>&, SelectionRectRespectTransforms respectTransforms, bool clipToVisibleContent = true) const;
 
         HTMLFormElement* currentForm() const;
 
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 944f215..87d2d6c 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -107,13 +107,14 @@ static const double deferredRepaintDelayIncrementDuringLoading = 0;
 // The maximum number of updateWidgets iterations that should be done before returning.
 static const unsigned maxUpdateWidgetsIterations = 2;
 
-struct ScheduledEvent {
+struct ScheduledEvent : Noncopyable {
     RefPtr<Event> m_event;
     RefPtr<Node> m_eventTarget;
 };
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
+    , m_canHaveScrollbars(true)
     , m_slowRepaintObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
     , m_layoutRoot(0)
@@ -206,7 +207,7 @@ void FrameView::reset()
     m_deferredRepaintDelay = initialDeferredRepaintDelayDuringLoading;
     m_deferredRepaintTimer.stop();
     m_lastPaintTime = 0;
-    m_paintRestriction = PaintRestrictionNone;
+    m_paintBehavior = PaintBehaviorNormal;
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
@@ -228,7 +229,10 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    if (m_canHaveScrollbars)
+        setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    else
+        setScrollbarModes(ScrollbarAlwaysOff, ScrollbarAlwaysOff);
     setScrollbarsSuppressed(false);
 }
 
@@ -325,6 +329,23 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
+void FrameView::setCanHaveScrollbars(bool canHaveScrollbars)
+{
+    m_canHaveScrollbars = canHaveScrollbars;
+    ScrollView::setCanHaveScrollbars(canHaveScrollbars);
+}
+
+void FrameView::updateCanHaveScrollbars()
+{
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
+    if (hMode == ScrollbarAlwaysOff && vMode == ScrollbarAlwaysOff)
+        m_canHaveScrollbars = false;
+    else
+        m_canHaveScrollbars = true;
+}
+
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -351,6 +372,9 @@ PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientatio
 
 void FrameView::setContentsSize(const IntSize& size)
 {
+    if (size == contentsSize())
+        return;
+
     m_deferSetNeedsLayouts++;
 
     ScrollView::setContentsSize(size);
@@ -423,7 +447,7 @@ void FrameView::updateCompositingLayers()
         return;
 
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
-    view->compositor()->cacheAcceleratedCompositingEnabledFlag();
+    view->compositor()->cacheAcceleratedCompositingFlags();
     
     if (!view->usesCompositing())
         return;
@@ -466,8 +490,9 @@ bool FrameView::syncCompositingStateRecursive()
         }
     }
     return allSubframesSynced;
-#endif // USE(ACCELERATED_COMPOSITING)
+#else // USE(ACCELERATED_COMPOSITING)
     return true;
+#endif
 }
 
 void FrameView::didMoveOnscreen()
@@ -513,9 +538,8 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
+#if ENABLE(INSPECTOR)    
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->willLayout();
 #endif
 
@@ -577,7 +601,13 @@ void FrameView::layout(bool allowSubtree)
 
     ScrollbarMode hMode;
     ScrollbarMode vMode;
-    scrollbarModes(hMode, vMode);
+    if (m_canHaveScrollbars) {
+        hMode = ScrollbarAuto;
+        vMode = ScrollbarAuto;
+    } else {
+        hMode = ScrollbarAlwaysOff;
+        vMode = ScrollbarAlwaysOff;
+    }
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -714,7 +744,7 @@ void FrameView::layout(bool allowSubtree)
     }
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didLayout();
 #endif
 
@@ -756,6 +786,11 @@ bool FrameView::useSlowRepaints() const
     return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || m_isOverlapped || !m_contentIsOpaque;
 }
 
+bool FrameView::useSlowRepaintsIfNotOverlapped() const
+{
+    return m_useSlowRepaints || m_slowRepaintObjectCount > 0 || !m_contentIsOpaque;
+}
+
 void FrameView::setUseSlowRepaints()
 {
     m_useSlowRepaints = true;
@@ -939,6 +974,7 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
 
     double delay = adjustedDeferredRepaintDelay();
     if ((m_deferringRepaints || m_deferredRepaintTimer.isActive() || delay) && !immediate) {
+<<<<<<< HEAD:WebCore/page/FrameView.cpp
         IntRect visibleContent = visibleContentRect();
 #ifdef ANDROID_CAPTURE_OFFSCREEN_PAINTS
         IntRect fullVis = visibleContent;
@@ -949,6 +985,12 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             ScrollView::platformOffscreenContentRectangle(fullVis, r);
 #endif
         if (visibleContent.isEmpty())
+=======
+        IntRect paintRect = r;
+        if (!paintsEntireContents())
+            paintRect.intersect(visibleContentRect());
+        if (paintRect.isEmpty())
+>>>>>>> webkit.org at r51976:WebCore/page/FrameView.cpp
             return;
         if (m_repaintCount == cRepaintRectUnionThreshold) {
             IntRect unionedRect;
@@ -958,9 +1000,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(visibleContent);
+            m_repaintRects.append(paintRect);
         else
-            m_repaintRects[0].unite(visibleContent);
+            m_repaintRects[0].unite(paintRect);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -1491,6 +1533,7 @@ void FrameView::valueChanged(Scrollbar* bar)
     ScrollView::valueChanged(bar);
     if (offset != scrollOffset())
         frame()->eventHandler()->sendScrollEvent();
+    frame()->loader()->client()->didChangeScrollOffset();
 }
 
 void FrameView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
@@ -1655,9 +1698,8 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         return;
 
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
-    if (timelineAgent)
-        timelineAgent->willPaint();
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
+        timelineAgent->willPaint(rect);
 #endif
 
     Document* document = frame()->document();
@@ -1670,7 +1712,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = false; // Subframe, don't fill with red.
     else if (isTransparent())
         fillWithRed = false; // Transparent, don't fill with red.
-    else if (m_paintRestriction == PaintRestrictionSelectionOnly || m_paintRestriction == PaintRestrictionSelectionOnlyBlackText)
+    else if (m_paintBehavior & PaintBehaviorSelectionOnly)
         fillWithRed = false; // Selections are transparent, don't fill with red.
     else if (m_nodeToDraw)
         fillWithRed = false; // Element images are transparent, don't fill with red.
@@ -1678,7 +1720,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = true;
     
     if (fillWithRed)
-        p->fillRect(rect, Color(0xFF, 0, 0));
+        p->fillRect(rect, Color(0xFF, 0, 0), DeviceColorSpace);
 #endif
 
     bool isTopLevelPainter = !sCurrentPaintTimeStamp;
@@ -1708,9 +1750,15 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         
     // m_nodeToDraw is used to draw only one element (and its descendants)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
-    if (m_paintRestriction == PaintRestrictionNone)
+
+    PaintBehavior paintBehavior = m_paintBehavior;
+    if (paintBehavior == PaintBehaviorNormal)
         document->invalidateRenderedRectsForMarkersInRect(rect);
-    contentRenderer->layer()->paint(p, rect, m_paintRestriction, eltRenderer);
+
+    if (document->printing())
+        paintBehavior |= PaintBehaviorFlattenCompositingLayers;
+
+    contentRenderer->layer()->paint(p, rect, paintBehavior, eltRenderer);
     
     m_isPainting = false;
     m_lastPaintTime = currentTime();
@@ -1725,14 +1773,14 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         sCurrentPaintTimeStamp = 0;
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
         timelineAgent->didPaint();
 #endif
 }
 
-void FrameView::setPaintRestriction(PaintRestriction pr)
+void FrameView::setPaintBehavior(PaintBehavior behavior)
 {
-    m_paintRestriction = pr;
+    m_paintBehavior = behavior;
 }
     
 bool FrameView::isPainting() const
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 3d17d2c..11f8843 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -72,6 +72,9 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
+    virtual void setCanHaveScrollbars(bool);
+    void updateCanHaveScrollbars();
+
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
     virtual void setContentsSize(const IntSize&);
@@ -167,7 +170,8 @@ public:
     void removeWidgetToUpdate(RenderPartObject*);
 
     virtual void paintContents(GraphicsContext*, const IntRect& damageRect);
-    void setPaintRestriction(PaintRestriction);
+    void setPaintBehavior(PaintBehavior);
+    PaintBehavior paintBehavior() const { return m_paintBehavior; }
     bool isPainting() const;
     void setNodeToDraw(Node*);
 
@@ -206,6 +210,7 @@ private:
 
     friend class RenderWidget;
     bool useSlowRepaints() const;
+    bool useSlowRepaintsIfNotOverlapped() const;
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
 
@@ -257,6 +262,7 @@ private:
 
     bool m_doFullRepaint;
     
+    bool m_canHaveScrollbars;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -307,7 +313,7 @@ private:
     bool m_setNeedsLayoutWasDeferred;
 
     RefPtr<Node> m_nodeToDraw;
-    PaintRestriction m_paintRestriction;
+    PaintBehavior m_paintBehavior;
     bool m_isPainting;
 
     bool m_isVisuallyNonEmpty;
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 604802f..561d19c 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -87,8 +87,13 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // Cache our pointer to the Geolocation object, as this object could be
     // deleted by a call to clearWatch in a callback.
+=======
+    // Cache our pointer to the Geolocation object, as this GeoNotifier object
+    // could be deleted by a call to clearWatch in a callback.
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
     Geolocation* geolocation = m_geolocation;
 
     if (m_fatalError) {
@@ -96,12 +101,15 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
             m_errorCallback->handleEvent(m_fatalError.get());
         // This will cause this notifier to be deleted.
         geolocation->fatalErrorOccurred(this);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         return;
     }
 
     if (m_cachedPosition) {
         m_successCallback->handleEvent(m_cachedPosition.get());
         geolocation->requestReturnedCachedPosition(this);
+=======
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
         return;
     }
 
@@ -112,10 +120,12 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
     geolocation->requestTimedOut(this);
 }
 
-void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> notifier)
+void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> prpNotifier)
 {
-    m_idToNotifierMap.set(id, notifier);
-    m_notifierToIdMap.set(notifier, id);
+    RefPtr<GeoNotifier> notifier = prpNotifier;
+
+    m_idToNotifierMap.set(id, notifier.get());
+    m_notifierToIdMap.set(notifier.release(), id);
 }
 
 void Geolocation::Watchers::remove(int id)
@@ -360,6 +370,7 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
     if (isDenied())
         notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
     else {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         if (haveSuitableCachedPosition(notifier->m_options.get())) {
             ASSERT(m_cachedPositionManager->cachedPosition());
             if (isAllowed())
@@ -374,6 +385,12 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
             else
                 notifier->setFatalError(PositionError::create(PositionError::UNKNOWN_ERROR, "Failed to start Geolocation service"));
         }
+=======
+        if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+            notifier->startTimerIfNeeded();
+        else
+            notifier->setFatalError(PositionError::create(PositionError::POSITION_UNAVAILABLE, "Failed to start Geolocation service"));
+>>>>>>> webkit.org at r51976:WebCore/page/Geolocation.cpp
     }
 
     return notifier.release();
diff --git a/WebCore/page/HaltablePlugin.h b/WebCore/page/HaltablePlugin.h
index a5fe0f4..0f4aa41 100644
--- a/WebCore/page/HaltablePlugin.h
+++ b/WebCore/page/HaltablePlugin.h
@@ -37,6 +37,8 @@ public:
     virtual void halt() = 0;
     virtual void restart() = 0;
     virtual Node* node() const = 0;
+    virtual bool isWindowed() const = 0;
+    virtual String pluginName() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 9a27f1c..ea9819e 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -26,8 +26,12 @@
 #include "config.h"
 #include "History.h"
 
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HistoryItem.h"
+#include "Page.h"
 
 namespace WebCore {
 
@@ -76,4 +80,46 @@ void History::go(int distance)
     m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
+KURL History::urlForState(const String& urlString)
+{
+    KURL baseURL = m_frame->loader()->baseURL();
+    if (urlString.isEmpty())
+        return baseURL;
+        
+    KURL absoluteURL(baseURL, urlString);
+    if (!absoluteURL.isValid())
+        return KURL();
+    
+    if (absoluteURL.string().left(absoluteURL.pathStart()) != baseURL.string().left(baseURL.pathStart()))
+        return KURL();
+    
+    return absoluteURL;
+}
+
+void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const String& title, const String& urlString, StateObjectType stateObjectType, ExceptionCode& ec)
+{
+    if (!m_frame)
+        return;
+    ASSERT(m_frame->page());
+    
+    KURL fullURL = urlForState(urlString);
+    if (!fullURL.isValid()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    if (stateObjectType == StateObjectPush)
+        m_frame->loader()->history()->pushState(data, title, fullURL.string());
+    else if (stateObjectType == StateObjectReplace)
+        m_frame->loader()->history()->replaceState(data, title, fullURL.string());
+            
+    if (!urlString.isEmpty()) {
+        m_frame->document()->updateURLForPushOrReplaceState(fullURL);
+        if (stateObjectType == StateObjectPush)
+            m_frame->loader()->client()->dispatchDidPushStateWithinPage();
+        else if (stateObjectType == StateObjectReplace)
+            m_frame->loader()->client()->dispatchDidReplaceStateWithinPage();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/History.h b/WebCore/page/History.h
index f0df2de..66a6a03 100644
--- a/WebCore/page/History.h
+++ b/WebCore/page/History.h
@@ -26,30 +26,42 @@
 #ifndef History_h
 #define History_h
 
+#include "KURL.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class Frame;
+class Frame;
+class SerializedScriptValue;
+class String;
+typedef int ExceptionCode;
 
-    class History : public RefCounted<History> {
-    public:
-        static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
-        
-        Frame* frame() const;
-        void disconnectFrame();
+class History : public RefCounted<History> {
+public:
+    static PassRefPtr<History> create(Frame* frame) { return adoptRef(new History(frame)); }
+    
+    Frame* frame() const;
+    void disconnectFrame();
 
-        unsigned length() const;
-        void back();
-        void forward();
-        void go(int distance);
+    unsigned length() const;
+    void back();
+    void forward();
+    void go(int distance);
 
-    private:
-        History(Frame*);
-
-        Frame* m_frame;
+    enum StateObjectType {
+        StateObjectPush,
+        StateObjectReplace
     };
+    void stateObjectAdded(PassRefPtr<SerializedScriptValue>, const String& title, const String& url, StateObjectType, ExceptionCode&);
+
+private:
+    History(Frame*);
+
+    KURL urlForState(const String& url);
+
+    Frame* m_frame;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/page/History.idl b/WebCore/page/History.idl
index 914d441..3790552 100644
--- a/WebCore/page/History.idl
+++ b/WebCore/page/History.idl
@@ -39,6 +39,11 @@ module window {
         [DoNotCheckDomainSecurity] void back();
         [DoNotCheckDomainSecurity] void forward();
         [DoNotCheckDomainSecurity] void go(in long distance);
+        
+        [Custom] void pushState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
+        [Custom] void replaceState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
     };
 
 }
diff --git a/WebCore/page/MouseEventWithHitTestResults.h b/WebCore/page/MouseEventWithHitTestResults.h
index 7330d93..8c28574 100644
--- a/WebCore/page/MouseEventWithHitTestResults.h
+++ b/WebCore/page/MouseEventWithHitTestResults.h
@@ -1,4 +1,4 @@
-/* This file is part of the KDE project
+/* 
    Copyright (C) 2000 Simon Hausmann <hausmann@kde.org>
    Copyright (C) 2006 Apple Computer, Inc.
 
diff --git a/WebCore/page/Navigator.cpp b/WebCore/page/Navigator.cpp
index 4922860..a4193fc 100644
--- a/WebCore/page/Navigator.cpp
+++ b/WebCore/page/Navigator.cpp
@@ -24,10 +24,12 @@
 #include "Navigator.h"
 
 #include "CookieJar.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "KURL.h"
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
@@ -169,4 +171,93 @@ void Navigator::getStorageUpdates()
 }
 #endif
 
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the the "%s" token is not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, sizeof(token) / sizeof(token[0]));
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these schemes to be handled by a custom handler.
+    if (equalIgnoringCase(scheme, "http") || equalIgnoringCase(scheme, "https") || equalIgnoringCase(scheme, "file")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
+static bool verifyProtocolHandlerMimeType(const String& type, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these mime types to be assigned to a custom
+    // handler.
+    if (equalIgnoringCase(type, "text/html") || equalIgnoringCase(type, "text/css") || equalIgnoringCase(type, "application/x-javascript")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerMimeType(mimeType, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    if (Page* page = m_frame->page())
+        page->chrome()->registerContentHandler(mimeType, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.h b/WebCore/page/Navigator.h
index 4adebe1..107082b 100644
--- a/WebCore/page/Navigator.h
+++ b/WebCore/page/Navigator.h
@@ -34,6 +34,8 @@ namespace WebCore {
     class PluginArray;
     class String;
 
+    typedef int ExceptionCode;
+
     class Navigator : public NavigatorBase, public RefCounted<Navigator> {
     public:
         static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
@@ -60,6 +62,9 @@ namespace WebCore {
         void getStorageUpdates();
 #endif
 
+        void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec);
+        void registerContentHandler(const String& mimeType, const String& url, const String& title, ExceptionCode& ec);
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/WebCore/page/Navigator.idl b/WebCore/page/Navigator.idl
index 80ef4fb..99b22af 100644
--- a/WebCore/page/Navigator.idl
+++ b/WebCore/page/Navigator.idl
@@ -46,6 +46,11 @@ module window {
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         void getStorageUpdates();
 #endif
+
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DomException);
+        void registerContentHandler(in DOMString mimeType, in DOMString url, in DOMString title)
+            raises(DomException);
     };
 
 }
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index 8a685f4..c4f33d6 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "BackForwardList.h"
 #include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
@@ -277,20 +278,30 @@ void Page::goBackOrForward(int distance)
 
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
-    // Abort any current load if we're going to a history item
+#if !ASSERT_DISABLED
+    // If we're navigating to an item with history state for a Document other than the
+    // current Document, the new Document had better be in the page cache.
+    if (item->stateObject() && item->document() != m_mainFrame->document())
+        ASSERT(item->document()->inPageCache());
+#endif
 
-    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
-    DatabasePolicy databasePolicy = DatabasePolicyStop;
+    // Abort any current load unless we're navigating the current document to a new state object
+    if (!item->stateObject() || item->document() != m_mainFrame->document()) {
+        // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+        DatabasePolicy databasePolicy = DatabasePolicyStop;
 
 #if ENABLE(DATABASE)
-    // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-    const KURL& currentURL = m_mainFrame->loader()->url();
-    const KURL& newURL = item->url();
-
-    if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
-        databasePolicy = DatabasePolicyContinue;
+        // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
+        const KURL& currentURL = m_mainFrame->loader()->url();
+        const KURL& newURL = item->url();
+    
+        if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
+            databasePolicy = DatabasePolicyContinue;
 #endif
-    m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+
+        m_mainFrame->loader()->stopAllLoaders(databasePolicy);
+    }
+        
     m_mainFrame->loader()->history()->goToItem(item, type);
 }
 
@@ -542,7 +553,7 @@ void Page::userStyleSheetLocationChanged()
 
         Vector<char> styleSheetAsUTF8;
         if (base64Decode(encodedData, styleSheetAsUTF8))
-            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data(), styleSheetAsUTF8.size());
     }
     
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index 427c240..558c5cb 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -200,29 +200,29 @@ StorageNamespace* PageGroup::localStorage()
 }
 #endif
 
-void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
                                      PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, injectionTime));
     if (!m_userScripts)
         m_userScripts.set(new UserScriptMap);
-    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(world, 0).first->second;
     if (!scriptsInWorld)
         scriptsInWorld = new UserScriptVector;
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+void PageGroup::addUserStyleSheetToWorld(DOMWrapperWorld* world, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
                                          PassOwnPtr<Vector<String> > blacklist)
 {
-    if (worldID == UINT_MAX)
-        return;
-    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
+    ASSERT_ARG(world, world);
+
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist));
     if (!m_userStyleSheets)
         m_userStyleSheets.set(new UserStyleSheetMap);
-    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(world, 0).first->second;
     if (!styleSheetsInWorld)
         styleSheetsInWorld = new UserStyleSheetVector;
     styleSheetsInWorld->append(userStyleSheet.release());
@@ -235,12 +235,14 @@ void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source,
     }
 }
 
-void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserScriptFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
     
@@ -257,12 +259,14 @@ void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+void PageGroup::removeUserStyleSheetFromWorld(DOMWrapperWorld* world, const KURL& url)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
 
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     bool sheetsChanged = false;
     if (it == m_userStyleSheets->end())
         return;
@@ -291,12 +295,14 @@ void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
     }
 }
 
-void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
+void PageGroup::removeUserScriptsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userScripts)
         return;
 
-    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    UserScriptMap::iterator it = m_userScripts->find(world);
     if (it == m_userScripts->end())
         return;
        
@@ -304,12 +310,14 @@ void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
     m_userScripts->remove(it);
 }
 
-void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+void PageGroup::removeUserStyleSheetsFromWorld(DOMWrapperWorld* world)
 {
+    ASSERT_ARG(world, world);
+
     if (!m_userStyleSheets)
         return;
     
-    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(world);
     if (it == m_userStyleSheets->end())
         return;
     
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index c233cd1..446f0c7 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -70,17 +70,17 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+        void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&, 
                                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                   UserScriptInjectionTime);
-        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+        void addUserStyleSheetToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void removeUserScriptFromWorld(unsigned, const KURL&);
-        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
+        void removeUserScriptFromWorld(DOMWrapperWorld*, const KURL&);
+        void removeUserStyleSheetFromWorld(DOMWrapperWorld*, const KURL&);
         
-        void removeUserScriptsFromWorld(unsigned);
-        void removeUserStyleSheetsFromWorld(unsigned);
+        void removeUserScriptsFromWorld(DOMWrapperWorld*);
+        void removeUserStyleSheetsFromWorld(DOMWrapperWorld*);
     
         void removeAllUserContent();
         
diff --git a/WebCore/page/PluginHalter.cpp b/WebCore/page/PluginHalter.cpp
index 63f5469..c0a6452 100644
--- a/WebCore/page/PluginHalter.cpp
+++ b/WebCore/page/PluginHalter.cpp
@@ -28,6 +28,7 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
+#include "PlatformString.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -93,7 +94,7 @@ void PluginHalter::timerFired(Timer<PluginHalter>*)
             continue;
         }
 
-        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+        if (m_client->shouldHaltPlugin(plugins[i]->node(), plugins[i]->isWindowed(), plugins[i]->pluginName()))
             plugins[i]->halt();
 
         m_plugins.remove(plugins[i]);
diff --git a/WebCore/page/PluginHalter.h b/WebCore/page/PluginHalter.h
index eddce34..af8b31e 100644
--- a/WebCore/page/PluginHalter.h
+++ b/WebCore/page/PluginHalter.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class HaltablePlugin;
 
-class PluginHalter {
+class PluginHalter : public Noncopyable {
 public:
     PluginHalter(PluginHalterClient*);
 
diff --git a/WebCore/page/PluginHalterClient.h b/WebCore/page/PluginHalterClient.h
index f77091f..0251547 100644
--- a/WebCore/page/PluginHalterClient.h
+++ b/WebCore/page/PluginHalterClient.h
@@ -29,12 +29,13 @@
 namespace WebCore {
 
 class Node;
+class String;
 
 class PluginHalterClient {
 public:
     virtual ~PluginHalterClient() { }
 
-    virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool shouldHaltPlugin(Node*, bool isWindowed, const String& pluginName) const = 0;
     virtual bool enabled() const = 0;
 };
 
diff --git a/WebCore/page/PositionError.h b/WebCore/page/PositionError.h
index f6f56f0..1467170 100644
--- a/WebCore/page/PositionError.h
+++ b/WebCore/page/PositionError.h
@@ -35,7 +35,6 @@ namespace WebCore {
 class PositionError : public RefCounted<PositionError> {
 public:
     enum ErrorCode {
-        UNKNOWN_ERROR = 0,
         PERMISSION_DENIED = 1,
         POSITION_UNAVAILABLE = 2,
         TIMEOUT = 3
diff --git a/WebCore/page/PositionError.idl b/WebCore/page/PositionError.idl
index cb2ef5e..91027df 100644
--- a/WebCore/page/PositionError.idl
+++ b/WebCore/page/PositionError.idl
@@ -31,7 +31,6 @@ module core {
         readonly attribute unsigned short code;
         readonly attribute DOMString message;
 
-        const unsigned short UNKNOWN_ERROR = 0;
         const unsigned short PERMISSION_DENIED = 1;
         const unsigned short POSITION_UNAVAILABLE = 2;
         const unsigned short TIMEOUT = 3;
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index bba678a..4d3a839 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -25,7 +25,6 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
-#include "Settings.h"
 
 using namespace WebCore;
 
@@ -96,23 +95,18 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
 void PrintContext::begin(float width)
 {
-    float PrintingMinimumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMinimumShrinkFactor() : 0.0f;
-    float PrintingMaximumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMaximumShrinkFactor() : 0.0f;
-
-    if (PrintingMaximumShrinkFactor < PrintingMinimumShrinkFactor || PrintingMinimumShrinkFactor <= 0.0f) {
-        // By imaging to a width a little wider than the available pixels,
-        // thin pages will be scaled down a little, matching the way they
-        // print in IE and Camino. This lets them use fewer sheets than they
-        // would otherwise, which is presumably why other browsers do this.
-        // Wide pages will be scaled down more than this.
-        PrintingMinimumShrinkFactor = 1.25f;
-
-        // This number determines how small we are willing to reduce the page content
-        // in order to accommodate the widest line. If the page would have to be
-        // reduced smaller to make the widest line fit, we just clip instead (this
-        // behavior matches MacIE and Mozilla, at least)
-        PrintingMaximumShrinkFactor = 2.0f;
-    }
+    // By imaging to a width a little wider than the available pixels,
+    // thin pages will be scaled down a little, matching the way they
+    // print in IE and Camino. This lets them use fewer sheets than they
+    // would otherwise, which is presumably why other browsers do this.
+    // Wide pages will be scaled down more than this.
+    const float PrintingMinimumShrinkFactor = 1.25f;
+
+    // This number determines how small we are willing to reduce the page content
+    // in order to accommodate the widest line. If the page would have to be
+    // reduced smaller to make the widest line fit, we just clip instead (this
+    // behavior matches MacIE and Mozilla, at least)
+    const float PrintingMaximumShrinkFactor = 2.0f;
 
     float minLayoutWidth = width * PrintingMinimumShrinkFactor;
     float maxLayoutWidth = width * PrintingMaximumShrinkFactor;
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 338bf9f..f53dbf1 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -75,26 +75,11 @@ static URLSchemesMap& noAccessSchemes()
     return noAccessSchemes;
 }
 
-bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
-{
-    if (protocol.isEmpty())
-        return false;
-
-    typedef HashMap<String, unsigned> DefaultPortsMap;
-    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
-    if (defaultPorts.isEmpty()) {
-        defaultPorts.set("http", 80);
-        defaultPorts.set("https", 443);
-        defaultPorts.set("ftp", 21);
-        defaultPorts.set("ftps", 990);
-    }
-    return defaultPorts.get(protocol) == port;
-}
-
 SecurityOrigin::SecurityOrigin(const KURL& url)
     : m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
     , m_host(url.host().isNull() ? "" : url.host().lower())
     , m_port(url.port())
+    , m_sandboxFlags(SandboxNone)
     , m_noAccess(false)
     , m_universalAccess(false)
     , m_domainWasSetInDOM(false)
@@ -112,6 +97,11 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 
     // By default, only local SecurityOrigins can load local resources.
     m_canLoadLocalResources = isLocal();
+    if (m_canLoadLocalResources) {
+        // Directories should never be readable.
+        if (!url.hasPath() || url.path().endsWith("/"))
+            m_noAccess = true;
+    }
 
     if (isDefaultPortForProtocol(m_port, m_protocol))
         m_port = 0;
@@ -122,6 +112,7 @@ SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
     , m_host(other->m_host.threadsafeCopy())
     , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
+    , m_sandboxFlags(other->m_sandboxFlags)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
     , m_domainWasSetInDOM(other->m_domainWasSetInDOM)
@@ -162,7 +153,7 @@ bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess || other->m_noAccess)
+    if (m_noAccess || other->m_noAccess || isSandboxed(SandboxOrigin) || other->isSandboxed(SandboxOrigin))
         return false;
 
     // Here are two cases where we should permit access:
@@ -203,10 +194,12 @@ bool SecurityOrigin::canRequest(const KURL& url) const
     if (m_universalAccess)
         return true;
 
-    if (m_noAccess)
+    if (m_noAccess || isSandboxed(SandboxOrigin))
         return false;
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
+    if (targetOrigin->m_noAccess)
+        return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
@@ -289,7 +282,7 @@ String SecurityOrigin::toString() const
     if (isEmpty())
         return "null";
 
-    if (m_noAccess)
+    if (m_noAccess || isSandboxed(SandboxOrigin))
         return "null";
 
     if (m_protocol == "file")
@@ -399,14 +392,10 @@ void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
     if (scheme == "applewebdata")
         return;
 #endif
-#if PLATFORM(QT)
-    if (scheme == "qrc")
-        return;
-#endif
     localSchemes().remove(scheme);
 }
 
-const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+const URLSchemesMap& SecurityOrigin::localURLSchemes()
 {
     return localSchemes();
 }
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index 6d4ce1f..af83f02 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -34,6 +34,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "StringHash.h"
 
@@ -110,6 +111,13 @@ namespace WebCore {
         // WARNING: This is an extremely powerful ability.  Use with caution!
         void grantUniversalAccess();
 
+        // Sandboxing status as determined by the frame.
+        void setSandboxFlags(SandboxFlags flags) { m_sandboxFlags = flags; }
+        bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
+
+        bool canAccessDatabase() const { return !isSandboxed(SandboxOrigin); }
+        bool canAccessStorage() const { return !isSandboxed(SandboxOrigin); }
+
         bool isSecureTransitionTo(const KURL&) const;
 
         // The local SecurityOrigin is the most privileged SecurityOrigin.
@@ -123,8 +131,14 @@ namespace WebCore {
         // Convert this SecurityOrigin into a string.  The string
         // representation of a SecurityOrigin is similar to a URL, except it
         // lacks a path component.  The string representation does not encode
-        // the value of the SecurityOrigin's domain property.  The empty
-        // SecurityOrigin is represented with the string "null".
+        // the value of the SecurityOrigin's domain property.
+        //
+        // When using the string value, it's important to remember that it
+        // might be "null".  This happens when this SecurityOrigin has
+        // noAccess to other SecurityOrigins.  For example, this SecurityOrigin
+        // might have come from a data URL, the SecurityOrigin might be empty,
+        // or we might have explicitly decided that we
+        // shouldTreatURLSchemeAsNoAccess.
         String toString() const;
 
         // Serialize the security origin to a string that could be used as part of
@@ -165,8 +179,6 @@ namespace WebCore {
         static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
         static void resetOriginAccessWhiteLists();
 
-        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
-
     private:
         explicit SecurityOrigin(const KURL&);
         explicit SecurityOrigin(const SecurityOrigin*);
@@ -175,6 +187,7 @@ namespace WebCore {
         String m_host;
         String m_domain;
         unsigned short m_port;
+        SandboxFlags m_sandboxFlags;
         bool m_noAccess;
         bool m_universalAccess;
         bool m_domainWasSetInDOM;
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 3964d74..b250e4d 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -75,8 +75,6 @@ Settings::Settings(Page* page)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
-    , m_printingMinimumShrinkFactor(0.0f)
-    , m_printingMaximumShrinkFactor(0.0f)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -84,7 +82,6 @@ Settings::Settings(Page* page)
     , m_arePluginsEnabled(false)
     , m_databasesEnabled(false)
     , m_localStorageEnabled(false)
-    , m_sessionStorageEnabled(true)
     , m_isJavaScriptEnabled(false)
     , m_isWebSecurityEnabled(true)
     , m_allowUniversalAccessFromFileURLs(true)
@@ -130,8 +127,11 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_experimentalNotificationsEnabled(false)
     , m_webGLEnabled(false)
+    , m_geolocationEnabled(true)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -278,11 +278,6 @@ void Settings::setLocalStorageEnabled(bool localStorageEnabled)
     m_localStorageEnabled = localStorageEnabled;
 }
 
-void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
-{
-    m_sessionStorageEnabled = sessionStorageEnabled;
-}
-
 void Settings::setLocalStorageQuota(unsigned localStorageQuota)
 {
     m_localStorageQuota = localStorageQuota;
@@ -703,6 +698,24 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setShowDebugBorders(bool enabled)
+{
+    if (m_showDebugBorders == enabled)
+        return;
+        
+    m_showDebugBorders = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
+void Settings::setShowRepaintCounter(bool enabled)
+{
+    if (m_showRepaintCounter == enabled)
+        return;
+        
+    m_showRepaintCounter = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
 void Settings::setExperimentalNotificationsEnabled(bool enabled)
 {
     m_experimentalNotificationsEnabled = enabled;
@@ -726,14 +739,9 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
-void Settings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
-{
-    m_printingMinimumShrinkFactor = printingMinimumShrinkFactor;
-}    
-
-void Settings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+void Settings::setGeolocationEnabled(bool enabled)
 {
-    m_printingMaximumShrinkFactor = printingMaximumShrinkFactor;
-}    
+    m_geolocationEnabled = enabled;
+}
 
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index de1030d..fbb70b0 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -64,7 +64,7 @@ namespace WebCore {
     // if possible in the future.
     enum EditingBehavior { EditingMacBehavior, EditingWindowsBehavior };
 
-    class Settings {
+    class Settings : public Noncopyable {
     public:
         Settings(Page*);
 
@@ -148,9 +148,6 @@ namespace WebCore {
         void setLocalStorageEnabled(bool);
         bool localStorageEnabled() const { return m_localStorageEnabled; }
 
-        void setSessionStorageEnabled(bool);
-        bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
-
         void setLocalStorageQuota(unsigned);
         unsigned localStorageQuota() const { return m_localStorageQuota; }
 
@@ -317,6 +314,12 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setShowDebugBorders(bool);
+        bool showDebugBorders() const { return m_showDebugBorders; }
+
+        void setShowRepaintCounter(bool);
+        bool showRepaintCounter() const { return m_showRepaintCounter; }
+
         void setExperimentalNotificationsEnabled(bool);
         bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
 
@@ -331,11 +334,8 @@ namespace WebCore {
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
-        void setPrintingMinimumShrinkFactor(float);
-        float printingMinimumShrinkFactor() const { return m_printingMinimumShrinkFactor; }
-
-        void setPrintingMaximumShrinkFactor(float);
-        float printingMaximumShrinkFactor() const { return m_printingMaximumShrinkFactor; }
+        void setGeolocationEnabled(bool);
+        bool geolocationEnabled() const { return m_geolocationEnabled; }
 
     private:
         Page* m_page;
@@ -396,8 +396,6 @@ namespace WebCore {
         size_t m_maximumDecodedImageSize;
         unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
-        float m_printingMinimumShrinkFactor;
-        float m_printingMaximumShrinkFactor;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -405,7 +403,6 @@ namespace WebCore {
         bool m_arePluginsEnabled : 1;
         bool m_databasesEnabled : 1;
         bool m_localStorageEnabled : 1;
-        bool m_sessionStorageEnabled : 1;
         bool m_isJavaScriptEnabled : 1;
         bool m_isWebSecurityEnabled : 1;
         bool m_allowUniversalAccessFromFileURLs: 1;
@@ -442,8 +439,11 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_showDebugBorders : 1;
+        bool m_showRepaintCounter : 1;
         bool m_experimentalNotificationsEnabled : 1;
         bool m_webGLEnabled : 1;
+        bool m_geolocationEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/WebCore/page/UserScript.h b/WebCore/page/UserScript.h
index dbbb879..8b3703f 100644
--- a/WebCore/page/UserScript.h
+++ b/WebCore/page/UserScript.h
@@ -34,16 +34,15 @@
 
 namespace WebCore {
 
-class UserScript {
+class UserScript : public Noncopyable {
 public:
     UserScript(const String& source, const KURL& url,
                PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-               unsigned worldID, UserScriptInjectionTime injectionTime)
+               UserScriptInjectionTime injectionTime)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
         , m_injectionTime(injectionTime)
     {
     }
@@ -52,7 +51,6 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
     UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
     
 private:
@@ -60,7 +58,6 @@ private:
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
     UserScriptInjectionTime m_injectionTime;
 };
 
diff --git a/WebCore/page/UserScriptTypes.h b/WebCore/page/UserScriptTypes.h
index ac37662..ad27e79 100644
--- a/WebCore/page/UserScriptTypes.h
+++ b/WebCore/page/UserScriptTypes.h
@@ -33,10 +33,11 @@ namespace WebCore {
 
 enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
 
+class DOMWrapperWorld;
 class UserScript;
 
 typedef Vector<OwnPtr<UserScript> > UserScriptVector;
-typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserScriptVector*> UserScriptMap;
 
 } // namespace WebCore
  
diff --git a/WebCore/page/UserStyleSheet.h b/WebCore/page/UserStyleSheet.h
index 56bec40..610778f 100644
--- a/WebCore/page/UserStyleSheet.h
+++ b/WebCore/page/UserStyleSheet.h
@@ -34,16 +34,14 @@
 
 namespace WebCore {
 
-class UserStyleSheet {
+class UserStyleSheet : public Noncopyable {
 public:
     UserStyleSheet(const String& source, const KURL& url,
-                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                   unsigned worldID)
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist)
         : m_source(source)
         , m_url(url)
         , m_whitelist(whitelist)
         , m_blacklist(blacklist)
-        , m_worldID(worldID)
     {
     }
 
@@ -51,14 +49,12 @@ public:
     const KURL& url() const { return m_url; }
     const Vector<String>* whitelist() const { return m_whitelist.get(); }
     const Vector<String>* blacklist() const { return m_blacklist.get(); }
-    unsigned worldID() const { return m_worldID; }
 
 private:
     String m_source;
     KURL m_url;
     OwnPtr<Vector<String> > m_whitelist;
     OwnPtr<Vector<String> > m_blacklist;
-    unsigned m_worldID;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/UserStyleSheetTypes.h b/WebCore/page/UserStyleSheetTypes.h
index 094b2cf..ef662f2 100644
--- a/WebCore/page/UserStyleSheetTypes.h
+++ b/WebCore/page/UserStyleSheetTypes.h
@@ -31,10 +31,11 @@
 
 namespace WebCore {
 
+class DOMWrapperWorld;
 class UserStyleSheet;
 
 typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
-typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+typedef HashMap<RefPtr<DOMWrapperWorld>, UserStyleSheetVector*> UserStyleSheetMap;
 
 } // namespace WebCore
  
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 890c3fa..72c2591 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -144,14 +144,7 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
-    // If the script is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // script. If the script has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL scriptURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+    if (isSameOriginResource(url))
         return true;
 
     if (findInRequest(context + url)) {
@@ -167,8 +160,11 @@ bool XSSAuditor::canLoadObject(const String& url) const
     if (!isEnabled())
         return true;
 
+    if (isSameOriginResource(url))
+        return true;
+
     if (findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+        String consoleMessage = String::format("Refused to load an object. URL found within request: \"%s\".\n", url.utf8().data());
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -179,10 +175,12 @@ bool XSSAuditor::canSetBaseElementURL(const String& url) const
 {
     if (!isEnabled())
         return true;
-    
-    KURL baseElementURL(m_frame->document()->url(), url);
-    if (m_frame->document()->url().host() != baseElementURL.host() && findInRequest(url)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+
+    if (isSameOriginResource(url))
+        return true;
+
+    if (findInRequest(url)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -255,6 +253,18 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
+bool XSSAuditor::isSameOriginResource(const String& url) const
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_frame->document()->url(), url);
+    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
+}
+
 bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
                                bool decodeURLEscapeSequencesTwice) const
 {
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index adfa5c7..b64665b 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -42,14 +42,14 @@ namespace WebCore {
     // a script is to be allowed or denied based on the content of any
     // user-submitted data, including:
     //
-    // * the query string of the URL.
+    // * the URL.
     // * the HTTP-POST data.
     //
     // If the source code of a script resembles any user-submitted data then it
     // is denied execution.
     //
-    // When you instantiate the XSSAuditor you must specify the {@link Frame}
-    // of the page that you wish to audit.
+    // When you instantiate the XSSAuditor you must specify the Frame of the
+    // page that you wish to audit.
     //
     // Bindings
     //
@@ -59,11 +59,14 @@ namespace WebCore {
     // JavaScript script is safe to execute before executing it. The following
     // methods call into XSSAuditor:
     //
-    // * ScriptController::evaluate - used to evaluate JavaScript scripts.
-    // * ScriptController::createInlineEventListener - used to create JavaScript event handlers.
-    // * HTMLTokenizer::scriptHandler - used to load external JavaScript scripts.
+    // * ScriptController::evaluateInWorld - used to evaluate JavaScript scripts.
+    // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
+    // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
+    // * HTMLBaseElement::process - used to set the document base URL.
+    // * HTMLTokenizer::parseTag - used to load external JavaScript scripts.
+    // * FrameLoader::requestObject - used to load <object>/<embed> elements.
     //
-    class XSSAuditor {
+    class XSSAuditor : public Noncopyable {
     public:
         XSSAuditor(Frame*);
         ~XSSAuditor();
@@ -122,6 +125,7 @@ namespace WebCore {
                                 bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
+        bool isSameOriginResource(const String& url) const;
         bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
                            bool decodeURLEscapeSequencesTwice = false) const;
         bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index 59797da..f1ee750 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -190,7 +190,7 @@ class PropertyWrapperBase;
 static void addShorthandProperties();
 static PropertyWrapperBase* wrapperForProperty(int propertyID);
 
-class PropertyWrapperBase {
+class PropertyWrapperBase : public Noncopyable {
 public:
     PropertyWrapperBase(int prop)
         : m_prop(prop)
diff --git a/WebCore/page/animation/KeyframeAnimation.cpp b/WebCore/page/animation/KeyframeAnimation.cpp
index 7e37e5f..500bf6f 100644
--- a/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/WebCore/page/animation/KeyframeAnimation.cpp
@@ -36,6 +36,7 @@
 #include "EventNames.h"
 #include "RenderLayer.h"
 #include "RenderLayerBacking.h"
+#include "RenderStyle.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
diff --git a/WebCore/page/animation/KeyframeAnimation.h b/WebCore/page/animation/KeyframeAnimation.h
index 4905fc3..e3b8f53 100644
--- a/WebCore/page/animation/KeyframeAnimation.h
+++ b/WebCore/page/animation/KeyframeAnimation.h
@@ -32,10 +32,11 @@
 #include "AnimationBase.h"
 #include "Document.h"
 #include "KeyframeList.h"
-#include "RenderStyle.h"
 
 namespace WebCore {
 
+class RenderStyle;
+
 // A KeyframeAnimation tracks the state of an explicit animation
 // for a single RenderObject.
 class KeyframeAnimation : public AnimationBase {
diff --git a/WebCore/page/chromium/EventHandlerChromium.cpp b/WebCore/page/chromium/EventHandlerChromium.cpp
index 467f94e..ac76a29 100644
--- a/WebCore/page/chromium/EventHandlerChromium.cpp
+++ b/WebCore/page/chromium/EventHandlerChromium.cpp
@@ -154,4 +154,14 @@ unsigned EventHandler::accessKeyModifiers()
 #endif
 }
 
+#if PLATFORM(LINUX)
+// GTK+ must scroll horizontally if the mouse pointer is on top of the
+// horizontal scrollbar while scrolling with the wheel.
+// This code comes from gtk/EventHandlerGtk.cpp.
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult& result) const
+{
+    return result.scrollbar() && result.scrollbar()->orientation() == HorizontalScrollbar;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/mac/ChromeMac.mm b/WebCore/page/mac/ChromeMac.mm
index aba3449..14c07de 100644
--- a/WebCore/page/mac/ChromeMac.mm
+++ b/WebCore/page/mac/ChromeMac.mm
@@ -25,6 +25,8 @@
 
 namespace WebCore {
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 void Chrome::focusNSView(NSView* view)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -48,4 +50,6 @@ void Chrome::focusNSView(NSView* view)
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/mac/DragControllerMac.mm b/WebCore/page/mac/DragControllerMac.mm
index 8a04809..adf89fa 100644
--- a/WebCore/page/mac/DragControllerMac.mm
+++ b/WebCore/page/mac/DragControllerMac.mm
@@ -42,6 +42,15 @@ const int DragController::DragIconBottomInset = 3;
 
 const float DragController::DragImageAlpha = 0.75f;
 
+#if ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+DragOperation DragController::dragOperation(DragData*)
+{
+    return DragOperationNone;
+} 
+
+#else
+
 bool DragController::isCopyKeyDown()
 {
     return [[NSApp currentEvent] modifierFlags] & NSAlternateKeyMask;
@@ -58,7 +67,9 @@ DragOperation DragController::dragOperation(DragData* dragData)
         return DragOperationCopy;
 
     return DragOperationNone;
-} 
+}
+
+#endif
 
 const IntSize& DragController::maxDragImageSize()
 {
diff --git a/WebCore/page/mac/EventHandlerMac.mm b/WebCore/page/mac/EventHandlerMac.mm
index 7da1d36..92895d9 100644
--- a/WebCore/page/mac/EventHandlerMac.mm
+++ b/WebCore/page/mac/EventHandlerMac.mm
@@ -64,6 +64,8 @@ namespace WebCore {
 const double EventHandler::TextDragDelay = 0.15;
 #endif
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 static RetainPtr<NSEvent>& currentNSEventSlot()
 {
     DEFINE_STATIC_LOCAL(RetainPtr<NSEvent>, event, ());
@@ -136,65 +138,6 @@ PassRefPtr<KeyboardEvent> EventHandler::currentKeyboardEvent() const
     }
 }
 
-static inline bool isKeyboardOptionTab(KeyboardEvent* event)
-{
-    return event
-        && (event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent)
-        && event->altKey()
-        && event->keyIdentifier() == "U+0009";    
-}
-
-bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent* event) const
-{
-    return isKeyboardOptionTab(event);
-}
-
-bool EventHandler::tabsToAllControls(KeyboardEvent* event) const
-{
-    Page* page = m_frame->page();
-    if (!page)
-        return false;
-
-    KeyboardUIMode keyboardUIMode = page->chrome()->client()->keyboardUIMode();
-    bool handlingOptionTab = isKeyboardOptionTab(event);
-
-    // If tab-to-links is off, option-tab always highlights all controls
-    if ((keyboardUIMode & KeyboardAccessTabsToLinks) == 0 && handlingOptionTab)
-        return true;
-    
-    // If system preferences say to include all controls, we always include all controls
-    if (keyboardUIMode & KeyboardAccessFull)
-        return true;
-    
-    // Otherwise tab-to-links includes all controls, unless the sense is flipped via option-tab.
-    if (keyboardUIMode & KeyboardAccessTabsToLinks)
-        return !handlingOptionTab;
-    
-    return handlingOptionTab;
-}
-
-bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
-{
-    Document* document = m_frame->document();
-
-    // RSS view needs arrow key keypress events.
-    if (applicationIsSafari() && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
-        return true;
-    Settings* settings = m_frame->settings();
-    if (!settings)
-        return false;
-
-#if ENABLE(DASHBOARD_SUPPORT)
-    if (settings->usesDashboardBackwardCompatibilityMode())
-        return true;
-#endif
-        
-    if (settings->needsKeyboardEventDisambiguationQuirks())
-        return true;
-
-    return false;
-}
-
 bool EventHandler::keyEvent(NSEvent *event)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -369,11 +312,6 @@ NSView *EventHandler::mouseDownViewIfStillGood()
     return mouseDownView;
 }
 
-bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
-{
-    return m_activationEventNumber == event.eventNumber();
-}
-
 #if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
@@ -393,15 +331,6 @@ bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResult
     
     return true;
 }
-    
-PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const 
-{
-    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
-    // Must be done before ondragstart adds types and data to the pboard,
-    // also done for security, as it erases data from the last drag
-    [pasteboard declareTypes:[NSArray array] owner:nil];
-    return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
-}
 #endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
@@ -697,17 +626,6 @@ bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults&
     return passSubframeEventToSubframe(mev, subframe);
 }
 
-unsigned EventHandler::accessKeyModifiers()
-{
-    // Control+Option key combinations are usually unused on Mac OS X, but not when VoiceOver is enabled.
-    // So, we use Control in this case, even though it conflicts with Emacs-style key bindings.
-    // See <https://bugs.webkit.org/show_bug.cgi?id=21107> for more detail.
-    if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
-        return PlatformKeyboardEvent::CtrlKey;
-
-    return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
-}
-
 PlatformMouseEvent EventHandler::currentPlatformMouseEvent() const
 {
     NSView *windowView = nil;
@@ -736,4 +654,144 @@ bool EventHandler::eventMayStartDrag(NSEvent *event)
 }
 #endif // ENABLE(DRAG_SUPPORT)
 
+bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
+{
+    return m_activationEventNumber == event.eventNumber();
+}
+
+#else // ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    subframe->eventHandler()->handleMousePressEvent(mev.event());
+    return true;
+}
+
+bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe, HitTestResult* hoveredNode)
+{
+    if (m_mouseDownMayStartDrag && !m_mouseDownWasInSubframe)
+        return false;
+    subframe->eventHandler()->handleMouseMoveEvent(mev.event(), hoveredNode);
+    return true;
+}
+
+bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
+{
+    subframe->eventHandler()->handleMouseReleaseEvent(mev.event());
+    return true;
+}
+
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& wheelEvent, Widget* widget)
+{
+    if (!widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(wheelEvent);
+}
+
+void EventHandler::focusDocumentView()
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    page->focusController()->setFocusedFrame(m_frame);
+}
+
+bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults&)
+{
+    notImplemented();
+    return false;
+}
+
+bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
+{
+    notImplemented();
+    return false;
+}
+
+#endif
+
+#if ENABLE(DRAG_SUPPORT)
+
+PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
+{
+    NSPasteboard *pasteboard = [NSPasteboard pasteboardWithName:NSDragPboard];
+    // Must be done before ondragstart adds types and data to the pboard,
+    // also done for security, as it erases data from the last drag
+    [pasteboard declareTypes:[NSArray array] owner:nil];
+    return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
+}
+
+#endif
+
+static inline bool isKeyboardOptionTab(KeyboardEvent* event)
+{
+    return event
+        && (event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent)
+        && event->altKey()
+        && event->keyIdentifier() == "U+0009";    
+}
+
+bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent* event) const
+{
+    return isKeyboardOptionTab(event);
+}
+
+bool EventHandler::tabsToAllControls(KeyboardEvent* event) const
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    KeyboardUIMode keyboardUIMode = page->chrome()->client()->keyboardUIMode();
+    bool handlingOptionTab = isKeyboardOptionTab(event);
+
+    // If tab-to-links is off, option-tab always highlights all controls
+    if ((keyboardUIMode & KeyboardAccessTabsToLinks) == 0 && handlingOptionTab)
+        return true;
+    
+    // If system preferences say to include all controls, we always include all controls
+    if (keyboardUIMode & KeyboardAccessFull)
+        return true;
+    
+    // Otherwise tab-to-links includes all controls, unless the sense is flipped via option-tab.
+    if (keyboardUIMode & KeyboardAccessTabsToLinks)
+        return !handlingOptionTab;
+    
+    return handlingOptionTab;
+}
+
+bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
+{
+    Document* document = m_frame->document();
+
+    // RSS view needs arrow key keypress events.
+    if (applicationIsSafari() && document->url().protocolIs("feed") || document->url().protocolIs("feeds"))
+        return true;
+    Settings* settings = m_frame->settings();
+    if (!settings)
+        return false;
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    if (settings->usesDashboardBackwardCompatibilityMode())
+        return true;
+#endif
+        
+    if (settings->needsKeyboardEventDisambiguationQuirks())
+        return true;
+
+    return false;
+}
+
+unsigned EventHandler::accessKeyModifiers()
+{
+    // Control+Option key combinations are usually unused on Mac OS X, but not when VoiceOver is enabled.
+    // So, we use Control in this case, even though it conflicts with Emacs-style key bindings.
+    // See <https://bugs.webkit.org/show_bug.cgi?id=21107> for more detail.
+    if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
+        return PlatformKeyboardEvent::CtrlKey;
+
+    return PlatformKeyboardEvent::CtrlKey | PlatformKeyboardEvent::AltKey;
+}
+
 }
diff --git a/WebCore/page/mac/FrameMac.mm b/WebCore/page/mac/FrameMac.mm
index d9faa8b..fce5704 100644
--- a/WebCore/page/mac/FrameMac.mm
+++ b/WebCore/page/mac/FrameMac.mm
@@ -271,7 +271,9 @@ NSImage* Frame::imageFromRect(NSRect rect) const
     if (![view respondsToSelector:@selector(drawSingleRect:)])
         return nil;
     
-    NSImage* resultImage;
+    PaintBehavior oldPaintBehavior = m_view->paintBehavior();
+    m_view->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     
     NSRect bounds = [view bounds];
@@ -282,7 +284,7 @@ NSImage* Frame::imageFromRect(NSRect rect) const
     rect.size.width = roundf(rect.size.width);
     rect = [view convertRect:rect fromView:nil];
     
-    resultImage = [[[NSImage alloc] initWithSize:rect.size] autorelease];
+    NSImage* resultImage = [[[NSImage alloc] initWithSize:rect.size] autorelease];
 
     if (rect.size.width != 0 && rect.size.height != 0) {
         [resultImage setFlipped:YES];
@@ -301,19 +303,21 @@ NSImage* Frame::imageFromRect(NSRect rect) const
         [resultImage setFlipped:NO];
     }
 
+    m_view->setPaintBehavior(oldPaintBehavior);
     return resultImage;
 
     END_BLOCK_OBJC_EXCEPTIONS;
     
+    m_view->setPaintBehavior(oldPaintBehavior);
     return nil;
 }
 
 NSImage* Frame::selectionImage(bool forceBlackText) const
 {
-    m_view->setPaintRestriction(forceBlackText ? PaintRestrictionSelectionOnlyBlackText : PaintRestrictionSelectionOnly);
+    m_view->setPaintBehavior(PaintBehaviorSelectionOnly | (forceBlackText ? PaintBehaviorForceBlackText : 0));
     m_doc->updateLayout();
     NSImage* result = imageFromRect(selectionBounds());
-    m_view->setPaintRestriction(PaintRestrictionNone);
+    m_view->setPaintBehavior(PaintBehaviorNormal);
     return result;
 }
 
@@ -459,33 +463,6 @@ NSWritingDirection Frame::baseWritingDirectionForSelectionStart() const
     return result;
 }
 
-const short enableRomanKeyboardsOnly = -23;
-void Frame::setUseSecureKeyboardEntry(bool enable)
-{
-    if (enable == IsSecureEventInputEnabled())
-        return;
-    if (enable) {
-        EnableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-        KeyScript(enableRomanKeyboardsOnly);
-#else
-        // WebKit substitutes nil for input context when in password field, which corresponds to null TSMDocument. So, there is
-        // no need to call TSMGetActiveDocument(), which may return an incorrect result when selection hasn't been yet updated
-        // after focusing a node.
-        CFArrayRef inputSources = TISCreateASCIICapableInputSourceList();
-        TSMSetDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag, sizeof(CFArrayRef), &inputSources);
-        CFRelease(inputSources);
-#endif
-    } else {
-        DisableSecureEventInput();
-#ifdef BUILDING_ON_TIGER
-        KeyScript(smKeyEnableKybds);
-#else
-        TSMRemoveDocumentProperty(0, kTSMDocumentEnabledInputSourcesPropertyTag);
-#endif
-    }
-}
-
 #if ENABLE(DASHBOARD_SUPPORT)
 NSMutableDictionary* Frame::dashboardRegionsDictionary()
 {
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index 249d696..43f3f0a 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -150,6 +150,13 @@
 - (NSString*)localizedMediaControlElementHelpText:(NSString*)name;
 - (NSString*)localizedMediaTimeDescription:(float)time;
 
+- (NSString *)validationMessageValueMissingText;
+- (NSString *)validationMessageTypeMismatchText;
+- (NSString *)validationMessagePatternMismatchText;
+- (NSString *)validationMessageTooLongText;
+- (NSString *)validationMessageRangeUnderflowText;
+- (NSString *)validationMessageRangeOverflowText;
+- (NSString *)validationMessageStepMismatchText;
 
 @end
 
diff --git a/WebCore/page/win/FrameCGWin.cpp b/WebCore/page/win/FrameCGWin.cpp
index 7483627..d9e577b 100644
--- a/WebCore/page/win/FrameCGWin.cpp
+++ b/WebCore/page/win/FrameCGWin.cpp
@@ -52,6 +52,9 @@ static void drawRectIntoContext(IntRect rect, FrameView* view, GraphicsContext*
 
 static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
 {
+    PaintBehavior oldPaintBehavior = frame->view()->paintBehavior();
+    frame->view()->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+
     void* bits;
     HDC hdc = CreateCompatibleDC(0);
     int w = ir.width();
@@ -74,6 +77,8 @@ static HBITMAP imageFromRect(const Frame* frame, IntRect& ir)
     SelectObject(hdc, hbmpOld);
     DeleteDC(hdc);
 
+    frame->view()->setPaintBehavior(oldPaintBehavior);
+
     return hbmp;
 }
 
@@ -81,12 +86,12 @@ HBITMAP imageFromSelection(Frame* frame, bool forceBlackText)
 {
     frame->document()->updateLayout();
 
-    frame->view()->setPaintRestriction(forceBlackText ? PaintRestrictionSelectionOnlyBlackText : PaintRestrictionSelectionOnly);
+    frame->view()->setPaintBehavior(PaintBehaviorSelectionOnly | (forceBlackText ? PaintBehaviorForceBlackText : 0));
     FloatRect fr = frame->selectionBounds();
     IntRect ir(static_cast<int>(fr.x()), static_cast<int>(fr.y()),
                static_cast<int>(fr.width()), static_cast<int>(fr.height()));
     HBITMAP image = imageFromRect(frame, ir);
-    frame->view()->setPaintRestriction(PaintRestrictionNone);
+    frame->view()->setPaintBehavior(PaintBehaviorNormal);
     return image;
 }
 
diff --git a/WebCore/platform/ContextMenu.cpp b/WebCore/platform/ContextMenu.cpp
index ee6aa4e..771798a 100644
--- a/WebCore/platform/ContextMenu.cpp
+++ b/WebCore/platform/ContextMenu.cpp
@@ -40,6 +40,7 @@
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "InspectorController.h"
 #include "KURL.h"
 #include "LocalizedStrings.h"
 #include "Node.h"
@@ -779,6 +780,7 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
 #endif
+        case ContextMenuItemBaseCustomTag:
         case ContextMenuItemBaseApplicationTag:
             break;
     }
diff --git a/WebCore/platform/ContextMenu.h b/WebCore/platform/ContextMenu.h
index dc484b2..77843dc 100644
--- a/WebCore/platform/ContextMenu.h
+++ b/WebCore/platform/ContextMenu.h
@@ -78,6 +78,8 @@ namespace WebCore {
         RetainPtr<NSMutableArray> m_platformDescription;
 #elif PLATFORM(QT)
         QList<ContextMenuItem> m_items;
+#elif PLATFORM(CHROMIUM)
+        Vector<ContextMenuItem> m_items;
 #else
         PlatformMenuDescription m_platformDescription;
 #endif
diff --git a/WebCore/platform/ContextMenuItem.h b/WebCore/platform/ContextMenuItem.h
index 6b9d0a9..b4c97a5 100644
--- a/WebCore/platform/ContextMenuItem.h
+++ b/WebCore/platform/ContextMenuItem.h
@@ -143,6 +143,7 @@ namespace WebCore {
         ContextMenuItemTagCapitalize,
         ContextMenuItemTagChangeBack,
 #endif
+        ContextMenuItemBaseCustomTag = 5000,
         ContextMenuItemBaseApplicationTag = 10000
     };
 
@@ -210,11 +211,24 @@ namespace WebCore {
     };
 #elif PLATFORM(HAIKU)
     typedef BMenuItem* PlatformMenuItemDescription;
+#elif PLATFORM(CHROMIUM)
+    struct PlatformMenuItemDescription {
+        PlatformMenuItemDescription()
+            : type(ActionType)
+            , action(ContextMenuItemTagNoAction)
+            , checked(false)
+            , enabled(true) { }
+        ContextMenuItemType type;
+        ContextMenuAction action;
+        String title;
+        bool checked;
+        bool enabled;
+    };
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
 
-    class ContextMenuItem {
+    class ContextMenuItem : public FastAllocBase {
     public:
         ContextMenuItem(PlatformMenuItemDescription);
         ContextMenuItem(ContextMenu* subMenu = 0);
@@ -239,7 +253,8 @@ namespace WebCore {
         void setSubMenu(ContextMenu*);
 
         void setChecked(bool = true);
-        
+        bool checked() const;
+
         void setEnabled(bool = true);
         bool enabled() const;
 
diff --git a/WebCore/platform/CrossThreadCopier.h b/WebCore/platform/CrossThreadCopier.h
index 178e056..2bdf57d 100644
--- a/WebCore/platform/CrossThreadCopier.h
+++ b/WebCore/platform/CrossThreadCopier.h
@@ -41,7 +41,7 @@
 namespace WebCore {
 
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
     class String;
     struct CrossThreadResourceResponseData;
diff --git a/WebCore/platform/DeprecatedPtrList.h b/WebCore/platform/DeprecatedPtrList.h
index 67161af..47cd538 100644
--- a/WebCore/platform/DeprecatedPtrList.h
+++ b/WebCore/platform/DeprecatedPtrList.h
@@ -27,12 +27,13 @@
 #define DeprecatedPtrList_h
 
 #include "DeprecatedPtrListImpl.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
 template <class T> class DeprecatedPtrListIterator;
 
-template <class T> class DeprecatedPtrList {
+template <class T> class DeprecatedPtrList : public FastAllocBase {
 public:
     DeprecatedPtrList() : impl(deleteFunc), del_item(false) { }
     ~DeprecatedPtrList() { impl.clear(del_item); }
diff --git a/WebCore/platform/DeprecatedPtrListImpl.cpp b/WebCore/platform/DeprecatedPtrListImpl.cpp
index 6d6112e..96fd513 100644
--- a/WebCore/platform/DeprecatedPtrListImpl.cpp
+++ b/WebCore/platform/DeprecatedPtrListImpl.cpp
@@ -29,10 +29,11 @@
 #include <cstddef>
 #include <algorithm>
 #include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class DeprecatedListNode
+class DeprecatedListNode : public Noncopyable
 {
 public:
     DeprecatedListNode(void *d) : data(d), next(0), prev(0) { }
diff --git a/WebCore/platform/FileChooser.cpp b/WebCore/platform/FileChooser.cpp
index 739181d..9fad392 100644
--- a/WebCore/platform/FileChooser.cpp
+++ b/WebCore/platform/FileChooser.cpp
@@ -37,16 +37,16 @@ FileChooserClient::~FileChooserClient()
 {
 }
 
-inline FileChooser::FileChooser(FileChooserClient* client, const String& filename)
+inline FileChooser::FileChooser(FileChooserClient* client, const Vector<String>& initialFilenames)
     : m_client(client)
-    , m_icon(chooseIcon(filename))
+    , m_icon(Icon::createIconForFiles(initialFilenames))
 {
-    m_filenames.append(filename);
+    m_filenames = initialFilenames;
 }
 
-PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const String& filename)
+PassRefPtr<FileChooser> FileChooser::create(FileChooserClient* client, const Vector<String>& initialFilenames)
 {
-    return adoptRef(new FileChooser(client, filename));
+    return adoptRef(new FileChooser(client, initialFilenames));
 }
 
 FileChooser::~FileChooser()
@@ -61,13 +61,9 @@ void FileChooser::clear()
 
 void FileChooser::chooseFile(const String& filename)
 {
-    if (m_filenames.size() == 1 && m_filenames[0] == filename)
-        return;
-    m_filenames.clear();
-    m_filenames.append(filename);
-    m_icon = chooseIcon(filename);
-    if (m_client)
-        m_client->valueChanged();
+    Vector<String> filenames;
+    filenames.append(filename);
+    chooseFiles(filenames);
 }
 
 void FileChooser::chooseFiles(const Vector<String>& filenames)
@@ -75,23 +71,9 @@ void FileChooser::chooseFiles(const Vector<String>& filenames)
     if (m_filenames == filenames)
         return;
     m_filenames = filenames;
-    m_icon = chooseIcon(filenames);
+    m_icon = Icon::createIconForFiles(filenames);
     if (m_client)
         m_client->valueChanged();
 }
 
-PassRefPtr<Icon> FileChooser::chooseIcon(const String& filename)
-{
-    return Icon::createIconForFile(filename);
-}
-
-PassRefPtr<Icon> FileChooser::chooseIcon(Vector<String> filenames)
-{
-    if (filenames.isEmpty())
-        return 0;
-    if (filenames.size() == 1)
-        return Icon::createIconForFile(filenames[0]);
-    return Icon::createIconForFiles(filenames);
-}
-
 }
diff --git a/WebCore/platform/FileChooser.h b/WebCore/platform/FileChooser.h
index 8192fe8..1d4e970 100644
--- a/WebCore/platform/FileChooser.h
+++ b/WebCore/platform/FileChooser.h
@@ -47,7 +47,7 @@ public:
 
 class FileChooser : public RefCounted<FileChooser> {
 public:
-    static PassRefPtr<FileChooser> create(FileChooserClient*, const String& initialFilename);
+    static PassRefPtr<FileChooser> create(FileChooserClient*, const Vector<String>& initialFilenames);
     ~FileChooser();
 
     void disconnectClient() { m_client = 0; }
@@ -66,9 +66,7 @@ public:
     bool allowsMultipleFiles() const { return m_client ? m_client->allowsMultipleFiles() : false; }
 
 private:
-    FileChooser(FileChooserClient*, const String& initialfilename);
-    static PassRefPtr<Icon> chooseIcon(const String& filename);
-    static PassRefPtr<Icon> chooseIcon(Vector<String> filenames);
+    FileChooser(FileChooserClient*, const Vector<String>& initialFilenames);
 
     FileChooserClient* m_client;
     Vector<String> m_filenames;
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index 9952b39..3220d51 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -39,9 +39,10 @@
 #if defined(Q_OS_WIN32)
 #include <windows.h>
 #endif
-#if defined(Q_WS_MAC)
-#include <CoreFoundation/CFBundle.h>
 #endif
+
+#if PLATFORM(CF) || (PLATFORM(QT) && defined(Q_WS_MAC))
+#include <CoreFoundation/CFBundle.h>
 #endif
 
 #include <time.h>
@@ -76,6 +77,8 @@ typedef QLibrary* PlatformModule;
 #endif // defined(Q_WS_MAC)
 #elif PLATFORM(GTK)
 typedef GModule* PlatformModule;
+#elif PLATFORM(CF)
+typedef CFBundleRef PlatformModule;
 #else
 typedef void* PlatformModule;
 #endif
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index ffacc19..a8f7969 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -30,7 +30,7 @@
 #include "KURL.h"
 
 #include "CString.h"
-#include "PlatformString.h"
+#include "StringHash.h"
 #include "TextEncoding.h"
 #include <wtf/StdLibExtras.h>
 
@@ -102,7 +102,7 @@ static const unsigned char characterClassTable[256] = {
     /* 42  * */ UserInfoChar,    /* 43  + */ SchemeChar | UserInfoChar,
     /* 44  , */ UserInfoChar,
     /* 45  - */ SchemeChar | UserInfoChar | HostnameChar,
-    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar,
+    /* 46  . */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,
     /* 47  / */ PathSegmentEndChar,
     /* 48  0 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char, 
     /* 49  1 */ SchemeChar | UserInfoChar | HostnameChar | IPv6Char,    
@@ -633,7 +633,7 @@ bool KURL::protocolIs(const char* protocol) const
 
     // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
     // The free function protocolIsJavaScript() should be used instead. 
-    ASSERT(strcmp(protocol, "javascript") != 0);
+    ASSERT(!equalIgnoringCase(protocol, String("javascript")));
 
     if (!m_isValid)
         return false;
@@ -685,18 +685,22 @@ void KURL::setHost(const String& s)
     parse(m_string.left(hostStart()) + (slashSlashNeeded ? "//" : "") + s + m_string.substring(m_hostEnd));
 }
 
+void KURL::removePort()
+{
+    if (m_hostEnd == m_portEnd)
+        return;
+    parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+}
+
 void KURL::setPort(unsigned short i)
 {
     if (!m_isValid)
         return;
 
-    if (i) {
-        bool colonNeeded = m_portEnd == m_hostEnd;
-        int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
+    bool colonNeeded = m_portEnd == m_hostEnd;
+    int portStart = (colonNeeded ? m_hostEnd : m_hostEnd + 1);
 
-        parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
-    } else
-        parse(m_string.left(m_hostEnd) + m_string.substring(m_portEnd));
+    parse(m_string.left(portStart) + (colonNeeded ? ":" : "") + String::number(i) + m_string.substring(m_portEnd));
 }
 
 void KURL::setHostAndPort(const String& hostAndPort)
@@ -819,7 +823,7 @@ String KURL::prettyURL() const
             authority.append('@');
         }
         append(authority, host());
-        if (port() != 0) {
+        if (hasPort()) {
             authority.append(':');
             append(authority, String::number(port()));
         }
@@ -1269,8 +1273,8 @@ void KURL::parse(const char* url, const String* originalString)
         m_userStart = m_userEnd = m_passwordEnd = m_hostEnd = m_portEnd = p - buffer.data();
 
     // For canonicalization, ensure we have a '/' for no path.
-    // Only do this for http and https.
-    if (m_protocolInHTTPFamily && pathEnd - pathStart == 0)
+    // Do this only for hierarchical URL with protocol http or https.
+    if (m_protocolInHTTPFamily && hierarchical && pathEnd == pathStart)
         *p++ = '/';
 
     // add path, escaping bad characters
@@ -1624,6 +1628,132 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 String mimeTypeFromDataURL(const String& url)
 {
     ASSERT(protocolIs(url, "data"));
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index 73fadd1..647330d 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -78,6 +78,7 @@ public:
     KURL(const KURL& base, const String& relative);
     KURL(const KURL& base, const String& relative, const TextEncoding&);
 
+
 #if USE(GOOGLEURL)
     // For conversions for other structures that have already parsed and
     // canonicalized the URL. The input must be exactly what KURL would have
@@ -104,6 +105,12 @@ public:
     // non-hierarchical (like "javascript:") URLs will have no path.
     bool hasPath() const;
 
+    // Returns true if you can set the host and port for the URL.
+    // Non-hierarchical URLs don't have a host and port.
+    bool canSetHostOrPort() const { return isHierarchical(); }
+
+    bool canSetPathname() const { return isHierarchical(); }
+    
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
 #else
@@ -113,6 +120,7 @@ public:
     String protocol() const;
     String host() const;
     unsigned short port() const;
+    bool hasPort() const;
     String user() const;
     String pass() const;
     String path() const;
@@ -135,7 +143,7 @@ public:
     void setProtocol(const String&);
     void setHost(const String&);
 
-    // Setting the port to 0 will clear any port from the URL.
+    void removePort();
     void setPort(unsigned short);
 
     // Input is like "foo.com" or "foo.com:8000".
@@ -254,6 +262,10 @@ const KURL& blankURL();
 
 bool protocolIs(const String& url, const char* protocol);
 bool protocolIsJavaScript(const String& url);
+bool isValidProtocol(const String& protocol);
+
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+bool portAllowed(const KURL&); // Blacklist ports that should never be used for Web resources.
 
 String mimeTypeFromDataURL(const String& url);
 
@@ -317,6 +329,11 @@ inline bool KURL::isValid() const
     return m_isValid;
 }
 
+inline bool KURL::hasPort() const
+{
+    return m_hostEnd < m_portEnd;
+}
+
 inline bool KURL::protocolInHTTPFamily() const
 {
     return m_protocolInHTTPFamily;
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index d0aae0c..76b5612 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -38,16 +38,21 @@
 #include <stdio.h>
 #endif
 
+#include <algorithm>
+
 #include "CString.h"
+#include "StringHash.h"
 #include "NotImplemented.h"
 #include "TextEncoding.h"
 #include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
 
 #include <googleurl/src/url_canon_internal.h>
 #include <googleurl/src/url_util.h>
 
 using WTF::isASCIILower;
 using WTF::toASCIILower;
+using std::binary_search;
 
 namespace WebCore {
 
@@ -116,6 +121,16 @@ static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char*
     return begin == end && !*str;
 }
 
+static inline bool isSchemeFirstChar(char c)
+{
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+}
+
+static inline bool isSchemeChar(char c)
+{
+    return isSchemeFirstChar(c) || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '*';
+}
+
 
 // KURLGooglePrivate -----------------------------------------------------------
 
@@ -426,6 +441,11 @@ bool KURL::isValid() const
     return m_url.m_isValid;
 }
 
+bool KURL::hasPort() const
+{
+    return hostEnd() < pathStart();
+}
+
 bool KURL::protocolInHTTPFamily() const
 {
     return m_url.m_protocolInHTTPFamily;
@@ -537,7 +557,10 @@ String KURL::query() const
     // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
     // an empty string when the query is empty rather than a null (not sure
     // which is right).
-    return String("", 0);
+    // Returns a null if the query is not specified, instead of empty.
+    if (m_url.m_parsed.query.is_valid())
+        return String("", 0);
+    return String();
 }
 
 String KURL::path() const
@@ -562,24 +585,36 @@ void KURL::setHost(const String& host)
     m_url.replaceComponents(replacements);
 }
 
-// This function is used only in the JSC build.
 void KURL::setHostAndPort(const String& s)
 {
-    String newhost = s.left(s.find(":"));
-    String newport = s.substring(s.find(":") + 1);
+    String host = s;
+    String port;
+    int hostEnd = s.find(":");
+    if (hostEnd != -1) {
+        host = s.left(hostEnd);
+        port = s.substring(hostEnd + 1);
+    }
 
     KURLGooglePrivate::Replacements replacements;
     // Host can't be removed, so we always set.
-    replacements.SetHost(CharactersOrEmpty(newhost),
-                         url_parse::Component(0, newhost.length()));
+    replacements.SetHost(CharactersOrEmpty(host),
+                         url_parse::Component(0, host.length()));
 
-    if (newport.isEmpty())  // Port may be removed, so we support clearing.
+    if (port.isEmpty())  // Port may be removed, so we support clearing.
         replacements.ClearPort();
     else
-        replacements.SetPort(CharactersOrEmpty(newport), url_parse::Component(0, newport.length()));
+        replacements.SetPort(CharactersOrEmpty(port), url_parse::Component(0, port.length()));
     m_url.replaceComponents(replacements);
 }
 
+void KURL::removePort()
+{
+    if (hasPort()) {
+        String urlWithoutPort = m_url.string().left(hostEnd()) + m_url.string().substring(pathStart());
+        m_url.setUtf8(urlWithoutPort.utf8());
+    }
+}
+
 void KURL::setPort(unsigned short i)
 {
     KURLGooglePrivate::Replacements replacements;
@@ -698,6 +733,142 @@ bool protocolIsJavaScript(const String& url)
     return protocolIs(url, "javascript");
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+{
+    if (protocol.isEmpty())
+        return false;
+
+    typedef HashMap<String, unsigned, CaseFoldingHash> DefaultPortsMap;
+    DEFINE_STATIC_LOCAL(DefaultPortsMap, defaultPorts, ());
+    if (defaultPorts.isEmpty()) {
+        defaultPorts.set("http", 80);
+        defaultPorts.set("https", 443);
+        defaultPorts.set("ftp", 21);
+        defaultPorts.set("ftps", 990);
+    }
+    return defaultPorts.get(protocol) == port;
+}
+
+// We copied the KURL version here on Dec 4, 2009 while doing a WebKit
+// merge.
+//
+// FIXME Somehow share this with KURL? Like we'd theoretically merge with
+// decodeURLEscapeSequences below?
+bool portAllowed(const KURL& url)
+{
+    unsigned short port = url.port();
+
+    // Since most URLs don't have a port, return early for the "no port" case.
+    if (!port)
+        return true;
+
+    // This blocked port list matches the port blocking that Mozilla implements.
+    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
+    static const unsigned short blockedPortList[] = {
+        1,    // tcpmux
+        7,    // echo
+        9,    // discard
+        11,   // systat
+        13,   // daytime
+        15,   // netstat
+        17,   // qotd
+        19,   // chargen
+        20,   // FTP-data
+        21,   // FTP-control
+        22,   // SSH
+        23,   // telnet
+        25,   // SMTP
+        37,   // time
+        42,   // name
+        43,   // nicname
+        53,   // domain
+        77,   // priv-rjs
+        79,   // finger
+        87,   // ttylink
+        95,   // supdup
+        101,  // hostriame
+        102,  // iso-tsap
+        103,  // gppitnp
+        104,  // acr-nema
+        109,  // POP2
+        110,  // POP3
+        111,  // sunrpc
+        113,  // auth
+        115,  // SFTP
+        117,  // uucp-path
+        119,  // nntp
+        123,  // NTP
+        135,  // loc-srv / epmap
+        139,  // netbios
+        143,  // IMAP2
+        179,  // BGP
+        389,  // LDAP
+        465,  // SMTP+SSL
+        512,  // print / exec
+        513,  // login
+        514,  // shell
+        515,  // printer
+        526,  // tempo
+        530,  // courier
+        531,  // Chat
+        532,  // netnews
+        540,  // UUCP
+        556,  // remotefs
+        563,  // NNTP+SSL
+        587,  // ESMTP
+        601,  // syslog-conn
+        636,  // LDAP+SSL
+        993,  // IMAP+SSL
+        995,  // POP3+SSL
+        2049, // NFS
+        3659, // apple-sasl / PasswordServer [Apple addition]
+        4045, // lockd
+        6000, // X11
+    };
+    const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
+
+#ifndef NDEBUG
+    // The port list must be sorted for binary_search to work.
+    static bool checkedPortList = false;
+    if (!checkedPortList) {
+        for (const unsigned short* p = blockedPortList; p != blockedPortListEnd - 1; ++p)
+            ASSERT(*p < *(p + 1));
+        checkedPortList = true;
+    }
+#endif
+
+    // If the port is not in the blocked port list, allow it.
+    if (!binary_search(blockedPortList, blockedPortListEnd, port))
+        return true;
+
+    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
+    if ((port == 21 || port == 22) && url.protocolIs("ftp"))
+        return true;
+
+    // Allow any port number in a file URL, since the port number is ignored.
+    if (url.protocolIs("file"))
+        return true;
+
+    return false;
+}
+
 // We copied the KURL version here on Sept 12, 2008 while doing a WebKit
 // merge.
 // 
diff --git a/WebCore/platform/Length.h b/WebCore/platform/Length.h
index b4497b6..4f36577 100644
--- a/WebCore/platform/Length.h
+++ b/WebCore/platform/Length.h
@@ -22,6 +22,7 @@
 #define Length_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
@@ -33,7 +34,7 @@ const int percentScaleFactor = 128;
 
 enum LengthType { Auto, Relative, Percent, Fixed, Static, Intrinsic, MinIntrinsic };
 
-struct Length {
+struct Length : FastAllocBase {
     Length()
         : m_value(0)
     {
diff --git a/WebCore/platform/LocalizedStrings.h b/WebCore/platform/LocalizedStrings.h
index 0fa9f71..f7a6fa6 100644
--- a/WebCore/platform/LocalizedStrings.h
+++ b/WebCore/platform/LocalizedStrings.h
@@ -141,6 +141,15 @@ namespace WebCore {
     String localizedMediaControlElementString(const String&);
     String localizedMediaControlElementHelpText(const String&);
     String localizedMediaTimeDescription(float);
+
+    String validationMessageValueMissingText();
+    String validationMessageTypeMismatchText();
+    String validationMessagePatternMismatchText();
+    String validationMessageTooLongText();
+    String validationMessageRangeUnderflowText();
+    String validationMessageRangeOverflowText();
+    String validationMessageStepMismatchText();
+
 }
 
 #endif
diff --git a/WebCore/platform/MIMETypeRegistry.cpp b/WebCore/platform/MIMETypeRegistry.cpp
index 32dd3f6..978a611 100644
--- a/WebCore/platform/MIMETypeRegistry.cpp
+++ b/WebCore/platform/MIMETypeRegistry.cpp
@@ -261,8 +261,8 @@ static void initializeMediaTypeMaps()
     static const TypeExtensionPair pairs[] = {
     
         // Ogg
-        { "application/ogg", "ogg" },
         { "application/ogg", "ogx" },
+        { "audio/ogg", "ogg" },
         { "audio/ogg", "oga" },
         { "video/ogg", "ogv" },
 
diff --git a/WebCore/platform/PlatformKeyboardEvent.h b/WebCore/platform/PlatformKeyboardEvent.h
index b5c2e95..cbbb48d 100644
--- a/WebCore/platform/PlatformKeyboardEvent.h
+++ b/WebCore/platform/PlatformKeyboardEvent.h
@@ -65,7 +65,7 @@ class BMessage;
 
 namespace WebCore {
 
-    class PlatformKeyboardEvent {
+    class PlatformKeyboardEvent : public FastAllocBase {
     public:
         enum Type {
             // KeyDown is sent by platforms such as Mac OS X, gtk and Qt, and has information about both physical pressed key, and its translation.
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 1c9b5ce..6df462a 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -50,6 +50,7 @@ ScrollView::ScrollView()
     , m_updateScrollbarsPass(0)
     , m_drawPanScrollIcon(false)
     , m_useFixedLayout(false)
+    , m_paintsEntireContents(false)
 {
     platformInit();
 }
@@ -169,6 +170,11 @@ bool ScrollView::canBlitOnScroll() const
     return m_canBlitOnScroll;
 }
 
+void ScrollView::setPaintsEntireContents(bool paintsEntireContents)
+{
+    m_paintsEntireContents = paintsEntireContents;
+}
+
 #if !PLATFORM(GTK)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
@@ -712,6 +718,7 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
+<<<<<<< HEAD:WebCore/platform/ScrollView.cpp
     IntRect visibleContent = visibleContentRect();
 #ifdef ANDROID_CAPTURE_OFFSCREEN_PAINTS
     IntRect fullVis = visibleContent;
@@ -722,14 +729,20 @@ void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
         platformOffscreenContentRectangle(fullVis, rect);
 #endif
     if (visibleContent.isEmpty())
+=======
+    IntRect paintRect = rect;
+    if (!paintsEntireContents())
+        paintRect.intersect(visibleContentRect());
+    if (paintRect.isEmpty())
+>>>>>>> webkit.org at r51976:WebCore/platform/ScrollView.cpp
         return;
     if (platformWidget()) {
-        platformRepaintContentRectangle(visibleContent, now);
+        platformRepaintContentRectangle(paintRect, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+        hostWindow()->repaint(contentsToWindow(paintRect), true, now);
 }
 
 IntRect ScrollView::scrollCornerRect() const
@@ -775,7 +788,7 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
-    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+    context->drawImage(panScrollIcon, DeviceColorSpace, m_panScrollIconPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -970,7 +983,7 @@ void ScrollView::platformDestroy()
 
 #endif
 
-#if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)
+#if (!PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(MAC)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformAddChild(Widget*)
 {
@@ -982,7 +995,7 @@ void ScrollView::platformRemoveChild(Widget*)
 
 #endif
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(MAC) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 {
@@ -990,7 +1003,7 @@ void ScrollView::platformSetScrollbarsSuppressed(bool repaintOnUnsuppress)
 
 #endif
 
-#if !PLATFORM(MAC) && !PLATFORM(WX)
+#if (!PLATFORM(MAC) && !PLATFORM(WX)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 
 void ScrollView::platformSetScrollbarModes()
 {
@@ -1052,8 +1065,12 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
     return true;
 }
 
+<<<<<<< HEAD:WebCore/platform/ScrollView.cpp
 #if !PLATFORM(ANDROID)
 void ScrollView::platformRepaintContentRectangle(const IntRect&, bool now)
+=======
+void ScrollView::platformRepaintContentRectangle(const IntRect&, bool /*now*/)
+>>>>>>> webkit.org at r51976:WebCore/platform/ScrollView.cpp
 {
 }
 
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index 2844ace..ac0e42f 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -89,9 +89,14 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    void setCanHaveScrollbars(bool flag);
+    virtual void setCanHaveScrollbars(bool);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
+    // By default you only receive paint events for the area that is visible. In the case of using a
+    // tiled backing store, this method can be set, so that the view paints the entire contents.
+    bool paintsEntireContents() const { return m_paintsEntireContents; }
+    void setPaintsEntireContents(bool);
+
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
@@ -272,6 +277,8 @@ private:
     bool m_drawPanScrollIcon;
     bool m_useFixedLayout;
 
+    bool m_paintsEntireContents;
+
     void init();
     void destroy();
 
diff --git a/WebCore/platform/ScrollbarTheme.h b/WebCore/platform/ScrollbarTheme.h
index 9327dc6..01229e1 100644
--- a/WebCore/platform/ScrollbarTheme.h
+++ b/WebCore/platform/ScrollbarTheme.h
@@ -36,7 +36,7 @@ class PlatformMouseEvent;
 class Scrollbar;
 class ScrollView;
 
-class ScrollbarTheme {
+class ScrollbarTheme : public Noncopyable {
 public:
     virtual ~ScrollbarTheme() {};
 
@@ -73,7 +73,7 @@ public:
 
     virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
 
-    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white); }
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, DeviceColorSpace); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
diff --git a/WebCore/platform/ScrollbarThemeComposite.cpp b/WebCore/platform/ScrollbarThemeComposite.cpp
index ab5e16b..74bfae3 100644
--- a/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -297,7 +297,7 @@ void ScrollbarThemeComposite::paintScrollCorner(ScrollView* view, GraphicsContex
     Page* page = frameView->frame() ? frameView->frame()->page() : 0;
     if (page && page->settings()->shouldPaintCustomScrollbars()) {
         if (!page->chrome()->client()->paintCustomScrollCorner(context, cornerRect))
-            context->fillRect(cornerRect, Color::white);
+            context->fillRect(cornerRect, Color::white, DeviceColorSpace);
     }
 }
 
diff --git a/WebCore/platform/SharedTimer.h b/WebCore/platform/SharedTimer.h
index a005add..5b5cd14 100644
--- a/WebCore/platform/SharedTimer.h
+++ b/WebCore/platform/SharedTimer.h
@@ -26,12 +26,14 @@
 #ifndef SharedTimer_h
 #define SharedTimer_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     // Each thread has its own single instance of shared timer, which implements this interface.
     // This instance is shared by all timers in the thread.
     // Not intended to be used directly; use the Timer class instead.
-    class SharedTimer {
+    class SharedTimer : public Noncopyable {
     public:
         virtual ~SharedTimer() {}
         virtual void setFiredFunction(void (*)()) = 0;
diff --git a/WebCore/platform/StaticConstructors.h b/WebCore/platform/StaticConstructors.h
index 5bc792c..c0a9a53 100644
--- a/WebCore/platform/StaticConstructors.h
+++ b/WebCore/platform/StaticConstructors.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/platform/ThemeTypes.h b/WebCore/platform/ThemeTypes.h
index e132313..439a3b1 100644
--- a/WebCore/platform/ThemeTypes.h
+++ b/WebCore/platform/ThemeTypes.h
@@ -48,7 +48,7 @@ enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
     ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
-    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
+    MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart, MediaToggleClosedCaptionsButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
     MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
diff --git a/WebCore/platform/ThreadGlobalData.cpp b/WebCore/platform/ThreadGlobalData.cpp
index a43e9bd..26a9728 100644
--- a/WebCore/platform/ThreadGlobalData.cpp
+++ b/WebCore/platform/ThreadGlobalData.cpp
@@ -32,7 +32,7 @@
 #include "ThreadTimers.h"
 #include <wtf/UnusedParam.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 
@@ -75,7 +75,7 @@ ThreadGlobalData::ThreadGlobalData()
 #ifndef NDEBUG
     , m_isMainThread(isMainThread())
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     , m_cachedConverterICU(new ICUConverterWrapper)
 #endif
 #if PLATFORM(MAC)
@@ -89,7 +89,7 @@ ThreadGlobalData::~ThreadGlobalData()
 #if PLATFORM(MAC)
     delete m_cachedConverterTEC;
 #endif
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     delete m_cachedConverterICU;
 #endif
 
diff --git a/WebCore/platform/TreeShared.h b/WebCore/platform/TreeShared.h
index 02728ff..a60ad0d 100644
--- a/WebCore/platform/TreeShared.h
+++ b/WebCore/platform/TreeShared.h
@@ -23,6 +23,9 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
+#ifndef NDEBUG
+#include <wtf/Threading.h>
+#endif
 
 namespace WebCore {
 
@@ -32,6 +35,7 @@ public:
         : m_refCount(initialRefCount)
         , m_parent(0)
     {
+        ASSERT(isMainThread());
 #ifndef NDEBUG
         m_deletionHasBegun = false;
         m_inRemovedLastRefFunction = false;
@@ -39,11 +43,13 @@ public:
     }
     virtual ~TreeShared()
     {
+        ASSERT(isMainThread());
         ASSERT(m_deletionHasBegun);
     }
 
     void ref()
     {
+        ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         ++m_refCount;
@@ -51,6 +57,7 @@ public:
 
     void deref()
     {
+        ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
         if (--m_refCount <= 0 && !m_parent) {
@@ -73,8 +80,17 @@ public:
         return m_refCount;
     }
 
-    void setParent(T* parent) { m_parent = parent; }
-    T* parent() const { return m_parent; }
+    void setParent(T* parent)
+    { 
+        ASSERT(isMainThread());
+        m_parent = parent; 
+    }
+
+    T* parent() const
+    {
+        ASSERT(isMainThread());
+        return m_parent;
+    }
 
 #ifndef NDEBUG
     bool m_deletionHasBegun;
diff --git a/WebCore/platform/Widget.cpp b/WebCore/platform/Widget.cpp
index 23e5de8..2213a11 100644
--- a/WebCore/platform/Widget.cpp
+++ b/WebCore/platform/Widget.cpp
@@ -105,7 +105,7 @@ IntPoint Widget::convertToContainingWindow(const IntPoint& localPoint) const
     return convertFromRootToContainingWindow(this, localPoint);
 }
 
-#if !PLATFORM(MAC)
+#if !PLATFORM(MAC) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
 IntRect Widget::convertFromRootToContainingWindow(const Widget*, const IntRect& rect)
 {
     return rect;
@@ -127,7 +127,11 @@ IntPoint Widget::convertFromContainingWindowToRoot(const Widget*, const IntPoint
 }
 #endif
 
+<<<<<<< HEAD:WebCore/platform/Widget.cpp
 #if !PLATFORM(MAC) && !PLATFORM(GTK) && !PLATFORM(ANDROID)
+=======
+#if (!PLATFORM(MAC) && !PLATFORM(GTK)) || ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+>>>>>>> webkit.org at r51976:WebCore/platform/Widget.cpp
 void Widget::releasePlatformWidget()
 {
 }
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index cbbc427..a449d58 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -189,7 +189,7 @@ public:
 
     virtual void frameRectsChanged() {}
 
-#if PLATFORM(MAC)    
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     NSView* getOuterView() const;
     
     static void beforeMouseDown(NSView*, Widget*);
@@ -226,7 +226,7 @@ private:
     
     IntRect m_frame; // Not used when a native widget exists.
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
     WidgetPrivate* m_data;
 #endif
 #if PLATFORM(ANDROID)
diff --git a/WebCore/platform/animation/AnimationList.h b/WebCore/platform/animation/AnimationList.h
index 9901424..afad422 100644
--- a/WebCore/platform/animation/AnimationList.h
+++ b/WebCore/platform/animation/AnimationList.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class AnimationList {
+class AnimationList : public FastAllocBase {
 public:
     void fillUnsetProperties();
     bool operator==(const AnimationList& o) const;
diff --git a/WebCore/platform/cf/BinaryPropertyList.h b/WebCore/platform/cf/BinaryPropertyList.h
index 598aaa7..a930b43 100644
--- a/WebCore/platform/cf/BinaryPropertyList.h
+++ b/WebCore/platform/cf/BinaryPropertyList.h
@@ -26,6 +26,8 @@
 #ifndef BinaryPropertyList_h
 #define BinaryPropertyList_h
 
+#include <CoreFoundation/CoreFoundation.h>
+
 #include <wtf/Vector.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 0c80636..3709f7c 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -37,6 +37,8 @@
 #include "PassRefPtr.h"
 #include "PasteboardPrivate.h"
 
+#include <wtf/Vector.h>
+
 typedef struct NPObject NPObject;
 typedef struct _NPP NPP_t;
 typedef NPP_t* NPP;
@@ -58,6 +60,7 @@ namespace WebCore {
     class String;
     class Widget;
 
+    struct Cookie;
     struct PluginInfo;
 
     // An interface to the embedding layer, which has the ability to answer
@@ -82,6 +85,8 @@ namespace WebCore {
         // Cookies ------------------------------------------------------------
         static void setCookies(const KURL& url, const KURL& firstPartyForCookies, const String& value);
         static String cookies(const KURL& url, const KURL& firstPartyForCookies);
+        static bool rawCookies(const KURL& url, const KURL& firstPartyForCookies, Vector<Cookie>*);
+        static void deleteCookie(const KURL& url, const String& cookieName);
 
         // DNS ----------------------------------------------------------------
         static void prefetchDNS(const String& hostname);
@@ -113,13 +118,13 @@ namespace WebCore {
         // HTML5 DB -----------------------------------------------------------
 #if ENABLE(DATABASE)
         // Returns a handle to the DB file and ooptionally a handle to its containing directory
-        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
+        static PlatformFileHandle databaseOpenFile(const String& vfsFleName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
         // Returns a SQLite code (SQLITE_OK = 0, on success)
-        static int databaseDeleteFile(const String& fileName, bool syncDir = false);
+        static int databaseDeleteFile(const String& vfsFileName, bool syncDir = false);
         // Returns the attributes of the DB file
-        static long databaseGetFileAttributes(const String& fileName);
+        static long databaseGetFileAttributes(const String& vfsFileName);
         // Returns the size of the DB file
-        static long long databaseGetFileSize(const String& fileName);
+        static long long databaseGetFileSize(const String& vfsFileName);
 #endif
 
         // JavaScript ---------------------------------------------------------
@@ -135,6 +140,11 @@ namespace WebCore {
         // LayoutTestMode -----------------------------------------------------
         static bool layoutTestMode();
 
+        // Memory -------------------------------------------------------------
+        // Returns the current space allocated for the pagefile, in MB.
+        // That is committed size for Windows and virtual memory size for POSIX
+        static int memoryUsageMB();
+
         // MimeType -----------------------------------------------------------
         static bool isSupportedImageMIMEType(const String& mimeType);
         static bool isSupportedJavaScriptMIMEType(const String& mimeType);
@@ -148,9 +158,6 @@ namespace WebCore {
         static NPObject* pluginScriptableObject(Widget*);
         static bool popupsAllowed(NPP);
 
-        // Protocol -----------------------------------------------------------
-        static String uiResourceProtocol();  // deprecated
-
         // Resources ----------------------------------------------------------
         static PassRefPtr<Image> loadPlatformImageResource(const char* name);
 
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index d330d3b..1a2caa4 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -354,7 +354,7 @@ void ClipboardChromium::writeRange(Range* selectedRange, Frame* frame)
     m_dataObject->textHtml = createMarkup(selectedRange, 0,
         AnnotateForInterchange);
 #if PLATFORM(DARWIN)
-    m_dataObject->textHtml = String("<meta charset='utf-8'>") + m_dataObject->textHtml;
+    m_dataObject->textHtml = String("<meta charset='utf-8' id='webkit-interchange-charset'>") + m_dataObject->textHtml;
 #endif
     m_dataObject->htmlBaseUrl = frame->document()->url();
 
diff --git a/WebCore/platform/chromium/ContextMenuChromium.cpp b/WebCore/platform/chromium/ContextMenuChromium.cpp
index 0614e3e..93c0ec4 100644
--- a/WebCore/platform/chromium/ContextMenuChromium.cpp
+++ b/WebCore/platform/chromium/ContextMenuChromium.cpp
@@ -38,13 +38,11 @@ namespace WebCore {
 
 ContextMenu::ContextMenu(const HitTestResult& result)
     : m_hitTestResult(result)
-    , m_platformDescription(0)
 {
 }
 
 ContextMenu::ContextMenu(const HitTestResult& result, const PlatformMenuDescription menu)
     : m_hitTestResult(result)
-    , m_platformDescription(0)
 {
 }
 
@@ -54,25 +52,31 @@ ContextMenu::~ContextMenu()
 
 unsigned ContextMenu::itemCount() const
 {
-    return 0;
+    return m_items.size();
 }
 
 void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
 {
+    m_items.insert(position, item);
 }
 
 void ContextMenu::appendItem(ContextMenuItem& item)
 {
+    m_items.append(item);
 }
 
 ContextMenuItem* ContextMenu::itemWithAction(unsigned action)
 {
+    for (size_t i = 0; i < m_items.size(); ++i) {
+        if (m_items[i].action() == static_cast<ContextMenuAction>(action))
+            return &m_items[i];
+    }
     return 0;
 }
 
 ContextMenuItem* ContextMenu::itemAtIndex(unsigned index, const PlatformMenuDescription platformDescription)
 {
-    return 0;
+    return &m_items[index];
 }
 
 void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
@@ -81,7 +85,7 @@ void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
 
 PlatformMenuDescription ContextMenu::platformDescription() const
 {
-    return m_platformDescription;
+    return 0;
 }
 
 PlatformMenuDescription ContextMenu::releasePlatformDescription()
diff --git a/WebCore/platform/chromium/ContextMenuItemChromium.cpp b/WebCore/platform/chromium/ContextMenuItemChromium.cpp
index f34ea23..6a0d657 100644
--- a/WebCore/platform/chromium/ContextMenuItemChromium.cpp
+++ b/WebCore/platform/chromium/ContextMenuItemChromium.cpp
@@ -46,6 +46,9 @@ ContextMenuItem::ContextMenuItem(ContextMenu* subMenu)
 
 ContextMenuItem::ContextMenuItem(ContextMenuItemType type, ContextMenuAction action, const String& title, ContextMenu* subMenu)
 {
+    m_platformDescription.type = type;
+    m_platformDescription.action = action;
+    m_platformDescription.title = title;
 }
 
 ContextMenuItem::~ContextMenuItem()
@@ -54,22 +57,32 @@ ContextMenuItem::~ContextMenuItem()
 
 PlatformMenuItemDescription ContextMenuItem::releasePlatformDescription()
 {
-    return PlatformMenuItemDescription();
+    return m_platformDescription;
 }
 
 ContextMenuItemType ContextMenuItem::type() const
 {
-    return ContextMenuItemType();
+    return m_platformDescription.type;
 }
 
 ContextMenuAction ContextMenuItem::action() const
 { 
-    return ContextMenuAction();
+    return m_platformDescription.action;
 }
 
 String ContextMenuItem::title() const 
 {
-    return String();
+    return m_platformDescription.title;
+}
+
+bool ContextMenuItem::checked() const
+{
+    return m_platformDescription.checked;
+}
+
+bool ContextMenuItem::enabled() const
+{
+    return m_platformDescription.enabled;
 }
 
 PlatformMenuDescription ContextMenuItem::platformSubMenu() const
@@ -79,14 +92,17 @@ PlatformMenuDescription ContextMenuItem::platformSubMenu() const
 
 void ContextMenuItem::setType(ContextMenuItemType type)
 {
+    m_platformDescription.type = type;
 }
 
 void ContextMenuItem::setAction(ContextMenuAction action)
 {
+    m_platformDescription.action = action;
 }
 
 void ContextMenuItem::setTitle(const String& title)
 {
+    m_platformDescription.title = title;
 }
 
 void ContextMenuItem::setSubMenu(ContextMenu* subMenu)
@@ -95,15 +111,12 @@ void ContextMenuItem::setSubMenu(ContextMenu* subMenu)
 
 void ContextMenuItem::setChecked(bool checked)
 {
+    m_platformDescription.checked = checked;
 }
 
 void ContextMenuItem::setEnabled(bool enabled)
 {
-}
-
-bool ContextMenuItem::enabled() const
-{
-    return false;
+    m_platformDescription.enabled = enabled;
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/GeolocationServiceChromium.cpp b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
new file mode 100644
index 0000000..65886b0
--- /dev/null
+++ b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeolocationService.h"
+
+namespace WebCore {
+
+class GeolocationServiceChromium : public GeolocationService {
+public:
+    GeolocationServiceChromium(GeolocationServiceClient* c)
+        : GeolocationService(c)
+    {
+    }
+    // FIXME: Implement. https://bugs.webkit.org/show_bug.cgi?id=32068
+};
+
+// This guard is the counterpart of the one in WebCore/platform/GeolocationService.cpp
+#if ENABLE(GEOLOCATION)
+static GeolocationService* createGeolocationService(GeolocationServiceClient* c)
+{
+    return new GeolocationServiceChromium(c);
+}
+
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &createGeolocationService;
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
index 51bff80..ff0be82 100644
--- a/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
+++ b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
@@ -34,6 +34,7 @@
 #include "ChromiumBridge.h"
 #include "CString.h"
 #include "MediaPlayer.h"
+#include "PluginDataChromium.h"
 
 // NOTE: Unlike other ports, we don't use the shared implementation bits in
 // MIMETypeRegistry.cpp.  Instead, we need to route most functions via the
@@ -41,11 +42,6 @@
 
 namespace WebCore {
 
-// Checks if any of the plugins handle this extension, and if so returns the
-// plugin's mime type for this extension.  Otherwise returns an empty string.
-// See PluginsChromium.cpp for the implementation of this function.
-String getPluginMimeTypeFromExtension(const String& extension);
-
 String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
 {
     return ChromiumBridge::mimeTypeForExtension(ext);
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index 4929eb8..ce06e55 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -83,7 +83,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
 {
     String html = createMarkup(selectedRange, 0, AnnotateForInterchange);
 #if PLATFORM(DARWIN)
-    html = String("<meta charset='utf-8'>") + html;
+    html = String("<meta charset='utf-8' id='webkit-interchange-charset'>") + html;
 #endif
     ExceptionCode ec = 0;
     KURL url = selectedRange->startContainer(ec)->document()->url();
@@ -170,6 +170,11 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
         String markup;
         KURL srcURL;
         ChromiumBridge::clipboardReadHTML(buffer, &markup, &srcURL);
+#if PLATFORM(DARWIN)
+        DEFINE_STATIC_LOCAL(const String, forceUtf8String, ("<meta charset='utf-8' id='webkit-interchange-charset'>"));
+        if (markup.startsWith(forceUtf8String))
+            markup = markup.substring(forceUtf8String.length());
+#endif
 
         RefPtr<DocumentFragment> fragment =
             createFragmentFromMarkup(frame->document(), markup, srcURL);
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index d6f895d..5abd364 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -370,6 +370,12 @@ void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
     ChromeClientChromium* client = static_cast<ChromeClientChromium*>(
          v->frame()->page()->chrome()->client());
     client->popupOpened(this, popupRect, true, true);
+
+    // The popup sends its "closed" notification through its parent. Set the
+    // parent, even though external popups have no real on-screen widget but a
+    // native menu (see |PopupListBox::hidePopup()|);
+    if (!m_listBox->parent())
+        addChild(m_listBox.get());
 }
 
 void PopupContainer::hidePopup()
@@ -446,7 +452,7 @@ void PopupContainer::paintBorder(GraphicsContext* gc, const IntRect& rect)
     Color borderColor(127, 157, 185);
 
     gc->setStrokeStyle(NoStroke);
-    gc->setFillColor(borderColor);
+    gc->setFillColor(borderColor, DeviceColorSpace);
 
     int tx = x();
     int ty = y();
@@ -772,7 +778,7 @@ void PopupListBox::paint(GraphicsContext* gc, const IntRect& rect)
 
     // Special case for an empty popup.
     if (numItems() == 0)
-        gc->fillRect(r, Color::white);
+        gc->fillRect(r, Color::white, DeviceColorSpace);
 
     gc->restore();
 
@@ -805,23 +811,23 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     // If we have a transparent background, make sure it has a color to blend
     // against.
     if (backColor.hasAlpha())
-        gc->fillRect(rowRect, Color::white);
+        gc->fillRect(rowRect, Color::white, DeviceColorSpace);
 
-    gc->fillRect(rowRect, backColor);
+    gc->fillRect(rowRect, backColor, DeviceColorSpace);
     
     if (m_popupClient->itemIsSeparator(rowIndex)) {
         IntRect separatorRect(
             rowRect.x() + separatorPadding,
             rowRect.y() + (rowRect.height() - separatorHeight) / 2,
             rowRect.width() - 2 * separatorPadding, separatorHeight);
-        gc->fillRect(separatorRect, textColor);
+        gc->fillRect(separatorRect, textColor, DeviceColorSpace);
         return;
     }
     
     if (!style.isVisible())
         return;
 
-    gc->setFillColor(textColor);
+    gc->setFillColor(textColor, DeviceColorSpace);
 
     Font itemFont = getRowFont(rowIndex);
     // FIXME: http://crbug.com/19872 We should get the padding of individual option
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index 725de10..a6720a1 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -113,7 +113,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
         const int yPos = rect.topLeft().y() + (rect.height() * percent);
 
         IntPoint tick(scrollbar->x(), yPos);
-        context->drawImage(dash.get(), tick);
+        context->drawImage(dash.get(), DeviceColorSpace, tick);
     }
 
     context->restore();
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index 64f58c4..3a1a652 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -33,6 +33,8 @@
 
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
+#include "RenderTheme.h"
+#include "RenderThemeChromiumLinux.h"
 #include "Scrollbar.h"
 #include "TransformationMatrix.h"
 
@@ -73,6 +75,60 @@ static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
     drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
 
+static SkScalar clamp(SkScalar value, SkScalar min, SkScalar max)
+{
+    return std::min(std::max(value, min), max);
+}
+
+static SkColor saturateAndBrighten(SkScalar* hsv,
+                                   SkScalar saturateAmount,
+                                   SkScalar brightenAmount)
+{
+    SkScalar color[3];
+    color[0] = hsv[0];
+    color[1] = clamp(hsv[1] + saturateAmount, 0.0, 1.0);
+    color[2] = clamp(hsv[2] + brightenAmount, 0.0, 1.0);
+    return SkHSVToColor(color);
+}
+
+static SkColor outlineColor(SkScalar* hsv1, SkScalar* hsv2)
+{
+    // GTK Theme engines have way too much control over the layout of
+    // the scrollbar. We might be able to more closely approximate its
+    // look-and-feel, if we sent whole images instead of just colors
+    // from the browser to the renderer. But even then, some themes
+    // would just break.
+    //
+    // So, instead, we don't even try to 100% replicate the look of
+    // the native scrollbar. We render our own version, but we make
+    // sure to pick colors that blend in nicely with the system GTK
+    // theme. In most cases, we can just sample a couple of pixels
+    // from the system scrollbar and use those colors to draw our
+    // scrollbar.
+    //
+    // This works fine for the track color and the overall thumb
+    // color. But it fails spectacularly for the outline color used
+    // around the thumb piece.  Not all themes have a clearly defined
+    // outline. For some of them it is partially transparent, and for
+    // others the thickness is very unpredictable.
+    //
+    // So, instead of trying to approximate the system theme, we
+    // instead try to compute a reasonable looking choice based on the
+    // known color of the track and the thumb piece. This is difficult
+    // when trying to deal both with high- and low-contrast themes,
+    // and both with positive and inverted themes.
+    //
+    // The following code has been tested to look OK with all of the
+    // default GTK themes.
+    SkScalar minDiff = clamp((hsv1[1] + hsv2[1]) * 1.2, 0.2, 0.5);
+    SkScalar diff = clamp(fabs(hsv1[2] - hsv2[2]) / 2, minDiff, 0.5);
+
+    if (hsv1[2] + hsv2[2] > 1.0)
+        diff = -diff;
+
+    return saturateAndBrighten(hsv2, -0.2, diff);
+}
+
 IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
@@ -89,10 +145,16 @@ void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar
     SkIRect skrect;
 
     skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-    paint.setARGB(0xff, 0xe3, 0xdd, 0xd8);
+    SkScalar track_hsv[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), track_hsv);
+    paint.setColor(saturateAndBrighten(track_hsv, 0, 0));
     canvas->drawIRect(skrect, paint);
 
-    paint.setARGB(0xff, 0xc5, 0xba, 0xb0);
+    SkScalar thumb_hsv[3];
+    SkColorToHSV(RenderThemeChromiumLinux::thumbInactiveColor(),
+                 thumb_hsv);
+
+    paint.setColor(outlineColor(track_hsv, thumb_hsv));
     drawBox(canvas, rect, paint);
 }
 
@@ -109,11 +171,14 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
     const bool vertical = scrollbar->orientation() == VerticalScrollbar;
     SkCanvas* const canvas = gc->platformContext()->canvas();
 
+    SkScalar thumb[3];
+    SkColorToHSV(hovered
+                 ? RenderThemeChromiumLinux::thumbActiveColor()
+                 : RenderThemeChromiumLinux::thumbInactiveColor(),
+                 thumb);
+
     SkPaint paint;
-    if (hovered)
-        paint.setARGB(0xff, 0xff, 0xff, 0xff);
-    else
-        paint.setARGB(0xff, 0xf4, 0xf2, 0xef);
+    paint.setColor(saturateAndBrighten(thumb, 0, 0.02));
 
     SkIRect skrect;
     if (vertical)
@@ -123,10 +188,7 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
 
     canvas->drawIRect(skrect, paint);
 
-    if (hovered)
-        paint.setARGB(0xff, 0xf4, 0xf2, 0xef);
-    else
-        paint.setARGB(0xff, 0xea, 0xe5, 0xe0);
+    paint.setColor(saturateAndBrighten(thumb, 0, -0.02));
 
     if (vertical)
         skrect.set(midx + 1, rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
@@ -135,11 +197,12 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
 
     canvas->drawIRect(skrect, paint);
 
-    paint.setARGB(0xff, 0x9d, 0x96, 0x8e);
+    SkScalar track[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), track);
+    paint.setColor(outlineColor(track, thumb));
     drawBox(canvas, rect, paint);
 
     if (rect.height() > 10 && rect.width() > 10) {
-        paint.setARGB(0xff, 0x9d, 0x96, 0x8e);
         const int grippyHalfWidth = 2;
         const int interGrippyOffset = 3;
         if (vertical) {
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
new file mode 100644
index 0000000..1ab2f18
--- /dev/null
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollbarThemeChromiumMac_h
+#define ScrollbarThemeChromiumMac_h
+
+#include "ScrollbarThemeComposite.h"
+
+// This file (and its associated .mm file) is a clone of ScrollbarThemeMac.h.
+// See the .mm file for details.
+
+namespace WebCore {
+
+class ScrollbarThemeChromiumMac : public ScrollbarThemeComposite {
+public:
+    ScrollbarThemeChromiumMac();
+    virtual ~ScrollbarThemeChromiumMac();
+
+    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+
+    virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+
+    virtual bool supportsControlTints() const { return true; }
+
+    virtual double initialAutoscrollTimerDelay();
+    virtual double autoscrollTimerDelay();
+
+    virtual ScrollbarButtonsPlacement buttonsPlacement() const;
+
+    virtual void registerScrollbar(Scrollbar*);
+    virtual void unregisterScrollbar(Scrollbar*);
+
+protected:
+    virtual bool hasButtons(Scrollbar*);
+    virtual bool hasThumb(Scrollbar*);
+
+    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+
+    virtual int minimumThumbLength(Scrollbar*);
+
+    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+
+public:
+    void preferencesChanged();
+};
+
+}
+
+#endif // ScrollbarThemeChromiumMac_h
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
new file mode 100644
index 0000000..b4ebaf6
--- /dev/null
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -0,0 +1,463 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScrollbarThemeChromiumMac.h"
+
+#include "ImageBuffer.h"
+#include "PlatformMouseEvent.h"
+#include "ScrollView.h"
+#include <Carbon/Carbon.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+// FIXME: There are repainting problems due to Aqua scroll bar buttons' visual overflow.
+
+using namespace std;
+using namespace WebCore;
+
+// This file (and its associated .h file) is a clone of ScrollbarThemeMac.mm.
+// Because we want to draw tickmarks in the scrollbar, we must maintain a fork.
+// Please maintain this file by performing parallel changes to it.
+//
+// The only changes from ScrollbarThemeMac should be:
+// - The classname change from ScrollbarThemeMac to ScrollbarThemeChromiumMac.
+// - In paint() the code to paint the track, tickmarks, and thumb separately.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
+static HashSet<Scrollbar*>* gScrollbars;
+
+@interface ScrollbarPrefsObserver : NSObject
+{
+
+}
+
++ (void)registerAsObserver;
++ (void)appearancePrefsChanged:(NSNotification*)theNotification;
++ (void)behaviorPrefsChanged:(NSNotification*)theNotification;
+
+@end
+
+@implementation ScrollbarPrefsObserver
+
++ (void)appearancePrefsChanged:(NSNotification*)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+
+    static_cast<ScrollbarThemeChromiumMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
+    if (!gScrollbars)
+        return;
+    HashSet<Scrollbar*>::iterator end = gScrollbars->end();
+    for (HashSet<Scrollbar*>::iterator it = gScrollbars->begin(); it != end; ++it) {
+        (*it)->styleChanged();
+        (*it)->invalidate();
+    }
+}
+
++ (void)behaviorPrefsChanged:(NSNotification*)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+
+    static_cast<ScrollbarThemeChromiumMac*>(ScrollbarTheme::nativeTheme())->preferencesChanged();
+}
+
++ (void)registerAsObserver
+{
+    [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(appearancePrefsChanged:) name:@"AppleAquaScrollBarVariantChanged" object:nil suspensionBehavior:NSNotificationSuspensionBehaviorDeliverImmediately];
+    [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(behaviorPrefsChanged:) name:@"AppleNoRedisplayAppearancePreferenceChanged" object:nil suspensionBehavior:NSNotificationSuspensionBehaviorCoalesce];
+}
+
+@end
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    DEFINE_STATIC_LOCAL(ScrollbarThemeChromiumMac, theme, ());
+    return &theme;
+}
+
+// FIXME: Get these numbers from CoreUI.
+static int cScrollbarThickness[] = { 15, 11 };
+static int cRealButtonLength[] = { 28, 21 };
+static int cButtonInset[] = { 14, 11 };
+static int cButtonHitInset[] = { 3, 2 };
+// cRealButtonLength - cButtonInset
+static int cButtonLength[] = { 14, 10 };
+static int cThumbMinLength[] = { 26, 20 };
+
+static int cOuterButtonLength[] = { 16, 14 }; // The outer button in a double button pair is a bit bigger.
+static int cOuterButtonOverlap = 2;
+
+static float gInitialButtonDelay = 0.5f;
+static float gAutoscrollButtonDelay = 0.05f;
+static bool gJumpOnTrackClick = false;
+static ScrollbarButtonsPlacement gButtonPlacement = ScrollbarButtonsDoubleEnd;
+
+static void updateArrowPlacement()
+{
+    NSString *buttonPlacement = [[NSUserDefaults standardUserDefaults] objectForKey:@"AppleScrollBarVariant"];
+    if ([buttonPlacement isEqualToString:@"Single"])
+        gButtonPlacement = ScrollbarButtonsSingle;
+    else if ([buttonPlacement isEqualToString:@"DoubleMin"])
+        gButtonPlacement = ScrollbarButtonsDoubleStart;
+    else if ([buttonPlacement isEqualToString:@"DoubleBoth"])
+        gButtonPlacement = ScrollbarButtonsDoubleBoth;
+    else
+        gButtonPlacement = ScrollbarButtonsDoubleEnd; // The default is ScrollbarButtonsDoubleEnd.
+}
+
+void ScrollbarThemeChromiumMac::registerScrollbar(Scrollbar* scrollbar)
+{
+    if (!gScrollbars)
+        gScrollbars = new HashSet<Scrollbar*>;
+    gScrollbars->add(scrollbar);
+}
+
+void ScrollbarThemeChromiumMac::unregisterScrollbar(Scrollbar* scrollbar)
+{
+    gScrollbars->remove(scrollbar);
+    if (gScrollbars->isEmpty()) {
+        delete gScrollbars;
+        gScrollbars = 0;
+    }
+}
+
+ScrollbarThemeChromiumMac::ScrollbarThemeChromiumMac()
+{
+    static bool initialized;
+    if (!initialized) {
+        initialized = true;
+        [ScrollbarPrefsObserver registerAsObserver];
+        preferencesChanged();
+    }
+}
+
+ScrollbarThemeChromiumMac::~ScrollbarThemeChromiumMac()
+{
+}
+
+void ScrollbarThemeChromiumMac::preferencesChanged()
+{
+    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
+    [defaults synchronize];
+    updateArrowPlacement();
+    gInitialButtonDelay = [defaults floatForKey:@"NSScrollerButtonDelay"];
+    gAutoscrollButtonDelay = [defaults floatForKey:@"NSScrollerButtonPeriod"];
+    gJumpOnTrackClick = [defaults boolForKey:@"AppleScrollerPagingBehavior"];
+}
+
+int ScrollbarThemeChromiumMac::scrollbarThickness(ScrollbarControlSize controlSize)
+{
+    return cScrollbarThickness[controlSize];
+}
+
+double ScrollbarThemeChromiumMac::initialAutoscrollTimerDelay()
+{
+    return gInitialButtonDelay;
+}
+
+double ScrollbarThemeChromiumMac::autoscrollTimerDelay()
+{
+    return gAutoscrollButtonDelay;
+}
+
+ScrollbarButtonsPlacement ScrollbarThemeChromiumMac::buttonsPlacement() const
+{
+    return gButtonPlacement;
+}
+
+bool ScrollbarThemeChromiumMac::hasButtons(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ?
+             scrollbar->width() :
+             scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
+}
+
+bool ScrollbarThemeChromiumMac::hasThumb(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ?
+             scrollbar->width() :
+             scrollbar->height()) >= 2 * cButtonInset[scrollbar->controlSize()] + cThumbMinLength[scrollbar->controlSize()] + 1;
+}
+
+static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation orientation, ScrollbarControlSize controlSize, bool start)
+{
+    IntRect paintRect(buttonRect);
+    if (orientation == HorizontalScrollbar) {
+        paintRect.setWidth(cRealButtonLength[controlSize]);
+        if (!start)
+            paintRect.setX(buttonRect.x() - (cRealButtonLength[controlSize] - buttonRect.width()));
+    } else {
+        paintRect.setHeight(cRealButtonLength[controlSize]);
+        if (!start)
+            paintRect.setY(buttonRect.y() - (cRealButtonLength[controlSize] - buttonRect.height()));
+    }
+
+    return paintRect;
+}
+
+IntRect ScrollbarThemeChromiumMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+{
+    IntRect result;
+
+    if (part == BackButtonStartPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleEnd))
+        return result;
+
+    if (part == BackButtonEndPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleStart || buttonsPlacement() == ScrollbarButtonsSingle))
+        return result;
+
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    bool outerButton = part == BackButtonStartPart && (buttonsPlacement() == ScrollbarButtonsDoubleStart || buttonsPlacement() == ScrollbarButtonsDoubleBoth);
+    if (outerButton) {
+        if (scrollbar->orientation() == HorizontalScrollbar)
+            result = IntRect(scrollbar->x(), scrollbar->y(), cOuterButtonLength[scrollbar->controlSize()] + painting ? cOuterButtonOverlap : 0, thickness);
+        else
+            result = IntRect(scrollbar->x(), scrollbar->y(), thickness, cOuterButtonLength[scrollbar->controlSize()] + painting ? cOuterButtonOverlap : 0);
+        return result;
+    }
+
+    // Our repaint rect is slightly larger, since we are a button that is adjacent to the track.
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int start = part == BackButtonStartPart ? scrollbar->x() : scrollbar->x() + scrollbar->width() - cOuterButtonLength[scrollbar->controlSize()] - cButtonLength[scrollbar->controlSize()];
+        result = IntRect(start, scrollbar->y(), cButtonLength[scrollbar->controlSize()], thickness);
+    } else {
+        int start = part == BackButtonStartPart ? scrollbar->y() : scrollbar->y() + scrollbar->height() - cOuterButtonLength[scrollbar->controlSize()] - cButtonLength[scrollbar->controlSize()];
+        result = IntRect(scrollbar->x(), start, thickness, cButtonLength[scrollbar->controlSize()]);
+    }
+
+    if (painting)
+        return buttonRepaintRect(result, scrollbar->orientation(), scrollbar->controlSize(), part == BackButtonStartPart);
+    return result;
+}
+
+IntRect ScrollbarThemeChromiumMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+{
+    IntRect result;
+
+    if (part == ForwardButtonEndPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleStart))
+        return result;
+
+    if (part == ForwardButtonStartPart && (buttonsPlacement() == ScrollbarButtonsNone || buttonsPlacement() == ScrollbarButtonsDoubleEnd || buttonsPlacement() == ScrollbarButtonsSingle))
+        return result;
+
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    int outerButtonLength = cOuterButtonLength[scrollbar->controlSize()];
+    int buttonLength = cButtonLength[scrollbar->controlSize()];
+
+    bool outerButton = part == ForwardButtonEndPart && (buttonsPlacement() == ScrollbarButtonsDoubleEnd || buttonsPlacement() == ScrollbarButtonsDoubleBoth);
+    if (outerButton) {
+        if (scrollbar->orientation() == HorizontalScrollbar) {
+            result = IntRect(scrollbar->x() + scrollbar->width() - outerButtonLength, scrollbar->y(), outerButtonLength, thickness);
+            if (painting)
+                result.inflateX(cOuterButtonOverlap);
+        } else {
+            result = IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - outerButtonLength, thickness, outerButtonLength);
+            if (painting)
+                result.inflateY(cOuterButtonOverlap);
+        }
+        return result;
+    }
+
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int start = part == ForwardButtonEndPart ? scrollbar->x() + scrollbar->width() - buttonLength : scrollbar->x() + outerButtonLength;
+        result = IntRect(start, scrollbar->y(), buttonLength, thickness);
+    } else {
+        int start = part == ForwardButtonEndPart ? scrollbar->y() + scrollbar->height() - buttonLength : scrollbar->y() + outerButtonLength;
+        result = IntRect(scrollbar->x(), start, thickness, buttonLength);
+    }
+    if (painting)
+        return buttonRepaintRect(result, scrollbar->orientation(), scrollbar->controlSize(), part == ForwardButtonStartPart);
+    return result;
+}
+
+IntRect ScrollbarThemeChromiumMac::trackRect(Scrollbar* scrollbar, bool painting)
+{
+    if (painting || !hasButtons(scrollbar))
+        return scrollbar->frameRect();
+
+    IntRect result;
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    int startWidth = 0;
+    int endWidth = 0;
+    int outerButtonLength = cOuterButtonLength[scrollbar->controlSize()];
+    int buttonLength = cButtonLength[scrollbar->controlSize()];
+    int doubleButtonLength = outerButtonLength + buttonLength;
+    switch (buttonsPlacement()) {
+        case ScrollbarButtonsSingle:
+            startWidth = buttonLength;
+            endWidth = buttonLength;
+            break;
+        case ScrollbarButtonsDoubleStart:
+            startWidth = doubleButtonLength;
+            break;
+        case ScrollbarButtonsDoubleEnd:
+            endWidth = doubleButtonLength;
+            break;
+        case ScrollbarButtonsDoubleBoth:
+            startWidth = doubleButtonLength;
+            endWidth = doubleButtonLength;
+            break;
+        default:
+            break;
+    }
+
+    int totalWidth = startWidth + endWidth;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        return IntRect(scrollbar->x() + startWidth, scrollbar->y(), scrollbar->width() - totalWidth, thickness);
+    return IntRect(scrollbar->x(), scrollbar->y() + startWidth, thickness, scrollbar->height() - totalWidth);
+}
+
+int ScrollbarThemeChromiumMac::minimumThumbLength(Scrollbar* scrollbar)
+{
+    return cThumbMinLength[scrollbar->controlSize()];
+}
+
+bool ScrollbarThemeChromiumMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+{
+    if (evt.button() != LeftButton)
+        return false;
+    if (gJumpOnTrackClick)
+        return !evt.altKey();
+    return evt.altKey();
+}
+
+static int scrollbarPartToHIPressedState(ScrollbarPart part)
+{
+    switch (part) {
+        case BackButtonStartPart:
+            return kThemeTopOutsideArrowPressed;
+        case BackButtonEndPart:
+            return kThemeTopOutsideArrowPressed; // This does not make much sense.  For some reason the outside constant is required.
+        case ForwardButtonStartPart:
+            return kThemeTopInsideArrowPressed;
+        case ForwardButtonEndPart:
+            return kThemeBottomOutsideArrowPressed;
+        case ThumbPart:
+            return kThemeThumbPressed;
+        default:
+            return 0;
+    }
+}
+
+bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+{
+    HIThemeTrackDrawInfo trackInfo;
+    trackInfo.version = 0;
+    trackInfo.kind = scrollbar->controlSize() == RegularScrollbar ? kThemeMediumScrollBar : kThemeSmallScrollBar;
+    trackInfo.bounds = scrollbar->frameRect();
+    trackInfo.min = 0;
+    trackInfo.max = scrollbar->maximum();
+    trackInfo.value = scrollbar->currentPos();
+    trackInfo.trackInfo.scrollbar.viewsize = scrollbar->pageStep();
+    trackInfo.attributes = 0;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        trackInfo.attributes |= kThemeTrackHorizontal;
+
+    if (!scrollbar->enabled())
+        trackInfo.enableState = kThemeTrackDisabled;
+    else
+        trackInfo.enableState = scrollbar->client()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+
+    if (!hasButtons(scrollbar))
+        trackInfo.enableState = kThemeTrackNothingToScroll;
+    trackInfo.trackInfo.scrollbar.pressState = scrollbarPartToHIPressedState(scrollbar->pressedPart());
+
+    CGAffineTransform currentCTM = CGContextGetCTM(context->platformContext());
+
+    // The Aqua scrollbar is buggy when rotated and scaled.  We will just draw into a bitmap if we detect a scale or rotation.
+    bool canDrawDirectly = currentCTM.a == 1.0f && currentCTM.b == 0.0f && currentCTM.c == 0.0f && (currentCTM.d == 1.0f || currentCTM.d == -1.0f);
+    GraphicsContext* drawingContext = context;
+    OwnPtr<ImageBuffer> imageBuffer;
+    if (!canDrawDirectly) {
+        trackInfo.bounds = IntRect(IntPoint(), scrollbar->frameRect().size());
+
+        IntRect bufferRect(scrollbar->frameRect());
+        bufferRect.intersect(damageRect);
+        bufferRect.move(-scrollbar->frameRect().x(), -scrollbar->frameRect().y());
+
+        imageBuffer = ImageBuffer::create(bufferRect.size());
+        if (!imageBuffer)
+            return true;
+
+        drawingContext = imageBuffer->context();
+    }
+
+    // Draw thumbless.
+    HIThemeDrawTrack(&trackInfo, 0, drawingContext->platformContext(), kHIThemeOrientationNormal);
+
+    Vector<IntRect> tickmarks;
+    scrollbar->client()->getTickmarks(tickmarks);
+    if (scrollbar->orientation() == VerticalScrollbar && tickmarks.size()) {
+        drawingContext->save();
+        drawingContext->setShouldAntialias(false);
+        drawingContext->setStrokeColor(Color(0xCC, 0xAA, 0x00, 0xFF), DeviceColorSpace);
+        drawingContext->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), DeviceColorSpace);
+
+        IntRect thumbArea = trackRect(scrollbar, false);
+        if (!canDrawDirectly) {
+            thumbArea.setX(0);
+            thumbArea.setY(0);
+        }
+        // The ends are rounded and the thumb doesn't go there.
+        thumbArea.inflateY(-thumbArea.width());
+
+        for (Vector<IntRect>::const_iterator i = tickmarks.begin(); i != tickmarks.end(); ++i) {
+            // Calculate how far down (in %) the tick-mark should appear.
+            const float percent = static_cast<float>(i->y()) / scrollbar->totalSize();
+            if (percent < 0.0 || percent > 1.0)
+              continue;
+
+            // Calculate how far down (in pixels) the tick-mark should appear.
+            const int yPos = static_cast<int>((thumbArea.topLeft().y() + (thumbArea.height() * percent))) & ~1;
+
+            // Paint.
+            const int indent = 2;
+            FloatRect tickRect(thumbArea.topLeft().x() + indent, yPos, thumbArea.width() - 2 * indent - 1, 2);
+            drawingContext->fillRect(tickRect);
+            drawingContext->strokeRect(tickRect, 1);
+        }
+
+        drawingContext->restore();
+    }
+
+    if (hasThumb(scrollbar)) {
+        trackInfo.attributes |= (kThemeTrackShowThumb | kThemeTrackHideTrack);
+        HIThemeDrawTrack(&trackInfo, 0, drawingContext->platformContext(), kHIThemeOrientationNormal);
+    }
+
+    if (!canDrawDirectly) {
+        context->drawImage(imageBuffer->image(), DeviceColorSpace, scrollbar->frameRect().location());
+    }
+
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/graphics/BitmapImage.h b/WebCore/platform/graphics/BitmapImage.h
index 13641d2..a07daf2 100644
--- a/WebCore/platform/graphics/BitmapImage.h
+++ b/WebCore/platform/graphics/BitmapImage.h
@@ -140,8 +140,10 @@ public:
     virtual CGImageRef getCGImageRef();
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || (PLATFORM(QT) && PLATFORM(WIN_OS))
     static PassRefPtr<BitmapImage> create(HBITMAP);
+#endif
+#if PLATFORM(WIN)
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
@@ -167,13 +169,13 @@ protected:
     BitmapImage(ImageObserver* = 0);
 
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator);
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
 #if PLATFORM(WX) || (PLATFORM(WINCE) && !PLATFORM(QT))
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 #endif
 
 #if PLATFORM(HAIKU)
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 8e51b95..c348166 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -26,6 +26,7 @@
 #ifndef Color_h
 #define Color_h
 
+#include <wtf/FastAllocBase.h>
 #include <wtf/Platform.h>
 
 #if PLATFORM(CG)
@@ -68,7 +69,7 @@ RGBA32 makeRGBAFromCMYKA(float c, float m, float y, float k, float a);
 
 int differenceSquared(const Color&, const Color&);
 
-class Color {
+class Color : public FastAllocBase {
 public:
     Color() : m_color(0), m_valid(false) { }
     Color(RGBA32 col) : m_color(col), m_valid(true) { }
diff --git a/WebCore/platform/graphics/ColorSpace.h b/WebCore/platform/graphics/ColorSpace.h
new file mode 100644
index 0000000..1bad58c
--- /dev/null
+++ b/WebCore/platform/graphics/ColorSpace.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ColorSpace_h
+#define ColorSpace_h
+
+namespace WebCore {
+
+    enum ColorSpace { DeviceColorSpace, sRGBColorSpace };
+    
+} // namespace WebCore
+
+#endif // ColorSpace_h
diff --git a/WebCore/platform/graphics/FloatRect.cpp b/WebCore/platform/graphics/FloatRect.cpp
index 532f719..7a54f21 100644
--- a/WebCore/platform/graphics/FloatRect.cpp
+++ b/WebCore/platform/graphics/FloatRect.cpp
@@ -102,12 +102,12 @@ void FloatRect::unite(const FloatRect& other)
     m_size.setHeight(b - t);
 }
 
-void FloatRect::scale(float s)
+void FloatRect::scale(float sx, float sy)
 {
-    m_location.setX(x() * s);
-    m_location.setY(y() * s);
-    m_size.setWidth(width() * s);
-    m_size.setHeight(height() * s);
+    m_location.setX(x() * sx);
+    m_location.setY(y() * sy);
+    m_size.setWidth(width() * sx);
+    m_size.setHeight(height() * sy);
 }
 
 IntRect enclosingIntRect(const FloatRect& rect)
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index 50cb095..4b4694f 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -120,7 +120,8 @@ public:
         m_size.setHeight(m_size.height() + dy + dy);
     }
     void inflate(float d) { inflateX(d); inflateY(d); }
-    void scale(float s);
+    void scale(float s) { scale(s, s); }
+    void scale(float sx, float sy);
 
 #if PLATFORM(CG)
     FloatRect(const CGRect&);
diff --git a/WebCore/platform/graphics/FontCache.h b/WebCore/platform/graphics/FontCache.h
index b88305f..4a6222b 100644
--- a/WebCore/platform/graphics/FontCache.h
+++ b/WebCore/platform/graphics/FontCache.h
@@ -50,7 +50,7 @@ class FontDescription;
 class FontSelector;
 class SimpleFontData;
 
-class FontCache {
+class FontCache : public Noncopyable {
 public:
     friend FontCache* fontCache();
 
diff --git a/WebCore/platform/graphics/GeneratedImage.cpp b/WebCore/platform/graphics/GeneratedImage.cpp
index bac9da0..eec7ffb 100644
--- a/WebCore/platform/graphics/GeneratedImage.cpp
+++ b/WebCore/platform/graphics/GeneratedImage.cpp
@@ -34,7 +34,7 @@ using namespace std;
 
 namespace WebCore {
 
-void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     context->save();
     context->setCompositeOperation(compositeOp);
@@ -48,7 +48,7 @@ void GeneratedImage::draw(GraphicsContext* context, const FloatRect& dstRect, co
 }
 
 void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                                 const FloatPoint& phase, CompositeOperator compositeOp, const FloatRect& destRect)
+                                 const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator compositeOp, const FloatRect& destRect)
 {
     // Create a BitmapImage and call drawPattern on it.
     OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size);
@@ -62,7 +62,7 @@ void GeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcR
     Image* bitmap = imageBuffer->image();
     
     // Now just call drawTiled on that image.
-    bitmap->drawPattern(context, srcRect, patternTransform, phase, compositeOp, destRect);
+    bitmap->drawPattern(context, srcRect, patternTransform, phase, styleColorSpace, compositeOp, destRect);
 }
 
 }
diff --git a/WebCore/platform/graphics/GeneratedImage.h b/WebCore/platform/graphics/GeneratedImage.h
index dea0c54..a4583e3 100644
--- a/WebCore/platform/graphics/GeneratedImage.h
+++ b/WebCore/platform/graphics/GeneratedImage.h
@@ -57,9 +57,9 @@ public:
     virtual unsigned decodedSize() const { return 0; }
 
 protected:
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
     
     GeneratedImage(PassRefPtr<Generator> generator, const IntSize& size)
         : m_generator(generator)
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index ccdce08..fee05ee 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -120,24 +120,21 @@ void GraphicsContext::setStrokeStyle(const StrokeStyle& style)
     setPlatformStrokeStyle(style);
 }
 
-void GraphicsContext::setStrokeColor(const Color& color)
+void GraphicsContext::setStrokeColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.strokeColorSpace = SolidColorSpace;
     m_common->state.strokeColor = color;
-    setPlatformStrokeColor(color);
+    m_common->state.strokeColorSpace = colorSpace;
+    m_common->state.strokeGradient.clear();
+    m_common->state.strokePattern.clear();
+    setPlatformStrokeColor(color, colorSpace);
 }
 
-ColorSpace GraphicsContext::strokeColorSpace() const
-{
-    return m_common->state.strokeColorSpace;
-}
-
-void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color)
+void GraphicsContext::setShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
 {
     m_common->state.shadowSize = size;
     m_common->state.shadowBlur = blur;
     m_common->state.shadowColor = color;
-    setPlatformShadow(size, blur, color);
+    setPlatformShadow(size, blur, color, colorSpace);
 }
 
 void GraphicsContext::clearShadow()
@@ -172,6 +169,11 @@ Color GraphicsContext::strokeColor() const
     return m_common->state.strokeColor;
 }
 
+ColorSpace GraphicsContext::strokeColorSpace() const
+{
+    return m_common->state.strokeColorSpace;
+}
+
 WindRule GraphicsContext::fillRule() const
 {
     return m_common->state.fillRule;
@@ -182,11 +184,13 @@ void GraphicsContext::setFillRule(WindRule fillRule)
     m_common->state.fillRule = fillRule;
 }
 
-void GraphicsContext::setFillColor(const Color& color)
+void GraphicsContext::setFillColor(const Color& color, ColorSpace colorSpace)
 {
-    m_common->state.fillColorSpace = SolidColorSpace;
     m_common->state.fillColor = color;
-    setPlatformFillColor(color);
+    m_common->state.fillColorSpace = colorSpace;
+    m_common->state.fillGradient.clear();
+    m_common->state.fillPattern.clear();
+    setPlatformFillColor(color, colorSpace);
 }
 
 Color GraphicsContext::fillColor() const
@@ -194,6 +198,11 @@ Color GraphicsContext::fillColor() const
     return m_common->state.fillColor;
 }
 
+ColorSpace GraphicsContext::fillColorSpace() const
+{
+    return m_common->state.fillColorSpace;
+}
+
 void GraphicsContext::setShouldAntialias(bool b)
 {
     m_common->state.shouldAntialias = b;
@@ -209,10 +218,10 @@ void GraphicsContext::setStrokePattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = PatternColorSpace;
+    m_common->state.strokeGradient.clear();
     m_common->state.strokePattern = pattern;
     setPlatformStrokePattern(m_common->state.strokePattern.get());
 }
@@ -221,10 +230,10 @@ void GraphicsContext::setFillPattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = PatternColorSpace;
+    m_common->state.fillGradient.clear();
     m_common->state.fillPattern = pattern;
     setPlatformFillPattern(m_common->state.fillPattern.get());
 }
@@ -233,11 +242,11 @@ void GraphicsContext::setStrokeGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setStrokeColor(Color::black);
+        setStrokeColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.strokeColorSpace = GradientColorSpace;
     m_common->state.strokeGradient = gradient;
+    m_common->state.strokePattern.clear();
     setPlatformStrokeGradient(m_common->state.strokeGradient.get());
 }
 
@@ -245,11 +254,11 @@ void GraphicsContext::setFillGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setFillColor(Color::black);
+        setFillColor(Color::black, DeviceColorSpace);
         return;
     }
-    m_common->state.fillColorSpace = GradientColorSpace;
     m_common->state.fillGradient = gradient;
+    m_common->state.fillPattern.clear();
     setPlatformFillGradient(m_common->state.fillGradient.get());
 }
 
@@ -258,11 +267,6 @@ Gradient* GraphicsContext::fillGradient() const
     return m_common->state.fillGradient.get();
 }
 
-ColorSpace GraphicsContext::fillColorSpace() const
-{
-    return m_common->state.fillColorSpace;
-}
-
 Gradient* GraphicsContext::strokeGradient() const
 {
     return m_common->state.strokeGradient.get();
@@ -304,24 +308,24 @@ bool GraphicsContext::paintingDisabled() const
     return m_common->state.paintingDisabled;
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& p, CompositeOperator op)
 {
-    drawImage(image, p, IntRect(0, 0, -1, -1), op);
+    drawImage(image, styleColorSpace, p, IntRect(0, 0, -1, -1), op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& r, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
+    drawImage(image, styleColorSpace, r, IntRect(0, 0, -1, -1), op, useLowQualityScale);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntPoint& dest, const IntRect& srcRect, CompositeOperator op)
 {
-    drawImage(image, IntRect(dest, srcRect.size()), srcRect, op);
+    drawImage(image, styleColorSpace, IntRect(dest, srcRect.size()), srcRect, op);
 }
 
-void GraphicsContext::drawImage(Image* image, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, CompositeOperator op, bool useLowQualityScale)
 {
-    drawImage(image, FloatRect(dest), srcRect, op, useLowQualityScale);
+    drawImage(image, styleColorSpace, FloatRect(dest), srcRect, op, useLowQualityScale);
 }
 
 #if !PLATFORM(WINCE) || PLATFORM(QT)
@@ -370,12 +374,12 @@ void GraphicsContext::drawBidiText(const Font& font, const TextRun& run, const F
     bidiResolver.deleteRuns();
 }
 
-void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, int from, int to)
+void GraphicsContext::drawHighlightForText(const Font& font, const TextRun& run, const IntPoint& point, int h, const Color& backgroundColor, ColorSpace colorSpace, int from, int to)
 {
     if (paintingDisabled())
         return;
 
-    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor);
+    fillRect(font.selectionRectForText(run, point, h, from, to), backgroundColor, colorSpace);
 }
 
 void GraphicsContext::initFocusRing(int width, int offset)
@@ -427,7 +431,7 @@ const Vector<IntRect>& GraphicsContext::focusRingRects() const
     return m_common->m_focusRingRects;
 }
 
-void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const FloatRect& dest, const FloatRect& src, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
@@ -451,29 +455,29 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
         save();
         setImageInterpolationQuality(InterpolationNone);
     }
-    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), op);
+    image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), styleColorSpace, op);
     if (useLowQualityScale)
         restore();
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op)
 {
     if (paintingDisabled() || !image)
         return;
 
-    image->drawTiled(this, rect, srcPoint, tileSize, op);
+    image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
 }
 
-void GraphicsContext::drawTiledImage(Image* image, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect, Image::TileRule hRule, Image::TileRule vRule, CompositeOperator op)
 {
     if (paintingDisabled() || !image)
         return;
 
     if (hRule == Image::StretchTile && vRule == Image::StretchTile)
         // Just do a scale.
-        return drawImage(image, dest, srcRect, op);
+        return drawImage(image, styleColorSpace, dest, srcRect, op);
 
-    image->drawTiled(this, dest, srcRect, hRule, vRule, op);
+    image->drawTiled(this, dest, srcRect, hRule, vRule, styleColorSpace, op);
 }
 
 void GraphicsContext::addRoundedRectClip(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight,
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 3ffc211..96a6221 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 #ifndef GraphicsContext_h
 #define GraphicsContext_h
 
+#include "ColorSpace.h"
 #include "DashArray.h"
 #include "FloatRect.h"
 #include "Image.h"
@@ -111,17 +112,17 @@ namespace WebCore {
     const int cMisspellingLinePatternWidth = 4;
     const int cMisspellingLinePatternGapWidth = 1;
 
-    class TransformationMatrix;
     class Font;
     class Generator;
     class Gradient;
-    class GraphicsContextPrivate;
     class GraphicsContextPlatformPrivate;
+    class GraphicsContextPrivate;
     class ImageBuffer;
     class KURL;
     class Path;
     class Pattern;
     class TextRun;
+    class TransformationMatrix;
 
     // These bits can be ORed together for a total of 8 possible text drawing modes.
     const int cTextInvisible = 0;
@@ -136,18 +137,6 @@ namespace WebCore {
         DashedStroke
     };
 
-    // FIXME: This is a place-holder until we decide to add
-    // real color space support to WebCore.  At that time, ColorSpace will be a
-    // class and instances will be held  off of Colors.   There will be
-    // special singleton Gradient and Pattern color spaces to mark when
-    // a fill or stroke is using a gradient or pattern instead of a solid color.
-    // https://bugs.webkit.org/show_bug.cgi?id=20558
-    enum ColorSpace {
-        SolidColorSpace,
-        PatternColorSpace,
-        GradientColorSpace
-    };
-
     enum InterpolationQuality {
         InterpolationDefault,
         InterpolationNone,
@@ -170,9 +159,8 @@ namespace WebCore {
         StrokeStyle strokeStyle() const;
         void setStrokeStyle(const StrokeStyle& style);
         Color strokeColor() const;
-        void setStrokeColor(const Color&);
-
         ColorSpace strokeColorSpace() const;
+        void setStrokeColor(const Color&, ColorSpace);
 
         void setStrokePattern(PassRefPtr<Pattern>);
         Pattern* strokePattern() const;
@@ -183,7 +171,8 @@ namespace WebCore {
         WindRule fillRule() const;
         void setFillRule(WindRule);
         Color fillColor() const;
-        void setFillColor(const Color&);
+        ColorSpace fillColorSpace() const;
+        void setFillColor(const Color&, ColorSpace);
 
         void setFillPattern(PassRefPtr<Pattern>);
         Pattern* fillPattern() const;
@@ -191,8 +180,6 @@ namespace WebCore {
         void setFillGradient(PassRefPtr<Gradient>);
         Gradient* fillGradient() const;
 
-        ColorSpace fillColorSpace() const;
-
         void setShadowsIgnoreTransforms(bool);
 
         void setShouldAntialias(bool);
@@ -250,24 +237,24 @@ namespace WebCore {
         void strokeArc(const IntRect&, int startAngle, int angleSpan);
 
         void fillRect(const FloatRect&);
-        void fillRect(const FloatRect&, const Color&);
+        void fillRect(const FloatRect&, const Color&, ColorSpace);
         void fillRect(const FloatRect&, Generator&);
-        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&);
+        void fillRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color&, ColorSpace);
 
         void clearRect(const FloatRect&);
 
         void strokeRect(const FloatRect&);
         void strokeRect(const FloatRect&, float lineWidth);
 
-        void drawImage(Image*, const IntPoint&, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
-        void drawImage(Image*, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawImage(Image*, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint&, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect&, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntPoint& destPoint, const IntRect& srcRect, CompositeOperator = CompositeSourceOver);
+        void drawImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect, CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
+        void drawImage(Image*, ColorSpace styleColorSpace, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1),
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
                        CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
+        void drawTiledImage(Image*, ColorSpace styleColorSpace, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
                             CompositeOperator = CompositeSourceOver);
 
@@ -288,7 +275,7 @@ namespace WebCore {
 
         void drawText(const Font&, const TextRun&, const IntPoint&, int from = 0, int to = -1);
         void drawBidiText(const Font&, const TextRun&, const FloatPoint&);
-        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
+        void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, ColorSpace, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
 
@@ -304,7 +291,7 @@ namespace WebCore {
         void beginTransparencyLayer(float opacity);
         void endTransparencyLayer();
 
-        void setShadow(const IntSize&, int blur, const Color&);
+        void setShadow(const IntSize&, int blur, const Color&, ColorSpace);
         bool getShadow(IntSize&, int&, Color&) const;
         void clearShadow();
 
@@ -322,6 +309,8 @@ namespace WebCore {
         void setAlpha(float);
 #if PLATFORM(CAIRO)
         float getAlpha();
+        void createPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float kernelSize);
+        static void calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& kernelSize, const FloatRect& sourceRect, const IntSize& shadowSize, int shadowBlur);
 #endif
 
         void setCompositeOperation(CompositeOperator);
@@ -405,12 +394,16 @@ namespace WebCore {
         void drawWindowsBitmap(WindowsBitmap*, const IntPoint&);
 #endif
 
-#if PLATFORM(QT) && defined(Q_WS_WIN)
+#if (PLATFORM(QT) && defined(Q_WS_WIN)) || (PLATFORM(WX) && PLATFORM(WIN_OS))
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         bool shouldIncludeChildWindows() const { return false; }
 #endif
 
+#if PLATFORM(WX)
+        bool inTransparencyLayer() const { return false; }
+#endif
+
 #if PLATFORM(QT)
         bool inTransparencyLayer() const;
         PlatformPath* currentPath();
@@ -434,19 +427,19 @@ namespace WebCore {
         void setPlatformTextDrawingMode(int);
         void setPlatformFont(const Font& font);
 
-        void setPlatformStrokeColor(const Color&);
+        void setPlatformStrokeColor(const Color&, ColorSpace);
         void setPlatformStrokeStyle(const StrokeStyle&);
         void setPlatformStrokeThickness(float);
         void setPlatformStrokeGradient(Gradient*);
         void setPlatformStrokePattern(Pattern*);
 
-        void setPlatformFillColor(const Color&);
+        void setPlatformFillColor(const Color&, ColorSpace);
         void setPlatformFillGradient(Gradient*);
         void setPlatformFillPattern(Pattern*);
 
         void setPlatformShouldAntialias(bool b);
 
-        void setPlatformShadow(const IntSize&, int blur, const Color&);
+        void setPlatformShadow(const IntSize&, int blur, const Color&, ColorSpace);
         void clearPlatformShadow();
 
         static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index 07ec04d..aad8dd4 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -28,9 +28,15 @@
 
 #include "PlatformString.h"
 
+#include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
+// FIXME: Find a better way to avoid the name confliction for NO_ERROR.
+#if PLATFORM(CHROMIUM) && PLATFORM(WIN_OS)
+#undef NO_ERROR
+#endif
+
 #if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
 
@@ -46,20 +52,19 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
-    class CanvasActiveInfo;
-    class CanvasArray;
-    class CanvasBuffer;
-    class CanvasUnsignedByteArray;
-    class CanvasFloatArray;
-    class CanvasFramebuffer;
-    class CanvasIntArray;
-    class CanvasProgram;
-    class CanvasRenderbuffer;
-    class CanvasRenderingContext3D;
-    class CanvasShader;
-    class CanvasTexture;
-    class HTMLCanvasElement;
-    class HTMLImageElement;
+    class WebGLActiveInfo;
+    class WebGLArray;
+    class WebGLBuffer;
+    class WebGLUnsignedByteArray;
+    class WebGLFloatArray;
+    class WebGLFramebuffer;
+    class WebGLIntArray;
+    class WebGLProgram;
+    class WebGLRenderbuffer;
+    class WebGLRenderingContext;
+    class WebGLShader;
+    class WebGLTexture;
+    class Image;
     class HTMLVideoElement;
     class ImageData;
     class WebKitCSSMatrix;
@@ -77,8 +82,309 @@ namespace WebCore {
 
     class GraphicsContext3D : public Noncopyable {
     public:
-        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
-    
+        enum WebGLEnumType {
+            DEPTH_BUFFER_BIT = 0x00000100,
+            STENCIL_BUFFER_BIT = 0x00000400,
+            COLOR_BUFFER_BIT = 0x00004000,
+            POINTS = 0x0000,
+            LINES = 0x0001,
+            LINE_LOOP = 0x0002,
+            LINE_STRIP = 0x0003,
+            TRIANGLES = 0x0004,
+            TRIANGLE_STRIP = 0x0005,
+            TRIANGLE_FAN = 0x0006,
+            ZERO = 0,
+            ONE = 1,
+            SRC_COLOR = 0x0300,
+            ONE_MINUS_SRC_COLOR = 0x0301,
+            SRC_ALPHA = 0x0302,
+            ONE_MINUS_SRC_ALPHA = 0x0303,
+            DST_ALPHA = 0x0304,
+            ONE_MINUS_DST_ALPHA = 0x0305,
+            DST_COLOR = 0x0306,
+            ONE_MINUS_DST_COLOR = 0x0307,
+            SRC_ALPHA_SATURATE = 0x0308,
+            FUNC_ADD = 0x8006,
+            BLEND_EQUATION = 0x8009,
+            BLEND_EQUATION_RGB = 0x8009,
+            BLEND_EQUATION_ALPHA = 0x883D,
+            FUNC_SUBTRACT = 0x800A,
+            FUNC_REVERSE_SUBTRACT = 0x800B,
+            BLEND_DST_RGB = 0x80C8,
+            BLEND_SRC_RGB = 0x80C9,
+            BLEND_DST_ALPHA = 0x80CA,
+            BLEND_SRC_ALPHA = 0x80CB,
+            CONSTANT_COLOR = 0x8001,
+            ONE_MINUS_CONSTANT_COLOR = 0x8002,
+            CONSTANT_ALPHA = 0x8003,
+            ONE_MINUS_CONSTANT_ALPHA = 0x8004,
+            BLEND_COLOR = 0x8005,
+            ARRAY_BUFFER = 0x8892,
+            ELEMENT_ARRAY_BUFFER = 0x8893,
+            ARRAY_BUFFER_BINDING = 0x8894,
+            ELEMENT_ARRAY_BUFFER_BINDING = 0x8895,
+            STREAM_DRAW = 0x88E0,
+            STATIC_DRAW = 0x88E4,
+            DYNAMIC_DRAW = 0x88E8,
+            BUFFER_SIZE = 0x8764,
+            BUFFER_USAGE = 0x8765,
+            CURRENT_VERTEX_ATTRIB = 0x8626,
+            FRONT = 0x0404,
+            BACK = 0x0405,
+            FRONT_AND_BACK = 0x0408,
+            TEXTURE_2D = 0x0DE1,
+            CULL_FACE = 0x0B44,
+            BLEND = 0x0BE2,
+            DITHER = 0x0BD0,
+            STENCIL_TEST = 0x0B90,
+            DEPTH_TEST = 0x0B71,
+            SCISSOR_TEST = 0x0C11,
+            POLYGON_OFFSET_FILL = 0x8037,
+            SAMPLE_ALPHA_TO_COVERAGE = 0x809E,
+            SAMPLE_COVERAGE = 0x80A0,
+            NO_ERROR = 0,
+            INVALID_ENUM = 0x0500,
+            INVALID_VALUE = 0x0501,
+            INVALID_OPERATION = 0x0502,
+            OUT_OF_MEMORY = 0x0505,
+            CW = 0x0900,
+            CCW = 0x0901,
+            LINE_WIDTH = 0x0B21,
+            ALIASED_POINT_SIZE_RANGE = 0x846D,
+            ALIASED_LINE_WIDTH_RANGE = 0x846E,
+            CULL_FACE_MODE = 0x0B45,
+            FRONT_FACE = 0x0B46,
+            DEPTH_RANGE = 0x0B70,
+            DEPTH_WRITEMASK = 0x0B72,
+            DEPTH_CLEAR_VALUE = 0x0B73,
+            DEPTH_FUNC = 0x0B74,
+            STENCIL_CLEAR_VALUE = 0x0B91,
+            STENCIL_FUNC = 0x0B92,
+            STENCIL_FAIL = 0x0B94,
+            STENCIL_PASS_DEPTH_FAIL = 0x0B95,
+            STENCIL_PASS_DEPTH_PASS = 0x0B96,
+            STENCIL_REF = 0x0B97,
+            STENCIL_VALUE_MASK = 0x0B93,
+            STENCIL_WRITEMASK = 0x0B98,
+            STENCIL_BACK_FUNC = 0x8800,
+            STENCIL_BACK_FAIL = 0x8801,
+            STENCIL_BACK_PASS_DEPTH_FAIL = 0x8802,
+            STENCIL_BACK_PASS_DEPTH_PASS = 0x8803,
+            STENCIL_BACK_REF = 0x8CA3,
+            STENCIL_BACK_VALUE_MASK = 0x8CA4,
+            STENCIL_BACK_WRITEMASK = 0x8CA5,
+            VIEWPORT = 0x0BA2,
+            SCISSOR_BOX = 0x0C10,
+            COLOR_CLEAR_VALUE = 0x0C22,
+            COLOR_WRITEMASK = 0x0C23,
+            UNPACK_ALIGNMENT = 0x0CF5,
+            PACK_ALIGNMENT = 0x0D05,
+            MAX_TEXTURE_SIZE = 0x0D33,
+            MAX_VIEWPORT_DIMS = 0x0D3A,
+            SUBPIXEL_BITS = 0x0D50,
+            RED_BITS = 0x0D52,
+            GREEN_BITS = 0x0D53,
+            BLUE_BITS = 0x0D54,
+            ALPHA_BITS = 0x0D55,
+            DEPTH_BITS = 0x0D56,
+            STENCIL_BITS = 0x0D57,
+            POLYGON_OFFSET_UNITS = 0x2A00,
+            POLYGON_OFFSET_FACTOR = 0x8038,
+            TEXTURE_BINDING_2D = 0x8069,
+            SAMPLE_BUFFERS = 0x80A8,
+            SAMPLES = 0x80A9,
+            SAMPLE_COVERAGE_VALUE = 0x80AA,
+            SAMPLE_COVERAGE_INVERT = 0x80AB,
+            NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2,
+            COMPRESSED_TEXTURE_FORMATS = 0x86A3,
+            DONT_CARE = 0x1100,
+            FASTEST = 0x1101,
+            NICEST = 0x1102,
+            GENERATE_MIPMAP_HINT = 0x8192,
+            BYTE = 0x1400,
+            UNSIGNED_BYTE = 0x1401,
+            SHORT = 0x1402,
+            UNSIGNED_SHORT = 0x1403,
+            INT = 0x1404,
+            UNSIGNED_INT = 0x1405,
+            FLOAT = 0x1406,
+            FIXED = 0x140C,
+            DEPTH_COMPONENT = 0x1902,
+            ALPHA = 0x1906,
+            RGB = 0x1907,
+            RGBA = 0x1908,
+            LUMINANCE = 0x1909,
+            LUMINANCE_ALPHA = 0x190A,
+            UNSIGNED_SHORT_4_4_4_4 = 0x8033,
+            UNSIGNED_SHORT_5_5_5_1 = 0x8034,
+            UNSIGNED_SHORT_5_6_5 = 0x8363,
+            FRAGMENT_SHADER = 0x8B30,
+            VERTEX_SHADER = 0x8B31,
+            MAX_VERTEX_ATTRIBS = 0x8869,
+            MAX_VERTEX_UNIFORM_VECTORS = 0x8DFB,
+            MAX_VARYING_VECTORS = 0x8DFC,
+            MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D,
+            MAX_VERTEX_TEXTURE_IMAGE_UNITS = 0x8B4C,
+            MAX_TEXTURE_IMAGE_UNITS = 0x8872,
+            MAX_FRAGMENT_UNIFORM_VECTORS = 0x8DFD,
+            SHADER_TYPE = 0x8B4F,
+            DELETE_STATUS = 0x8B80,
+            LINK_STATUS = 0x8B82,
+            VALIDATE_STATUS = 0x8B83,
+            ATTACHED_SHADERS = 0x8B85,
+            ACTIVE_UNIFORMS = 0x8B86,
+            ACTIVE_UNIFORM_MAX_LENGTH = 0x8B87,
+            ACTIVE_ATTRIBUTES = 0x8B89,
+            ACTIVE_ATTRIBUTE_MAX_LENGTH = 0x8B8A,
+            SHADING_LANGUAGE_VERSION = 0x8B8C,
+            CURRENT_PROGRAM = 0x8B8D,
+            NEVER = 0x0200,
+            LESS = 0x0201,
+            EQUAL = 0x0202,
+            LEQUAL = 0x0203,
+            GREATER = 0x0204,
+            NOTEQUAL = 0x0205,
+            GEQUAL = 0x0206,
+            ALWAYS = 0x0207,
+            KEEP = 0x1E00,
+            REPLACE = 0x1E01,
+            INCR = 0x1E02,
+            DECR = 0x1E03,
+            INVERT = 0x150A,
+            INCR_WRAP = 0x8507,
+            DECR_WRAP = 0x8508,
+            VENDOR = 0x1F00,
+            RENDERER = 0x1F01,
+            VERSION = 0x1F02,
+            EXTENSIONS = 0x1F03,
+            NEAREST = 0x2600,
+            LINEAR = 0x2601,
+            NEAREST_MIPMAP_NEAREST = 0x2700,
+            LINEAR_MIPMAP_NEAREST = 0x2701,
+            NEAREST_MIPMAP_LINEAR = 0x2702,
+            LINEAR_MIPMAP_LINEAR = 0x2703,
+            TEXTURE_MAG_FILTER = 0x2800,
+            TEXTURE_MIN_FILTER = 0x2801,
+            TEXTURE_WRAP_S = 0x2802,
+            TEXTURE_WRAP_T = 0x2803,
+            TEXTURE = 0x1702,
+            TEXTURE_CUBE_MAP = 0x8513,
+            TEXTURE_BINDING_CUBE_MAP = 0x8514,
+            TEXTURE_CUBE_MAP_POSITIVE_X = 0x8515,
+            TEXTURE_CUBE_MAP_NEGATIVE_X = 0x8516,
+            TEXTURE_CUBE_MAP_POSITIVE_Y = 0x8517,
+            TEXTURE_CUBE_MAP_NEGATIVE_Y = 0x8518,
+            TEXTURE_CUBE_MAP_POSITIVE_Z = 0x8519,
+            TEXTURE_CUBE_MAP_NEGATIVE_Z = 0x851A,
+            MAX_CUBE_MAP_TEXTURE_SIZE = 0x851C,
+            TEXTURE0 = 0x84C0,
+            TEXTURE1 = 0x84C1,
+            TEXTURE2 = 0x84C2,
+            TEXTURE3 = 0x84C3,
+            TEXTURE4 = 0x84C4,
+            TEXTURE5 = 0x84C5,
+            TEXTURE6 = 0x84C6,
+            TEXTURE7 = 0x84C7,
+            TEXTURE8 = 0x84C8,
+            TEXTURE9 = 0x84C9,
+            TEXTURE10 = 0x84CA,
+            TEXTURE11 = 0x84CB,
+            TEXTURE12 = 0x84CC,
+            TEXTURE13 = 0x84CD,
+            TEXTURE14 = 0x84CE,
+            TEXTURE15 = 0x84CF,
+            TEXTURE16 = 0x84D0,
+            TEXTURE17 = 0x84D1,
+            TEXTURE18 = 0x84D2,
+            TEXTURE19 = 0x84D3,
+            TEXTURE20 = 0x84D4,
+            TEXTURE21 = 0x84D5,
+            TEXTURE22 = 0x84D6,
+            TEXTURE23 = 0x84D7,
+            TEXTURE24 = 0x84D8,
+            TEXTURE25 = 0x84D9,
+            TEXTURE26 = 0x84DA,
+            TEXTURE27 = 0x84DB,
+            TEXTURE28 = 0x84DC,
+            TEXTURE29 = 0x84DD,
+            TEXTURE30 = 0x84DE,
+            TEXTURE31 = 0x84DF,
+            ACTIVE_TEXTURE = 0x84E0,
+            REPEAT = 0x2901,
+            CLAMP_TO_EDGE = 0x812F,
+            MIRRORED_REPEAT = 0x8370,
+            FLOAT_VEC2 = 0x8B50,
+            FLOAT_VEC3 = 0x8B51,
+            FLOAT_VEC4 = 0x8B52,
+            INT_VEC2 = 0x8B53,
+            INT_VEC3 = 0x8B54,
+            INT_VEC4 = 0x8B55,
+            BOOL = 0x8B56,
+            BOOL_VEC2 = 0x8B57,
+            BOOL_VEC3 = 0x8B58,
+            BOOL_VEC4 = 0x8B59,
+            FLOAT_MAT2 = 0x8B5A,
+            FLOAT_MAT3 = 0x8B5B,
+            FLOAT_MAT4 = 0x8B5C,
+            SAMPLER_2D = 0x8B5E,
+            SAMPLER_CUBE = 0x8B60,
+            VERTEX_ATTRIB_ARRAY_ENABLED = 0x8622,
+            VERTEX_ATTRIB_ARRAY_SIZE = 0x8623,
+            VERTEX_ATTRIB_ARRAY_STRIDE = 0x8624,
+            VERTEX_ATTRIB_ARRAY_TYPE = 0x8625,
+            VERTEX_ATTRIB_ARRAY_NORMALIZED = 0x886A,
+            VERTEX_ATTRIB_ARRAY_POINTER = 0x8645,
+            VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F,
+            IMPLEMENTATION_COLOR_READ_TYPE = 0x8B9A,
+            IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B,
+            COMPILE_STATUS = 0x8B81,
+            INFO_LOG_LENGTH = 0x8B84,
+            SHADER_SOURCE_LENGTH = 0x8B88,
+            SHADER_COMPILER = 0x8DFA,
+            SHADER_BINARY_FORMATS = 0x8DF8,
+            NUM_SHADER_BINARY_FORMATS = 0x8DF9,
+            LOW_FLOAT = 0x8DF0,
+            MEDIUM_FLOAT = 0x8DF1,
+            HIGH_FLOAT = 0x8DF2,
+            LOW_INT = 0x8DF3,
+            MEDIUM_INT = 0x8DF4,
+            HIGH_INT = 0x8DF5,
+            FRAMEBUFFER = 0x8D40,
+            RENDERBUFFER = 0x8D41,
+            RGBA4 = 0x8056,
+            RGB5_A1 = 0x8057,
+            RGB565 = 0x8D62,
+            DEPTH_COMPONENT16 = 0x81A5,
+            STENCIL_INDEX = 0x1901,
+            STENCIL_INDEX8 = 0x8D48,
+            RENDERBUFFER_WIDTH = 0x8D42,
+            RENDERBUFFER_HEIGHT = 0x8D43,
+            RENDERBUFFER_INTERNAL_FORMAT = 0x8D44,
+            RENDERBUFFER_RED_SIZE = 0x8D50,
+            RENDERBUFFER_GREEN_SIZE = 0x8D51,
+            RENDERBUFFER_BLUE_SIZE = 0x8D52,
+            RENDERBUFFER_ALPHA_SIZE = 0x8D53,
+            RENDERBUFFER_DEPTH_SIZE = 0x8D54,
+            RENDERBUFFER_STENCIL_SIZE = 0x8D55,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE = 0x8CD0,
+            FRAMEBUFFER_ATTACHMENT_OBJECT_NAME = 0x8CD1,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL = 0x8CD2,
+            FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3,
+            COLOR_ATTACHMENT0 = 0x8CE0,
+            DEPTH_ATTACHMENT = 0x8D00,
+            STENCIL_ATTACHMENT = 0x8D20,
+            NONE = 0,
+            FRAMEBUFFER_COMPLETE = 0x8CD5,
+            FRAMEBUFFER_INCOMPLETE_ATTACHMENT = 0x8CD6,
+            FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7,
+            FRAMEBUFFER_INCOMPLETE_DIMENSIONS = 0x8CD9,
+            FRAMEBUFFER_UNSUPPORTED = 0x8CDD,
+            FRAMEBUFFER_BINDING = 0x8CA6,
+            RENDERBUFFER_BINDING = 0x8CA7,
+            MAX_RENDERBUFFER_SIZE = 0x84E8,
+            INVALID_FRAMEBUFFER_OPERATION = 0x0506
+        };
+        
         static PassOwnPtr<GraphicsContext3D> create();
         virtual ~GraphicsContext3D();
 
@@ -92,7 +398,6 @@ namespace WebCore {
         PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
         Platform3DObject platformTexture() const { return NullPlatform3DObject; }
 #endif
-        void checkError() const;
         void makeContextCurrent();
         
         // Helper to return the size in bytes of OpenGL data types
@@ -100,12 +405,12 @@ namespace WebCore {
         int sizeInBytes(int type);
 
         void activeTexture(unsigned long texture);
-        void attachShader(CanvasProgram* program, CanvasShader* shader);
-        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
-        void bindBuffer(unsigned long target, CanvasBuffer*);
-        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
-        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
-        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void attachShader(WebGLProgram* program, WebGLShader* shader);
+        void bindAttribLocation(WebGLProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, WebGLBuffer*);
+        void bindFramebuffer(unsigned long target, WebGLFramebuffer*);
+        void bindRenderbuffer(unsigned long target, WebGLRenderbuffer*);
+        void bindTexture(unsigned long target, WebGLTexture* texture);
         void blendColor(double red, double green, double blue, double alpha);
         void blendEquation(unsigned long mode);
         void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
@@ -113,8 +418,8 @@ namespace WebCore {
         void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
 
         void bufferData(unsigned long target, int size, unsigned long usage);
-        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
-        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+        void bufferData(unsigned long target, WebGLArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, WebGLArray* data);
 
         unsigned long checkFramebufferStatus(unsigned long target);
         void clear(unsigned long mask);
@@ -122,7 +427,7 @@ namespace WebCore {
         void clearDepth(double depth);
         void clearStencil(long s);
         void colorMask(bool red, bool green, bool blue, bool alpha);
-        void compileShader(CanvasShader*);
+        void compileShader(WebGLShader*);
         
         //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
         //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
@@ -133,7 +438,7 @@ namespace WebCore {
         void depthFunc(unsigned long func);
         void depthMask(bool flag);
         void depthRange(double zNear, double zFar);
-        void detachShader(CanvasProgram*, CanvasShader*);
+        void detachShader(WebGLProgram*, WebGLShader*);
         void disable(unsigned long cap);
         void disableVertexAttribArray(unsigned long index);
         void drawArrays(unsigned long mode, long first, long count);
@@ -143,84 +448,77 @@ namespace WebCore {
         void enableVertexAttribArray(unsigned long index);
         void finish();
         void flush();
-        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
-        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
-        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
-        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo&);
 
-        int  getAttribLocation(CanvasProgram*, const String& name);
+        int  getAttribLocation(WebGLProgram*, const String& name);
 
-        bool getBoolean(unsigned long pname);
-        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
-        int getBufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+        void getBooleanv(unsigned long pname, unsigned char* value);
+
+        void getBufferParameteriv(unsigned long target, unsigned long pname, int* value);
 
         unsigned long getError();
 
-        float getFloat(unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
-        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
-        int getInteger(unsigned long pname);
-        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
-        int getProgrami(CanvasProgram*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
-        String getProgramInfoLog(CanvasProgram*);
-        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
-        int getShaderi(CanvasShader*, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
-
-        String getShaderInfoLog(CanvasShader*);
+        void getFloatv(unsigned long pname, float* value);
+
+        void getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname, int* value);
+
+        void getIntegerv(unsigned long pname, int* value);
+
+        void getProgramiv(WebGLProgram* program, unsigned long pname, int* value);
+
+        String getProgramInfoLog(WebGLProgram*);
+
+        void getRenderbufferParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getShaderiv(WebGLShader*, unsigned long pname, int* value);
+
+        String getShaderInfoLog(WebGLShader*);
 
         // TBD
         // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
 
-        String getShaderSource(CanvasShader*);
+        String getShaderSource(WebGLShader*);
         String getString(unsigned long name);
-        
-        float getTexParameterf(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
-        int getTexParameteri(unsigned long target, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
-
-        float getUniformf(CanvasProgram* program, long location);
-        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
-        int getUniformi(CanvasProgram* program, long location);
-        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
-
-        long getUniformLocation(CanvasProgram*, const String& name);
-
-        float getVertexAttribf(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
-        int getVertexAttribi(unsigned long index, unsigned long pname);
-        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
-        
+
+        void getTexParameterfv(unsigned long target, unsigned long pname, float* value);
+        void getTexParameteriv(unsigned long target, unsigned long pname, int* value);
+
+        void getUniformfv(WebGLProgram* program, long location, float* value);
+        void getUniformiv(WebGLProgram* program, long location, int* value);
+
+        long getUniformLocation(WebGLProgram*, const String& name);
+
+        void getVertexAttribfv(unsigned long index, unsigned long pname, float* value);
+        void getVertexAttribiv(unsigned long index, unsigned long pname, int* value);
+
         long getVertexAttribOffset(unsigned long index, unsigned long pname);
 
         void hint(unsigned long target, unsigned long mode);
-        bool isBuffer(CanvasBuffer*);
+        bool isBuffer(WebGLBuffer*);
         bool isEnabled(unsigned long cap);
-        bool isFramebuffer(CanvasFramebuffer*);
-        bool isProgram(CanvasProgram*);
-        bool isRenderbuffer(CanvasRenderbuffer*);
-        bool isShader(CanvasShader*);
-        bool isTexture(CanvasTexture*);
+        bool isFramebuffer(WebGLFramebuffer*);
+        bool isProgram(WebGLProgram*);
+        bool isRenderbuffer(WebGLRenderbuffer*);
+        bool isShader(WebGLShader*);
+        bool isTexture(WebGLTexture*);
         void lineWidth(double);
-        void linkProgram(CanvasProgram*);
+        void linkProgram(WebGLProgram*);
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
+        PassRefPtr<WebGLArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
         void sampleCoverage(double value, bool invert);
         void scissor(long x, long y, unsigned long width, unsigned long height);
-        void shaderSource(CanvasShader*, const String& string);
+        void shaderSource(WebGLShader*, const String& string);
         void stencilFunc(unsigned long func, long ref, unsigned long mask);
         void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
         void stencilMask(unsigned long mask);
@@ -232,13 +530,11 @@ namespace WebCore {
         // Currently they return -1 on any error.
         int texImage2D(unsigned target, unsigned level, unsigned internalformat,
                        unsigned width, unsigned height, unsigned border,
-                       unsigned format, unsigned type, CanvasArray* pixels);
+                       unsigned format, unsigned type, WebGLArray* pixels);
         int texImage2D(unsigned target, unsigned level, unsigned internalformat,
                        unsigned width, unsigned height, unsigned border,
                        unsigned format, unsigned type, ImageData* pixels);
-        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
-                       bool flipY, bool premultiplyAlpha);
-        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+        int texImage2D(unsigned target, unsigned level, Image* image,
                        bool flipY, bool premultiplyAlpha);
         int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
                        bool flipY, bool premultiplyAlpha);
@@ -248,15 +544,12 @@ namespace WebCore {
 
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height,
-                          unsigned format, unsigned type, CanvasArray* pixels);
+                          unsigned format, unsigned type, WebGLArray* pixels);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height,
                           unsigned format, unsigned type, ImageData* pixels);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLImageElement* image,
-                          bool flipY, bool premultiplyAlpha);
-        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
-                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                          unsigned width, unsigned height, Image* image,
                           bool flipY, bool premultiplyAlpha);
         int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
                           unsigned width, unsigned height, HTMLVideoElement* video,
@@ -282,8 +575,8 @@ namespace WebCore {
         void uniformMatrix3fv(long location, bool transpose, float* value, int size);
         void uniformMatrix4fv(long location, bool transpose, float* value, int size);
 
-        void useProgram(CanvasProgram*);
-        void validateProgram(CanvasProgram*);
+        void useProgram(WebGLProgram*);
+        void validateProgram(WebGLProgram*);
 
         void vertexAttrib1f(unsigned long indx, float x);
         void vertexAttrib1fv(unsigned long indx, float* values);
@@ -301,7 +594,7 @@ namespace WebCore {
         void reshape(int width, int height);
         
         // Helpers for notification about paint events
-        void beginPaint(CanvasRenderingContext3D* context);
+        void beginPaint(WebGLRenderingContext* context);
         void endPaint();
 
         // Support for buffer creation and deletion
@@ -309,7 +602,7 @@ namespace WebCore {
         unsigned createFramebuffer();
         unsigned createProgram();
         unsigned createRenderbuffer();
-        unsigned createShader(ShaderType);
+        unsigned createShader(unsigned long);
         unsigned createTexture();
         
         void deleteBuffer(unsigned);
@@ -319,6 +612,16 @@ namespace WebCore {
         void deleteShader(unsigned);
         void deleteTexture(unsigned);        
         
+        // Synthesizes an OpenGL error which will be returned from a
+        // later call to getError. This is used to emulate OpenGL ES
+        // 2.0 behavior on the desktop and to enforce additional error
+        // checking mandated by WebGL.
+        //
+        // Per the behavior of glGetError, this stores at most one
+        // instance of any given error, and returns them from calls to
+        // getError in the order they were added.
+        void synthesizeGLError(unsigned long error);
+
     private:        
         GraphicsContext3D();
 
@@ -331,6 +634,8 @@ namespace WebCore {
         GLuint m_texture;
         GLuint m_fbo;
         GLuint m_depthBuffer;
+        // Errors raised by synthesizeGLError().
+        ListHashSet<unsigned long> m_syntheticErrors;
 #endif        
 
         // FIXME: ideally this would be used on all platforms.
@@ -343,4 +648,3 @@ namespace WebCore {
 } // namespace WebCore
 
 #endif // GraphicsContext3D_h
-
diff --git a/WebCore/platform/graphics/GraphicsContextPrivate.h b/WebCore/platform/graphics/GraphicsContextPrivate.h
index 98baab1..c532162 100644
--- a/WebCore/platform/graphics/GraphicsContextPrivate.h
+++ b/WebCore/platform/graphics/GraphicsContextPrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,10 @@
 #ifndef GraphicsContextPrivate_h
 #define GraphicsContextPrivate_h
 
-#include "TransformationMatrix.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
 
 namespace WebCore {
 
@@ -38,18 +38,18 @@ namespace WebCore {
             : textDrawingMode(cTextFill)
             , strokeStyle(SolidStroke)
             , strokeThickness(0)
-#if PLATFORM(CAIRO)
-            , globalAlpha(1.0f)
-#endif
-            , strokeColorSpace(SolidColorSpace)
             , strokeColor(Color::black)
+            , strokeColorSpace(DeviceColorSpace)
             , fillRule(RULE_NONZERO)
-            , fillColorSpace(SolidColorSpace)
             , fillColor(Color::black)
+            , fillColorSpace(DeviceColorSpace)
             , shouldAntialias(true)
             , paintingDisabled(false)
             , shadowBlur(0)
             , shadowsIgnoreTransforms(false)
+#if PLATFORM(CAIRO)
+            , globalAlpha(1.0f)
+#endif
         {
         }
 
@@ -57,19 +57,14 @@ namespace WebCore {
         
         StrokeStyle strokeStyle;
         float strokeThickness;
-#if PLATFORM(CAIRO)
-        float globalAlpha;
-#elif PLATFORM(QT)
-        TransformationMatrix pathTransform;
-#endif
-        ColorSpace strokeColorSpace;
         Color strokeColor;
+        ColorSpace strokeColorSpace;
         RefPtr<Gradient> strokeGradient;
         RefPtr<Pattern> strokePattern;
         
         WindRule fillRule;
-        ColorSpace fillColorSpace;
         Color fillColor;
+        ColorSpace fillColorSpace;
         RefPtr<Gradient> fillGradient;
         RefPtr<Pattern> fillPattern;
 
@@ -82,9 +77,14 @@ namespace WebCore {
         Color shadowColor;
 
         bool shadowsIgnoreTransforms;
+#if PLATFORM(CAIRO)
+        float globalAlpha;
+#elif PLATFORM(QT)
+        TransformationMatrix pathTransform;
+#endif
     };
 
-    class GraphicsContextPrivate {
+    class GraphicsContextPrivate : public Noncopyable {
     public:
         GraphicsContextPrivate()
             : m_focusRingWidth(0)
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index c8582bb..e215097 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -92,6 +92,21 @@ bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
     return false;
 }
 
+bool GraphicsLayer::setChildren(const Vector<GraphicsLayer*>& newChildren)
+{
+    // If the contents of the arrays are the same, nothing to do.
+    if (newChildren == m_children)
+        return false;
+
+    removeAllChildren();
+    
+    size_t listSize = newChildren.size();
+    for (size_t i = 0; i < listSize; ++i)
+        addChild(newChildren[i]);
+    
+    return true;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 85eace0..0456bad 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -53,6 +53,12 @@ typedef CALayer* NativeLayer;
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
 #endif
+#elif PLATFORM(WIN)
+namespace WebCore {
+class WKCACFLayer;
+typedef WKCACFLayer PlatformLayer;
+typedef void* NativeLayer;
+}
 #else
 typedef void* PlatformLayer;
 typedef void* NativeLayer;
@@ -176,6 +182,8 @@ public:
     bool hasAncestor(GraphicsLayer*) const;
     
     const Vector<GraphicsLayer*>& children() const { return m_children; }
+    // Returns true if the child list changed.
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
     virtual void addChild(GraphicsLayer*);
@@ -292,8 +300,8 @@ public:
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-    static bool showDebugBorders();
-    static bool showRepaintCounter();
+    bool showDebugBorders() { return m_client ? m_client->showDebugBorders() : false; }
+    bool showRepaintCounter() { return m_client ? m_client->showRepaintCounter() : false; }
     
     void updateDebugIndicators();
     
diff --git a/WebCore/platform/graphics/GraphicsLayerClient.h b/WebCore/platform/graphics/GraphicsLayerClient.h
index 5facc94..afb297d 100644
--- a/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -62,6 +62,9 @@ public:
     virtual void notifySyncRequired(const GraphicsLayer*) = 0;
     
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) = 0;
+    
+    virtual bool showDebugBorders() const = 0;
+    virtual bool showRepaintCounter() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/Icon.h b/WebCore/platform/graphics/Icon.h
index 444c67c..d7d694a 100644
--- a/WebCore/platform/graphics/Icon.h
+++ b/WebCore/platform/graphics/Icon.h
@@ -51,7 +51,6 @@ class String;
     
 class Icon : public RefCounted<Icon> {
 public:
-    static PassRefPtr<Icon> createIconForFile(const String& filename);
     static PassRefPtr<Icon> createIconForFiles(const Vector<String>& filenames);
 
     ~Icon();
diff --git a/WebCore/platform/graphics/Image.cpp b/WebCore/platform/graphics/Image.cpp
index 80b5457..611216a 100644
--- a/WebCore/platform/graphics/Image.cpp
+++ b/WebCore/platform/graphics/Image.cpp
@@ -75,14 +75,14 @@ bool Image::setData(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     return dataChanged(allDataReceived);
 }
 
-void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op)
+void Image::fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, ColorSpace styleColorSpace, CompositeOperator op)
 {
     if (color.alpha() <= 0)
         return;
     
     ctxt->save();
     ctxt->setCompositeOperation(!color.hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
-    ctxt->fillRect(dstRect, color);
+    ctxt->fillRect(dstRect, color, styleColorSpace);
     ctxt->restore();
 }
 
@@ -104,10 +104,10 @@ static inline FloatSize calculatePatternScale(const FloatRect& dstRect, const Fl
 }
 
 
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const FloatPoint& srcPoint, const FloatSize& scaledTileSize, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, destRect, solidColor(), op);
+        fillWithSolidColor(ctxt, destRect, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -132,22 +132,22 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& destRect, const Fl
         visibleSrcRect.setY((destRect.y() - oneTileRect.y()) / scale.height());
         visibleSrcRect.setWidth(destRect.width() / scale.width());
         visibleSrcRect.setHeight(destRect.height() / scale.height());
-        draw(ctxt, destRect, visibleSrcRect, op);
+        draw(ctxt, destRect, visibleSrcRect, styleColorSpace, op);
         return;
     }
 
     TransformationMatrix patternTransform = TransformationMatrix().scaleNonUniform(scale.width(), scale.height());
     FloatRect tileRect(FloatPoint(), intrinsicTileSize);    
-    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), op, destRect);
+    drawPattern(ctxt, tileRect, patternTransform, oneTileRect.location(), styleColorSpace, op, destRect);
     
     startAnimation();
 }
 
 // FIXME: Merge with the other drawTiled eventually, since we need a combination of both for some things.
-void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator op)
+void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator op)
 {    
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dstRect, solidColor(), op);
+        fillWithSolidColor(ctxt, dstRect, solidColor(), styleColorSpace, op);
         return;
     }
     
@@ -170,7 +170,7 @@ void Image::drawTiled(GraphicsContext* ctxt, const FloatRect& dstRect, const Flo
         vPhase -= fmodf(dstRect.height(), scale.height() * srcRect.height()) / 2.0f;
     FloatPoint patternPhase(dstRect.x() - hPhase, dstRect.y() - vPhase);
     
-    drawPattern(ctxt, srcRect, patternTransform, patternPhase, op, dstRect);
+    drawPattern(ctxt, srcRect, patternTransform, patternPhase, styleColorSpace, op, dstRect);
 
     startAnimation();
 }
diff --git a/WebCore/platform/graphics/Image.h b/WebCore/platform/graphics/Image.h
index 294ddf6..aef6577 100644
--- a/WebCore/platform/graphics/Image.h
+++ b/WebCore/platform/graphics/Image.h
@@ -28,6 +28,7 @@
 #define Image_h
 
 #include "Color.h"
+#include "ColorSpace.h"
 #include "GraphicsTypes.h"
 #include "ImageSource.h"
 #include "IntRect.h"
@@ -158,21 +159,22 @@ public:
 protected:
     Image(ImageObserver* = 0);
 
-    static void fillWithSolidColor(GraphicsContext* ctxt, const FloatRect& dstRect, const Color& color, CompositeOperator op);
+    static void fillWithSolidColor(GraphicsContext*, const FloatRect& dstRect, const Color&, ColorSpace styleColorSpace, CompositeOperator);
 
+    // The ColorSpace parameter will only be used for untagged images.
 #if PLATFORM(WIN)
-    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator) { }
+    virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator) { }
 #endif
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator) = 0;
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, CompositeOperator);
-    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator) = 0;
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatPoint& srcPoint, const FloatSize& tileSize, ColorSpace styleColorSpace, CompositeOperator);
+    void drawTiled(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, TileRule hRule, TileRule vRule, ColorSpace styleColorSpace, CompositeOperator);
 
     // Supporting tiled drawing
     virtual bool mayFillWithSolidColor() { return false; }
     virtual Color solidColor() const { return Color(); }
     
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
-                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+                             const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator, const FloatRect& destRect);
 
 private:
     RefPtr<SharedBuffer> m_data; // The encoded raw data for the image. 
diff --git a/WebCore/platform/graphics/MediaPlayer.cpp b/WebCore/platform/graphics/MediaPlayer.cpp
index b64f82b..4c66c50 100644
--- a/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/WebCore/platform/graphics/MediaPlayer.cpp
@@ -91,6 +91,9 @@ public:
 
     virtual void setVolume(float) { }
 
+    virtual bool hasClosedCaptions() const { return false; }
+    virtual void setClosedCaptionsVisible(bool) { };
+
     virtual MediaPlayer::NetworkState networkState() const { return MediaPlayer::Empty; }
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
@@ -126,7 +129,7 @@ static MediaPlayerPrivateInterface* createNullMediaPlayer(MediaPlayer* player)
 
 // engine support
 
-struct MediaPlayerFactory {
+struct MediaPlayerFactory : Noncopyable {
     MediaPlayerFactory(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsTypeAndCodecs) 
         : constructor(constructor)
         , getSupportedTypes(getSupportedTypes)
@@ -377,6 +380,16 @@ void MediaPlayer::setVolume(float volume)
     m_private->setVolume(volume);   
 }
 
+bool MediaPlayer::hasClosedCaptions() const
+{
+    return m_private->hasClosedCaptions();
+}
+
+void MediaPlayer::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    m_private->setClosedCaptionsVisible(closedCaptionsVisible);
+}
+
 float MediaPlayer::rate() const
 {
     return m_rate;
diff --git a/WebCore/platform/graphics/MediaPlayer.h b/WebCore/platform/graphics/MediaPlayer.h
index 4cc6476..ec8ac33 100644
--- a/WebCore/platform/graphics/MediaPlayer.h
+++ b/WebCore/platform/graphics/MediaPlayer.h
@@ -37,6 +37,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 
 #ifdef __OBJC__
 @class QTMovie;
@@ -115,7 +116,11 @@ public:
 
 class MediaPlayer : public Noncopyable {
 public:
-    MediaPlayer(MediaPlayerClient*);
+
+    static PassOwnPtr<MediaPlayer> create(MediaPlayerClient* client)
+    {
+        return new MediaPlayer(client);
+    }
     virtual ~MediaPlayer();
 
     // media engine support
@@ -175,7 +180,10 @@ public:
     
     float volume() const;
     void setVolume(float);
-    
+
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool closedCaptionsVisible);
+
     int dataRate() const;
 
     bool autobuffer() const;    
@@ -223,6 +231,8 @@ public:
     bool hasSingleSecurityOrigin() const;
 
 private:
+    MediaPlayer(MediaPlayerClient*);
+
     static void initializeMediaEngines();
 
     MediaPlayerClient* m_mediaPlayerClient;
diff --git a/WebCore/platform/graphics/MediaPlayerPrivate.h b/WebCore/platform/graphics/MediaPlayerPrivate.h
index f5687b3..03906bd 100644
--- a/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -36,7 +36,7 @@ class IntRect;
 class IntSize;
 class String;
 
-class MediaPlayerPrivateInterface {
+class MediaPlayerPrivateInterface : public Noncopyable {
 public:
     virtual ~MediaPlayerPrivateInterface() { }
 
@@ -76,6 +76,9 @@ public:
 
     virtual void setVolume(float) = 0;
 
+    virtual bool hasClosedCaptions() const { return false; }    
+    virtual void setClosedCaptionsVisible(bool) { }
+
     virtual MediaPlayer::NetworkState networkState() const = 0;
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
diff --git a/WebCore/platform/graphics/Path.h b/WebCore/platform/graphics/Path.h
index 6b617a0..fef5ad2 100644
--- a/WebCore/platform/graphics/Path.h
+++ b/WebCore/platform/graphics/Path.h
@@ -29,6 +29,7 @@
 #define Path_h
 
 #include <algorithm>
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 typedef struct CGPath PlatformPath;
@@ -93,7 +94,7 @@ namespace WebCore {
 
     typedef void (*PathApplierFunction)(void* info, const PathElement*);
 
-    class Path {
+    class Path : public FastAllocBase {
     public:
         Path();
         ~Path();
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index 1a951c2..3bfa8f3 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -32,6 +32,7 @@
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
+#include "ImageBuffer.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
 #include "TransformationMatrix.h"
@@ -85,6 +86,34 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         shadowFillColor.getRGBA(red, green, blue, alpha);
         cairo_set_source_rgba(cr, red, green, blue, alpha);
 
+#if ENABLE(FILTERS)
+        cairo_text_extents_t extents;
+        cairo_scaled_font_glyph_extents(font->platformData().scaledFont(), glyphs, numGlyphs, &extents);
+
+        FloatRect rect(FloatPoint(), FloatSize(extents.width, extents.height));
+        IntSize shadowBufferSize;
+        FloatRect shadowRect;
+        float kernelSize = 0.f;
+        GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+        // Draw shadow into a new ImageBuffer
+        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+        GraphicsContext* shadowContext = shadowBuffer->context();
+        cairo_t* shadowCr = shadowContext->platformContext();
+
+        cairo_translate(shadowCr, kernelSize, extents.height + kernelSize);
+
+        cairo_set_scaled_font(shadowCr, font->platformData().scaledFont());
+        cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
+        if (font->syntheticBoldOffset()) {
+            cairo_save(shadowCr);
+            cairo_translate(shadowCr, font->syntheticBoldOffset(), 0);
+            cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
+            cairo_restore(shadowCr);
+        }
+        cairo_translate(cr, 0.0, -extents.height);
+        context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#else
         cairo_translate(cr, shadowSize.width(), shadowSize.height());
         cairo_show_glyphs(cr, glyphs, numGlyphs);
         if (font->syntheticBoldOffset()) {
@@ -93,6 +122,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
             cairo_show_glyphs(cr, glyphs, numGlyphs);
             cairo_restore(cr);
         }
+#endif
 
         cairo_restore(cr);
     }
@@ -156,7 +186,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
 
     // Re-enable the platform shadow we disabled earlier
     if (hasShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     cairo_restore(cr);
 }
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 8741c5e..14034fd 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -1,8 +1,9 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
- * Copyright (C) 2008 Dirk Schulze <vbs85@gmx.de>
+ * Copyright (C) 2008, 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2008 Nuanti Ltd.
+ * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,14 +33,17 @@
 #if PLATFORM(CAIRO)
 
 #include "CairoPath.h"
+#include "FEGaussianBlur.h"
 #include "FloatRect.h"
 #include "Font.h"
 #include "ImageBuffer.h"
+#include "ImageBufferFilter.h"
 #include "IntRect.h"
 #include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
+#include "SourceGraphic.h"
 #include "TransformationMatrix.h"
 
 #include <cairo.h>
@@ -69,6 +73,42 @@ static inline void setColor(cairo_t* cr, const Color& col)
     cairo_set_source_rgba(cr, red, green, blue, alpha);
 }
 
+static inline void setPlatformFill(GraphicsContext* context, cairo_t* cr, GraphicsContextPrivate* gcp)
+{
+    cairo_save(cr);
+    if (gcp->state.fillPattern) {
+        TransformationMatrix affine;
+        cairo_set_source(cr, gcp->state.fillPattern->createPlatformPattern(affine));
+    } else if (gcp->state.fillGradient)
+        cairo_set_source(cr, gcp->state.fillGradient->platformGradient());
+    else
+        setColor(cr, context->fillColor());
+    cairo_clip_preserve(cr);
+    cairo_paint_with_alpha(cr, gcp->state.globalAlpha);
+    cairo_restore(cr);
+}
+
+static inline void setPlatformStroke(GraphicsContext* context, cairo_t* cr, GraphicsContextPrivate* gcp)
+{
+    cairo_save(cr);
+    if (gcp->state.strokePattern) {
+        TransformationMatrix affine;
+        cairo_set_source(cr, gcp->state.strokePattern->createPlatformPattern(affine));
+    } else if (gcp->state.strokeGradient)
+        cairo_set_source(cr, gcp->state.strokeGradient->platformGradient());
+    else  {
+        Color strokeColor = colorWithOverrideAlpha(context->strokeColor().rgb(), context->strokeColor().alpha() / 255.f * gcp->state.globalAlpha);
+        setColor(cr, strokeColor);
+    }
+    if (gcp->state.globalAlpha < 1.0f && (gcp->state.strokePattern || gcp->state.strokeGradient)) {
+        cairo_push_group(cr);
+        cairo_paint_with_alpha(cr, gcp->state.globalAlpha);
+        cairo_pop_group_to_source(cr);
+    }
+    cairo_stroke_preserve(cr);
+    cairo_restore(cr);
+}
+
 // A fillRect helper
 static inline void fillRectSourceOver(cairo_t* cr, const FloatRect& rect, const Color& col)
 {
@@ -78,6 +118,81 @@ static inline void fillRectSourceOver(cairo_t* cr, const FloatRect& rect, const
     cairo_fill(cr);
 }
 
+static inline void copyContextProperties(cairo_t* srcCr, cairo_t* dstCr)
+{
+    cairo_set_antialias(dstCr, cairo_get_antialias(srcCr));
+
+    size_t dashCount = cairo_get_dash_count(srcCr);
+    Vector<double> dashes(dashCount);
+
+    double offset;
+    cairo_get_dash(srcCr, dashes.data(), &offset);
+    cairo_set_dash(dstCr, dashes.data(), dashCount, offset);
+    cairo_set_line_cap(dstCr, cairo_get_line_cap(srcCr));
+    cairo_set_line_join(dstCr, cairo_get_line_join(srcCr));
+    cairo_set_line_width(dstCr, cairo_get_line_width(srcCr));
+    cairo_set_miter_limit(dstCr, cairo_get_miter_limit(srcCr));
+    cairo_set_fill_rule(dstCr, cairo_get_fill_rule(srcCr));
+}
+
+void GraphicsContext::calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& kernelSize, const FloatRect& sourceRect, const IntSize& shadowSize, int shadowBlur)
+{
+#if ENABLE(FILTERS)
+    // calculate the kernel size according to the HTML5 canvas shadow specification
+    kernelSize = (shadowBlur < 8 ? shadowBlur / 2.f : sqrt(shadowBlur * 2.f));
+    int blurRadius = ceil(kernelSize);
+
+    shadowBufferSize = IntSize(sourceRect.width() + blurRadius * 2, sourceRect.height() + blurRadius * 2);
+
+    // determine dimensions of shadow rect
+    shadowRect = FloatRect(sourceRect.location(), shadowBufferSize);
+    shadowRect.move(shadowSize.width() - kernelSize, shadowSize.height() - kernelSize);
+#endif
+}
+
+static inline void drawPathShadow(GraphicsContext* context, GraphicsContextPrivate* gcp, bool fillShadow, bool strokeShadow)
+{
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (!context->getShadow(shadowSize, shadowBlur, shadowColor))
+        return;
+    
+    // Calculate filter values to create appropriate shadow.
+    cairo_t* cr = context->platformContext();
+    cairo_path_t* path = cairo_copy_path(cr);
+    double x0, x1, y0, y1;
+    if (strokeShadow)
+        cairo_stroke_extents(cr, &x0, &y0, &x1, &y1);
+    else
+        cairo_fill_extents(cr, &x0, &y0, &x1, &y1);
+    FloatRect rect(x0, y0, x1 - x0, y1 - y0);
+
+    IntSize shadowBufferSize;
+    FloatRect shadowRect;
+    float kernelSize = 0;
+    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+    // Create suitably-sized ImageBuffer to hold the shadow.
+    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+
+    // Draw shadow into a new ImageBuffer.
+    cairo_t* shadowContext = shadowBuffer->context()->platformContext();
+    copyContextProperties(cr, shadowContext);
+    cairo_translate(shadowContext, -rect.x() + kernelSize, -rect.y() + kernelSize);
+    cairo_new_path(shadowContext);
+    cairo_append_path(shadowContext, path);
+
+    if (fillShadow)
+        setPlatformFill(context, shadowContext, gcp);
+    if (strokeShadow)
+        setPlatformStroke(context, shadowContext, gcp);
+
+    context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#endif
+}
+
 GraphicsContext::GraphicsContext(PlatformGraphicsContext* cr)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate)
@@ -387,30 +502,12 @@ void GraphicsContext::fillPath()
         return;
 
     cairo_t* cr = m_data->cr;
-    cairo_save(cr);
 
     cairo_set_fill_rule(cr, fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        setColor(cr, fillColor());
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        cairo_set_source(cr, m_common->state.fillPattern->createPlatformPattern(affine));
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    }
-    case GradientColorSpace:
-        cairo_pattern_t* pattern = m_common->state.fillGradient->platformGradient();
-        cairo_set_source(cr, pattern);
-        cairo_clip(cr);
-        cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-        break;
-    }
-    cairo_restore(cr);
+    drawPathShadow(this, m_common, true, false);
+
+    setPlatformFill(this, cr, m_common);
+    cairo_new_path(cr);
 }
 
 void GraphicsContext::strokePath()
@@ -419,45 +516,26 @@ void GraphicsContext::strokePath()
         return;
 
     cairo_t* cr = m_data->cr;
-    cairo_save(cr);
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        float red, green, blue, alpha;
-        strokeColor().getRGBA(red, green, blue, alpha);
-        if (m_common->state.globalAlpha < 1.0f)
-            alpha *= m_common->state.globalAlpha;
-        cairo_set_source_rgba(cr, red, green, blue, alpha);
-        cairo_stroke(cr);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        cairo_set_source(cr, m_common->state.strokePattern->createPlatformPattern(affine));
-        if (m_common->state.globalAlpha < 1.0f) {
-            cairo_push_group(cr);
-            cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-            cairo_pop_group_to_source(cr);
-        }
-        cairo_stroke(cr);
-        break;
-    }
-    case GradientColorSpace:
-        cairo_pattern_t* pattern = m_common->state.strokeGradient->platformGradient();
-        cairo_set_source(cr, pattern);
-        if (m_common->state.globalAlpha < 1.0f) {
-            cairo_push_group(cr);
-            cairo_paint_with_alpha(cr, m_common->state.globalAlpha);
-            cairo_pop_group_to_source(cr);
-        }
-        cairo_stroke(cr);
-        break;
-    }
-    cairo_restore(cr);
+    drawPathShadow(this, m_common, false, true);
+
+    setPlatformStroke(this, cr, m_common);
+    cairo_new_path(cr);
+
 }
 
 void GraphicsContext::drawPath()
 {
-    fillPath();
-    strokePath();
+    if (paintingDisabled())
+        return;
+
+    cairo_t* cr = m_data->cr;
+
+    cairo_set_fill_rule(cr, fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
+    drawPathShadow(this, m_common, true, true);
+
+    setPlatformFill(this, cr, m_common);
+    setPlatformStroke(this, cr, m_common);
+    cairo_new_path(cr);
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect)
@@ -470,11 +548,36 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     fillPath();
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+static void drawBorderlessRectShadow(GraphicsContext* context, const FloatRect& rect, const Color& rectColor)
+{
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+
+    if (!context->getShadow(shadowSize, shadowBlur, shadowColor))
+        return;
+
+    IntSize shadowBufferSize;
+    FloatRect shadowRect;
+    float kernelSize = 0;
+    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, rect, shadowSize, shadowBlur);
+
+    // Draw shadow into a new ImageBuffer
+    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+    GraphicsContext* shadowContext = shadowBuffer->context();
+    shadowContext->fillRect(FloatRect(FloatPoint(kernelSize, kernelSize), rect.size()), rectColor, DeviceColorSpace);
+
+    context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+#endif
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
+    drawBorderlessRectShadow(this, rect, color);
     if (color.alpha())
         fillRectSourceOver(m_data->cr, rect, color);
 }
@@ -634,13 +737,13 @@ IntPoint GraphicsContext::origin()
     return IntPoint(static_cast<int>(matrix.x0), static_cast<int>(matrix.y0));
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& col)
+void GraphicsContext::setPlatformFillColor(const Color& col, ColorSpace colorSpace)
 {
     // Cairo contexts can't hold separate fill and stroke colors
     // so we set them just before we actually fill or stroke
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& col)
+void GraphicsContext::setPlatformStrokeColor(const Color& col, ColorSpace colorSpace)
 {
     // Cairo contexts can't hold separate fill and stroke colors
     // so we set them just before we actually fill or stroke
@@ -726,9 +829,48 @@ void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer
     notImplemented();
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+void GraphicsContext::setPlatformShadow(IntSize const& size, int, Color const&, ColorSpace)
 {
-    notImplemented();
+    // Cairo doesn't support shadows natively, they are drawn manually in the draw*
+    // functions
+
+    if (m_common->state.shadowsIgnoreTransforms) {
+        // Meaning that this graphics context is associated with a CanvasRenderingContext
+        // We flip the height since CG and HTML5 Canvas have opposite Y axis
+        m_common->state.shadowSize = IntSize(size.width(), -size.height());
+    }
+}
+
+void GraphicsContext::createPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float kernelSize)
+{
+#if ENABLE(FILTERS)
+    cairo_t* cr = m_data->cr;
+
+    // draw the shadow without blurring, if kernelSize is zero
+    if (!kernelSize) {
+        setColor(cr, shadowColor);
+        cairo_mask_surface(cr, buffer->image()->nativeImageForCurrentFrame(), shadowRect.x(), shadowRect.y());
+        return;
+    }
+
+    // limit kernel size to 1000, this is what CG is doing.
+    kernelSize = std::min(1000.f, kernelSize);
+
+    // create filter
+    RefPtr<Filter> filter = ImageBufferFilter::create();
+    filter->setSourceImage(buffer.release());
+    RefPtr<FilterEffect> source = SourceGraphic::create();
+    source->setScaledSubRegion(FloatRect(FloatPoint(), shadowRect.size()));
+    source->setIsAlphaImage(true);
+    RefPtr<FilterEffect> blur = FEGaussianBlur::create(source.get(), kernelSize, kernelSize);
+    blur->setScaledSubRegion(FloatRect(FloatPoint(), shadowRect.size()));
+    blur->apply(filter.get());
+
+    // Mask the filter with the shadow color and draw it to the context.
+    // Masking makes it possible to just blur the alpha channel.
+    setColor(cr, shadowColor);
+    cairo_mask_surface(cr, blur->resultImage()->image()->nativeImageForCurrentFrame(), shadowRect.x(), shadowRect.y());
+#endif
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -941,7 +1083,6 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     cairo_t* cr = m_data->cr;
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
@@ -952,9 +1093,6 @@ void GraphicsContext::clipOut(const Path& path)
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_EVEN_ODD);
     cairo_clip(cr);
     cairo_set_fill_rule(cr, savedFillRule);
-#else
-    notImplemented();
-#endif
 }
 
 void GraphicsContext::rotate(float radians)
@@ -980,19 +1118,15 @@ void GraphicsContext::clipOut(const IntRect& r)
     if (paintingDisabled())
         return;
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     cairo_t* cr = m_data->cr;
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
-    cairo_rectangle(cr, x1, x2, x2 - x1, y2 - y1);
+    cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
     cairo_rectangle(cr, r.x(), r.y(), r.width(), r.height());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_EVEN_ODD);
     cairo_clip(cr);
     cairo_set_fill_rule(cr, savedFillRule);
-#else
-    notImplemented();
-#endif
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& r)
@@ -1005,7 +1139,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& r)
     clipOut(p);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1015,6 +1149,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft,
     beginPath();
     addPath(Path::createRoundedRectangle(r, topLeft, topRight, bottomLeft, bottomRight));
     setColor(cr, color);
+    drawPathShadow(this, m_common, true, false);
     cairo_fill(cr);
     cairo_restore(cr);
 }
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 0213944..d991c80 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -136,6 +136,7 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
             *pixel = premultipliedARGBFromColor(pixelColor);
         }
     }
+    cairo_surface_mark_dirty_rectangle (m_data.m_surface, 0, 0, m_size.width(), m_size.height());
 }
 
 template <Multiply multiplied>
@@ -260,6 +261,9 @@ void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint&
         }
         srcRows += srcBytesPerRow;
     }
+    cairo_surface_mark_dirty_rectangle (data.m_surface,
+                                        destx, desty,
+                                        numColumns, numRows);
 }
 
 void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
diff --git a/WebCore/platform/graphics/cairo/ImageCairo.cpp b/WebCore/platform/graphics/cairo/ImageCairo.cpp
index c8c992e..92e36fc 100644
--- a/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -89,7 +89,7 @@ BitmapImage::BitmapImage(cairo_surface_t* surface, ImageObserver* observer)
     checkForSolidColor();
 }
 
-void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     FloatRect srcRect(src);
     FloatRect dstRect(dst);
@@ -105,7 +105,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(context, dstRect, solidColor(), op);
+        fillWithSolidColor(context, dstRect, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -125,17 +125,37 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
     // Test using example site at http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
     cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
 
-    // To avoid the unwanted gradient effect (#14017) we use
-    // CAIRO_FILTER_NEAREST now, but the real fix will be to have
-    // CAIRO_EXTEND_PAD implemented for surfaces in Cairo allowing us to still
-    // use bilinear filtering
-    cairo_pattern_set_filter(pattern, CAIRO_FILTER_NEAREST);
+    cairo_pattern_set_extend(pattern, CAIRO_EXTEND_PAD);
 
     float scaleX = srcRect.width() / dstRect.width();
     float scaleY = srcRect.height() / dstRect.height();
     cairo_matrix_t matrix = { scaleX, 0, 0, scaleY, srcRect.x(), srcRect.y() };
     cairo_pattern_set_matrix(pattern, &matrix);
 
+    // Draw the shadow
+#if ENABLE(FILTERS)
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        IntSize shadowBufferSize;
+        FloatRect shadowRect;
+        float kernelSize (0.0);
+        GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, kernelSize, dstRect, shadowSize, shadowBlur);
+        shadowColor = colorWithOverrideAlpha(shadowColor.rgb(), (shadowColor.alpha() *  context->getAlpha()) / 255.f);
+
+        //draw shadow into a new ImageBuffer
+        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+        cairo_t* shadowContext = shadowBuffer->context()->platformContext();
+        cairo_set_source(shadowContext, pattern);
+        cairo_translate(shadowContext, -dstRect.x(), -dstRect.y());
+        cairo_rectangle(shadowContext, 0, 0, dstRect.width(), dstRect.height());
+        cairo_fill(shadowContext);
+
+        context->createPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, kernelSize);
+    }
+#endif
+
     // Draw the image.
     cairo_translate(cr, dstRect.x(), dstRect.y());
     cairo_set_source(cr, pattern);
@@ -151,7 +171,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 }
 
 void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     cairo_surface_t* image = nativeImageForCurrentFrame();
     if (!image) // If it's too early we won't have an image yet.
@@ -180,9 +200,6 @@ void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, con
     cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
     cairo_pattern_set_extend(pattern, CAIRO_EXTEND_REPEAT);
 
-    // Workaround to avoid the unwanted gradient effect (#14017)
-    cairo_pattern_set_filter(pattern, CAIRO_FILTER_NEAREST);
-
     cairo_matrix_t pattern_matrix = cairo_matrix_t(patternTransform);
     cairo_matrix_t phase_matrix = {1, 0, 0, 1, phase.x() + tileRect.x() * patternTransform.a(), phase.y() + tileRect.y() * patternTransform.d()};
     cairo_matrix_t combined;
diff --git a/WebCore/platform/graphics/cairo/PathCairo.cpp b/WebCore/platform/graphics/cairo/PathCairo.cpp
index 75681bd..8bde57e 100644
--- a/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -78,15 +78,7 @@ void Path::clear()
 
 bool Path::isEmpty() const
 {
-    cairo_t* cr = platformPath()->m_cr;
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,5,10)
-    return !cairo_has_current_point(cr);
-#else
-    cairo_path_t* p = cairo_copy_path(cr);
-    bool hasData = p->num_data;
-    cairo_path_destroy(p);
-    return !hasData;
-#endif
+    return !cairo_has_current_point(platformPath()->m_cr);
 }
 
 bool Path::hasCurrentPoint() const
@@ -256,11 +248,7 @@ FloatRect Path::boundingRect() const
 {
     cairo_t* cr = platformPath()->m_cr;
     double x0, x1, y0, y1;
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1, 6, 0)
     cairo_path_extents(cr, &x0, &y0, &x1, &y1);
-#else
-    cairo_stroke_extents(cr, &x0, &y0, &x1, &y1);
-#endif
     return FloatRect(x0, y0, x1 - x0, y1 - y0);
 }
 
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 1350bd3..39f06a6 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -43,26 +43,78 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/RetainPtr.h>
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+// Building on 10.6 or later: kCGInterpolationMedium is defined in the CGInterpolationQuality enum.
 #define HAVE_CG_INTERPOLATION_MEDIUM 1
 #endif
 
+#if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
+// Targeting 10.6 or later: use kCGInterpolationMedium.
+#define WTF_USE_CG_INTERPOLATION_MEDIUM 1
+#endif
+
+#endif
+
 using namespace std;
 
 namespace WebCore {
 
-static void setCGFillColor(CGContextRef context, const Color& color)
+static CGColorRef createCGColorWithColorSpace(const Color& color, ColorSpace colorSpace)
 {
-    CGFloat red, green, blue, alpha;
-    color.getRGBA(red, green, blue, alpha);
-    CGContextSetRGBFillColor(context, red, green, blue, alpha);
+    CGFloat components[4];
+    color.getRGBA(components[0], components[1], components[2], components[3]);
+
+    CGColorRef cgColor = 0;
+    if (colorSpace == sRGBColorSpace)
+        cgColor = CGColorCreate(sRGBColorSpaceRef(), components);
+    else
+        cgColor = CGColorCreate(deviceRGBColorSpaceRef(), components);
+
+    return cgColor;
 }
 
-static void setCGStrokeColor(CGContextRef context, const Color& color)
+static void setCGFillColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
-    CGFloat red, green, blue, alpha;
-    color.getRGBA(red, green, blue, alpha);
-    CGContextSetRGBStrokeColor(context, red, green, blue, alpha);
+    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
+    CGContextSetFillColorWithColor(context, cgColor);
+    CFRelease(cgColor);
+}
+
+static void setCGStrokeColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
+{
+    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
+    CGContextSetStrokeColorWithColor(context, cgColor);
+    CFRelease(cgColor);
+}
+
+static void setCGFillColorSpace(CGContextRef context, ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        break;
+    case sRGBColorSpace:
+        CGContextSetFillColorSpace(context, sRGBColorSpaceRef());
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+static void setCGStrokeColorSpace(CGContextRef context, ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        break;
+    case sRGBColorSpace:
+        CGContextSetStrokeColorSpace(context, sRGBColorSpaceRef());
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 GraphicsContext::GraphicsContext(CGContextRef cgContext)
@@ -72,8 +124,8 @@ GraphicsContext::GraphicsContext(CGContextRef cgContext)
     setPaintingDisabled(!cgContext);
     if (cgContext) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), fillColorSpace());
+        setPlatformStrokeColor(strokeColor(), strokeColorSpace());
     }
 }
 
@@ -123,7 +175,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         // We do a fill of four rects to simulate the stroke of a border.
         Color oldFillColor = fillColor();
         if (oldFillColor != strokeColor())
-            setCGFillColor(context, strokeColor());
+            setCGFillColor(context, strokeColor(), strokeColorSpace());
         CGRect rects[4] = {
             FloatRect(rect.x(), rect.y(), rect.width(), 1),
             FloatRect(rect.x(), rect.bottom() - 1, rect.width(), 1),
@@ -132,7 +184,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
         };
         CGContextFillRects(context, rects, 4);
         if (oldFillColor != strokeColor())
-            setCGFillColor(context, oldFillColor);
+            setCGFillColor(context, oldFillColor, fillColorSpace());
     }
 }
 
@@ -200,7 +252,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
-        setCGFillColor(context, strokeColor());  // The save/restore make it safe to mutate the fill color here without setting it back to the old color.
+        setCGFillColor(context, strokeColor(), strokeColorSpace());  // The save/restore make it safe to mutate the fill color here without setting it back to the old color.
         if (isVerticalLine) {
             CGContextFillRect(context, FloatRect(p1.x() - width / 2, p1.y() - width, width, width));
             CGContextFillRect(context, FloatRect(p2.x() - width / 2, p2.y(), width, width));
@@ -392,7 +444,7 @@ void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
 
-    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern.get()->createPlatformPattern(getCTM()));
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
@@ -407,7 +459,7 @@ void GraphicsContext::applyFillPattern()
 {
     CGContextRef cgContext = platformContext();
 
-    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern.get()->createPlatformPattern(getCTM()));
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
@@ -420,8 +472,8 @@ void GraphicsContext::applyFillPattern()
 
 static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPathDrawingMode& mode)
 {
-    bool shouldFill = state.fillColorSpace == PatternColorSpace || state.fillColor.alpha();
-    bool shouldStroke = state.strokeColorSpace == PatternColorSpace || (state.strokeStyle != NoStroke && state.strokeColor.alpha());
+    bool shouldFill = state.fillPattern || state.fillColor.alpha();
+    bool shouldStroke = state.strokePattern || (state.strokeStyle != NoStroke && state.strokeColor.alpha());
     bool useEOFill = state.fillRule == RULE_EVENODD;
 
     if (shouldFill) {
@@ -453,16 +505,16 @@ void GraphicsContext::drawPath()
     CGContextRef context = platformContext();
     const GraphicsContextState& state = m_common->state;
 
-    if (state.fillColorSpace == GradientColorSpace || state.strokeColorSpace == GradientColorSpace) {
+    if (state.fillGradient || state.strokeGradient) {
         // We don't have any optimized way to fill & stroke a path using gradients
         fillPath();
         strokePath();
         return;
     }
 
-    if (state.fillColorSpace == PatternColorSpace)
+    if (state.fillPattern)
         applyFillPattern();
-    if (state.strokeColorSpace == PatternColorSpace)
+    if (state.strokePattern)
         applyStrokePattern();
 
     CGPathDrawingMode drawingMode;
@@ -484,15 +536,11 @@ void GraphicsContext::fillPath()
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        fillPathWithFillRule(context, fillRule());
-        break;
-    case PatternColorSpace:
-        applyFillPattern();
-        fillPathWithFillRule(context, fillRule());
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
+    setCGFillColorSpace(context, m_common->state.fillColorSpace);
+
+    if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         if (fillRule() == RULE_EVENODD)
             CGContextEOClip(context);
@@ -501,8 +549,12 @@ void GraphicsContext::fillPath()
         CGContextConcatCTM(context, m_common->state.fillGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.fillGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.fillPattern)
+        applyFillPattern();
+    fillPathWithFillRule(context, fillRule());
 }
 
 void GraphicsContext::strokePath()
@@ -511,76 +563,83 @@ void GraphicsContext::strokePath()
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        CGContextStrokePath(context);
-        break;
-    case PatternColorSpace:
-        applyStrokePattern();
-        CGContextStrokePath(context);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
+    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
+
+    if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         CGContextReplacePathWithStrokedPath(context);
         CGContextClip(context);
         CGContextConcatCTM(context, m_common->state.strokeGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.strokeGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.strokePattern)
+        applyStrokePattern();
+    CGContextStrokePath(context);
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
         return;
+
     CGContextRef context = platformContext();
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        CGContextFillRect(context, rect);
-        break;
-    case PatternColorSpace:
-        applyFillPattern();
-        CGContextFillRect(context, rect);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
+    setCGFillColorSpace(context, m_common->state.fillColorSpace);
+
+    if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         CGContextClipToRect(context, rect);
         CGContextConcatCTM(context, m_common->state.fillGradient->gradientSpaceTransform());
         CGContextDrawShading(context, m_common->state.fillGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.fillPattern)
+        applyFillPattern();
+    CGContextFillRect(context, rect);
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
     CGContextRef context = platformContext();
     Color oldFillColor = fillColor();
-    if (oldFillColor != color)
-      setCGFillColor(context, color);
+    ColorSpace oldColorSpace = fillColorSpace();
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+      setCGFillColor(context, color, colorSpace);
+
     CGContextFillRect(context, rect);
-    if (oldFillColor != color)
-      setCGFillColor(context, oldFillColor);
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+      setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
     CGContextRef context = platformContext();
     Color oldFillColor = fillColor();
-    if (oldFillColor != color)
-        setCGFillColor(context, color);
+    ColorSpace oldColorSpace = fillColorSpace();
+
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+        setCGFillColor(context, color, colorSpace);
 
     addPath(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
     fillPath();
 
-    if (oldFillColor != color)
-        setCGFillColor(context, oldFillColor);
+    if (oldFillColor != color || oldColorSpace != colorSpace)
+        setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
 void GraphicsContext::clip(const FloatRect& rect)
@@ -680,7 +739,7 @@ void GraphicsContext::endTransparencyLayer()
     m_data->m_userToDeviceTransformKnownToBeIdentity = false;
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color& color)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -727,7 +786,7 @@ void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Col
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(width, height), blurRadius);
     else {
-        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColor(color));
+        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColorWithColorSpace(color, colorSpace));
         CGContextSetShadowWithColor(context,
                                     CGSizeMake(width, height),
                                     blurRadius,
@@ -769,15 +828,11 @@ void GraphicsContext::strokeRect(const FloatRect& r, float lineWidth)
         return;
 
     CGContextRef context = platformContext();
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        CGContextStrokeRectWithWidth(context, r, lineWidth);
-        break;
-    case PatternColorSpace:
-        applyStrokePattern();
-        CGContextStrokeRectWithWidth(context, r, lineWidth);
-        break;
-    case GradientColorSpace:
+
+    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
+    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
+
+    if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         setStrokeThickness(lineWidth);
         CGContextAddRect(context, r);
@@ -785,8 +840,12 @@ void GraphicsContext::strokeRect(const FloatRect& r, float lineWidth)
         CGContextClip(context);
         CGContextDrawShading(context, m_common->state.strokeGradient->platformGradient());
         CGContextRestoreGState(context);
-        break;
+        return;
     }
+
+    if (m_common->state.strokePattern)
+        applyStrokePattern();
+    CGContextStrokeRectWithWidth(context, r, lineWidth);
 }
 
 void GraphicsContext::setLineCap(LineCap cap)
@@ -986,10 +1045,10 @@ void GraphicsContext::drawLineForText(const IntPoint& point, int width, bool pri
     }
 
     if (fillColor() != strokeColor())
-        setCGFillColor(platformContext(), strokeColor());
+        setCGFillColor(platformContext(), strokeColor(), strokeColorSpace());
     CGContextFillRect(platformContext(), CGRectMake(x, y, lineLength, thickness));
     if (fillColor() != strokeColor())
-        setCGFillColor(platformContext(), fillColor());
+        setCGFillColor(platformContext(), fillColor(), fillColorSpace());
 
     if (restoreAntialiasMode)
         CGContextSetShouldAntialias(platformContext(), true);
@@ -1034,9 +1093,9 @@ void GraphicsContext::setImageInterpolationQuality(InterpolationQuality mode)
         quality = kCGInterpolationLow;
         break;
 
-    // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
+    // Fall through to InterpolationHigh if kCGInterpolationMedium is not usable.
     case InterpolationMedium:
-#if HAVE(CG_INTERPOLATION_MEDIUM)
+#if USE(CG_INTERPOLATION_MEDIUM)
         quality = kCGInterpolationMedium;
         break;
 #endif
@@ -1061,9 +1120,15 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
     case kCGInterpolationLow:
         return InterpolationLow;
 #if HAVE(CG_INTERPOLATION_MEDIUM)
+    // kCGInterpolationMedium is known to be present in the CGInterpolationQuality enum.
     case kCGInterpolationMedium:
+#if USE(CG_INTERPOLATION_MEDIUM)
+        // Only map to InterpolationMedium if targeting a system that understands it.
         return InterpolationMedium;
-#endif
+#else
+        return InterpolationDefault;
+#endif  // USE(CG_INTERPOLATION_MEDIUM)
+#endif  // HAVE(CG_INTERPOLATION_MEDIUM)
     case kCGInterpolationHigh:
         return InterpolationHigh;
     }
@@ -1107,11 +1172,11 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
     }
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
-    setCGStrokeColor(platformContext(), color);
+    setCGStrokeColor(platformContext(), color, colorSpace);
 }
 
 void GraphicsContext::setPlatformStrokeThickness(float thickness)
@@ -1121,11 +1186,11 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     CGContextSetLineWidth(platformContext(), thickness);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
-    setCGFillColor(platformContext(), color);
+    setCGFillColor(platformContext(), color, colorSpace);
 }
 
 void GraphicsContext::setPlatformShouldAntialias(bool enable)
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index 38c5506..ff1816f 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -27,6 +27,25 @@
 
 namespace WebCore {
 
+// FIXME: This would be in GraphicsContextCG.h if that existed.
+inline CGColorSpaceRef deviceRGBColorSpaceRef()
+{
+    static CGColorSpaceRef deviceSpace = CGColorSpaceCreateDeviceRGB();
+    return deviceSpace;
+}
+
+// FIXME: This would be in GraphicsContextCG.h if that existed.
+inline CGColorSpaceRef sRGBColorSpaceRef()
+{
+    // FIXME: Windows should be able to use kCGColorSpaceSRGB, this is tracked by http://webkit.org/b/31363.
+#if PLATFORM(WIN) || defined(BUILDING_ON_TIGER)
+    return deviceRGBColorSpaceRef();
+#else
+    static CGColorSpaceRef sRGBSpace = CGColorSpaceCreateWithName(kCGColorSpaceSRGB);
+    return sRGBSpace;
+#endif
+}
+
 class GraphicsContextPlatformPrivate {
 public:
     GraphicsContextPlatformPrivate(CGContextRef cgContext)
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index 4da7018..2e372e2 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -32,6 +32,7 @@
 #include "FloatConversion.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
+#include "GraphicsContextPlatformPrivateCG.h"
 #include "ImageObserver.h"
 #include "PDFDocumentImage.h"
 #include "PlatformString.h"
@@ -127,25 +128,46 @@ void BitmapImage::checkForSolidColor()
     }
 }
 
+static RetainPtr<CGImageRef> imageWithColorSpace(CGImageRef originalImage, ColorSpace colorSpace)
+{
+    CGColorSpaceRef originalColorSpace = CGImageGetColorSpace(originalImage);
+
+    // If the image already has a (non-device) color space, we don't want to
+    // override it, so return.
+    if (!originalColorSpace || !CFEqual(originalColorSpace, deviceRGBColorSpaceRef()))
+        return originalImage;
+
+    switch (colorSpace) {
+    case DeviceColorSpace:
+        return originalImage;
+    case sRGBColorSpace:
+        return RetainPtr<CGImageRef>(AdoptCF, CGImageCreateCopyWithColorSpace(originalImage, 
+            sRGBColorSpaceRef()));
+    }
+
+    ASSERT_NOT_REACHED();
+    return originalImage;
+}
+
 CGImageRef BitmapImage::getCGImageRef()
 {
     return frameAtIndex(0);
 }
 
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     startAnimation();
 
-    CGImageRef image = frameAtIndex(m_currentFrame);
+    RetainPtr<CGImageRef> image = frameAtIndex(m_currentFrame);
     if (!image) // If it's too early we won't have an image yet.
         return;
     
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, destRect, solidColor(), compositeOp);
+        fillWithSolidColor(ctxt, destRect, solidColor(), styleColorSpace, compositeOp);
         return;
     }
 
-    float currHeight = CGImageGetHeight(image);
+    float currHeight = CGImageGetHeight(image.get());
     if (currHeight <= srcRect.y())
         return;
 
@@ -181,10 +203,10 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
             subimageRect.setHeight(ceilf(subimageRect.height() + topPadding));
             adjustedDestRect.setHeight(subimageRect.height() / yScale);
 
-            image = CGImageCreateWithImageInRect(image, subimageRect);
+            image.adoptCF(CGImageCreateWithImageInRect(image.get(), subimageRect));
             if (currHeight < srcRect.bottom()) {
-                ASSERT(CGImageGetHeight(image) == currHeight - CGRectIntegral(srcRect).origin.y);
-                adjustedDestRect.setHeight(CGImageGetHeight(image) / yScale);
+                ASSERT(CGImageGetHeight(image.get()) == currHeight - CGRectIntegral(srcRect).origin.y);
+                adjustedDestRect.setHeight(CGImageGetHeight(image.get()) / yScale);
             }
         } else {
             adjustedDestRect.setLocation(FloatPoint(destRect.x() - srcRect.x() / xScale, destRect.y() - srcRect.y() / yScale));
@@ -204,11 +226,11 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
     CGContextScaleCTM(context, 1, -1);
     adjustedDestRect.setY(-adjustedDestRect.bottom());
 
-    // Draw the image.
-    CGContextDrawImage(context, adjustedDestRect, image);
+    // Adjust the color space.
+    image = imageWithColorSpace(image.get(), styleColorSpace);
 
-    if (shouldUseSubimage)
-        CGImageRelease(image);
+    // Draw the image.
+    CGContextDrawImage(context, adjustedDestRect, image.get());
 
     ctxt->restore();
 
@@ -223,7 +245,7 @@ static void drawPatternCallback(void* info, CGContextRef context)
 }
 
 void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     if (!nativeImageForCurrentFrame())
         return;
@@ -260,6 +282,9 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         ASSERT(h == height());
         subImage.adoptCF(CGImageCreateWithImageInRect(tileImage, tileRect));
     }
+
+    // Adjust the color space.
+    subImage = imageWithColorSpace(subImage.get(), styleColorSpace);
     
 #ifndef BUILDING_ON_TIGER
     // Leopard has an optimized call for the tiling of image patterns, but we can only use it if the image has been decoded enough that
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index 66246fe..2b2c6b0 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -35,12 +35,27 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/UnusedParam.h>
 
+using namespace std;
+
 namespace WebCore {
 
 static const CFStringRef kCGImageSourceShouldPreferRGB32 = CFSTR("kCGImageSourceShouldPreferRGB32");
 
 #if !PLATFORM(MAC)
-static void sharedBufferDerefCallback(void*, void* info)
+size_t sharedBufferGetBytesAtPosition(void* info, void* buffer, off_t position, size_t count)
+{
+    SharedBuffer* sharedBuffer = static_cast<SharedBuffer*>(info);
+    size_t sourceSize = sharedBuffer->size();
+    if (position >= sourceSize)
+        return 0;
+
+    const char* source = sharedBuffer->data() + position;
+    size_t amount = min<size_t>(count, sourceSize - position);
+    memcpy(buffer, source, amount);
+    return amount;
+}
+
+void sharedBufferRelease(void* info)
 {
     SharedBuffer* sharedBuffer = static_cast<SharedBuffer*>(info);
     sharedBuffer->deref();
@@ -110,15 +125,17 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
     // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
     // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
     RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
+    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 #else
-    // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
-    // scenes.  We use CFDataCreateWithBytesNoCopy in that case. Ensure that the SharedBuffer lives as long as the CFDataRef.
+    // Create a CGDataProvider to wrap the SharedBuffer.
     data->ref();
-    CFAllocatorContext context = {0, data, 0, 0, 0, 0, 0, &sharedBufferDerefCallback, 0};
-    RetainPtr<CFAllocatorRef> derefAllocator(AdoptCF, CFAllocatorCreate(kCFAllocatorDefault, &context));
-    RetainPtr<CFDataRef> cfData(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator.get()));
+    // We use the GetBytesAtPosition callback rather than the GetBytePointer one because SharedBuffer
+    // does not provide a way to lock down the byte pointer and guarantee that it won't move, which
+    // is a requirement for using the GetBytePointer callback.
+    CGDataProviderDirectCallbacks providerCallbacks = { 0, 0, 0, sharedBufferGetBytesAtPosition, sharedBufferRelease };
+    RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateDirect(data, data->size(), &providerCallbacks));
+    CGImageSourceUpdateDataProvider(m_decoder, dataProvider.get(), allDataReceived);
 #endif
-    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.h b/WebCore/platform/graphics/cg/ImageSourceCG.h
index d5b4b5a..76b4160 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.h
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.h
@@ -36,6 +36,10 @@ String preferredExtensionForImageSourceType(const String& type);
 
 String MIMETypeForImageSourceType(const String& type);
 
+#if !PLATFORM(MAC)
+size_t sharedBufferGetBytesAtPosition(void* info, void* buffer, off_t position, size_t count);
+#endif
+
 }
 
 #endif // ImageSourceCG_h
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 2f5c15e..67333ae 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -33,6 +33,10 @@
 #include "ImageObserver.h"
 #include <wtf/MathExtras.h>
 
+#if !PLATFORM(MAC)
+#include "ImageSourceCG.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -69,12 +73,15 @@ bool PDFDocumentImage::dataChanged(bool allDataReceived)
         // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
         // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
         RetainPtr<CFDataRef> data(AdoptCF, this->data()->createCFData());
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
 #else
-        // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
-        // scenes.  We use CFDataCreateWithBytesNoCopy in that case.
-        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull));
+        // Create a CGDataProvider to wrap the SharedBuffer.
+        // We use the GetBytesAtPosition callback rather than the GetBytePointer one because SharedBuffer
+        // does not provide a way to lock down the byte pointer and guarantee that it won't move, which
+        // is a requirement for using the GetBytePointer callback.
+        CGDataProviderDirectCallbacks providerCallbacks = { 0, 0, 0, sharedBufferGetBytesAtPosition, 0 };
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateDirect(this->data(), this->data()->size(), &providerCallbacks));
 #endif
-        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
         m_document = CGPDFDocumentCreateWithProvider(dataProvider.get());
         setCurrentPage(0);
     }
@@ -139,7 +146,7 @@ int PDFDocumentImage::pageCount() const
     return m_document ? CGPDFDocumentGetNumberOfPages(m_document) : 0;
 }
 
-void PDFDocumentImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator op)
+void PDFDocumentImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator op)
 {
     if (!m_document || m_currentPage == -1)
         return;
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.h b/WebCore/platform/graphics/cg/PDFDocumentImage.h
index 130c12c..12ab46c 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.h
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.h
@@ -58,7 +58,7 @@ namespace WebCore {
         virtual IntSize size() const;
 
         PDFDocumentImage();
-        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
         
         void setCurrentPage(int);
         int pageCount() const;
diff --git a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 229188e..9f8f354 100644
--- a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -112,12 +112,16 @@ void TransparencyAwareFontPainter::init()
 
 void TransparencyAwareFontPainter::initializeForGDI()
 {
+    m_graphicsContext->save();
     SkColor color = m_platformContext->effectiveFillColor();
+    // Used only when m_createdTransparencyLayer is true.
+    float layerAlpha = 0.0f;
     if (SkColorGetA(color) != 0xFF) {
         // When the font has some transparency, apply it by creating a new
-        // transparency layer with that opacity applied.
+        // transparency layer with that opacity applied. We'll actually create
+        // a new transparency layer after we calculate the bounding box.
         m_createdTransparencyLayer = true;
-        m_graphicsContext->beginTransparencyLayer(SkColorGetA(color) / 255.0f);
+        layerAlpha = SkColorGetA(color) / 255.0f;
         // The color should be opaque now.
         color = SkColorSetRGB(SkColorGetR(color), SkColorGetG(color), SkColorGetB(color));
     }
@@ -131,16 +135,22 @@ void TransparencyAwareFontPainter::initializeForGDI()
         // and we could do ClearType in that case.
         layerMode = TransparencyWin::TextComposite;
         layerRect = estimateTextBounds();
+        m_graphicsContext->clip(layerRect);
+        if (m_createdTransparencyLayer)
+            m_graphicsContext->beginTransparencyLayer(layerAlpha);
 
         // The transparency helper requires that we draw text in black in
         // this mode and it will apply the color.
         m_transparency.setTextCompositeColor(color);
         color = SkColorSetRGB(0, 0, 0);
-    } else if (canvasHasMultipleLayers(m_platformContext->canvas())) {
+    } else if (m_createdTransparencyLayer || canvasHasMultipleLayers(m_platformContext->canvas())) {
         // When we're drawing a web page, we know the background is opaque,
         // but if we're drawing to a layer, we still need extra work.
         layerMode = TransparencyWin::OpaqueCompositeLayer;
         layerRect = estimateTextBounds();
+        m_graphicsContext->clip(layerRect);
+        if (m_createdTransparencyLayer)
+            m_graphicsContext->beginTransparencyLayer(layerAlpha);
     } else {
         // Common case of drawing onto the bottom layer of a web page: we
         // know everything is opaque so don't need to do anything special.
@@ -167,6 +177,7 @@ TransparencyAwareFontPainter::~TransparencyAwareFontPainter()
     m_transparency.composite();
     if (m_createdTransparencyLayer)
         m_graphicsContext->endTransparencyLayer();
+    m_graphicsContext->restore();
     m_platformContext->canvas()->endPlatformPaint();
 }
 
diff --git a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
index 88035d5..6bd7d7c 100644
--- a/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/chromium/FontCustomPlatformData.cpp
@@ -42,12 +42,11 @@
 
 #include "FontPlatformData.h"
 #include "NotImplemented.h"
+#include "OpenTypeSanitizer.h"
 #include "SharedBuffer.h"
 
 #if PLATFORM(WIN_OS)
 #include <objbase.h>
-#include <t2embapi.h>
-#pragma comment(lib, "t2embed")
 #elif PLATFORM(LINUX)
 #include <cstring>
 #endif
@@ -57,13 +56,8 @@ namespace WebCore {
 FontCustomPlatformData::~FontCustomPlatformData()
 {
 #if PLATFORM(WIN_OS)
-    if (m_fontReference) {
-        if (m_name.isNull()) {
-            ULONG status;
-            TTDeleteEmbeddedFont(m_fontReference, 0, &status);
-        } else
-            RemoveFontMemResourceEx(m_fontReference);
-    }
+    if (m_fontReference)
+        RemoveFontMemResourceEx(m_fontReference);
 #elif PLATFORM(LINUX)
     if (m_fontReference)
         m_fontReference->unref();
@@ -76,19 +70,15 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     ASSERT(m_fontReference);
 
     LOGFONT logFont;
-    if (m_name.isNull())
-        TTGetNewFontName(&m_fontReference, logFont.lfFaceName, LF_FACESIZE, 0, 0);
-    else {
-        // m_name comes from createUniqueFontName, which, in turn, gets
-        // it from base64-encoded uuid (128-bit). So, m_name
-        // can never be longer than LF_FACESIZE (32).
-        if (m_name.length() + 1 >= LF_FACESIZE) {
-            ASSERT_NOT_REACHED();
-            return FontPlatformData();
-        }
-        memcpy(logFont.lfFaceName, m_name.charactersWithNullTermination(),
-               sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
+    // m_name comes from createUniqueFontName, which, in turn, gets
+    // it from base64-encoded uuid (128-bit). So, m_name
+    // can never be longer than LF_FACESIZE (32).
+    if (m_name.length() + 1 >= LF_FACESIZE) {
+        ASSERT_NOT_REACHED();
+        return FontPlatformData();
     }
+    memcpy(logFont.lfFaceName, m_name.charactersWithNullTermination(),
+           sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
 
     // FIXME: almost identical to FillLogFont in FontCacheWin.cpp.
     // Need to refactor. 
@@ -119,69 +109,6 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
 }
 
 #if PLATFORM(WIN_OS)
-// FIXME: EOTStream class and static functions in this #if block are
-// duplicated from platform/graphics/win/FontCustomPlatformData.cpp
-// and need to be shared.
-
-// Streams the concatenation of a header and font data.
-class EOTStream {
-public:
-    EOTStream(const EOTHeader& eotHeader, const SharedBuffer* fontData, size_t overlayDst, size_t overlaySrc, size_t overlayLength)
-        : m_eotHeader(eotHeader)
-        , m_fontData(fontData)
-        , m_overlayDst(overlayDst)
-        , m_overlaySrc(overlaySrc)
-        , m_overlayLength(overlayLength)
-        , m_offset(0)
-        , m_inHeader(true)
-    {
-    }
-
-    size_t read(void* buffer, size_t count);
-
-private:
-    const EOTHeader& m_eotHeader;
-    const SharedBuffer* m_fontData;
-    size_t m_overlayDst;
-    size_t m_overlaySrc;
-    size_t m_overlayLength;
-    size_t m_offset;
-    bool m_inHeader;
-};
-
-size_t EOTStream::read(void* buffer, size_t count)
-{
-    size_t bytesToRead = count;
-    if (m_inHeader) {
-        size_t bytesFromHeader = std::min(m_eotHeader.size() - m_offset, count);
-        memcpy(buffer, m_eotHeader.data() + m_offset, bytesFromHeader);
-        m_offset += bytesFromHeader;
-        bytesToRead -= bytesFromHeader;
-        if (m_offset == m_eotHeader.size()) {
-            m_inHeader = false;
-            m_offset = 0;
-        }
-    }
-    if (bytesToRead && !m_inHeader) {
-        size_t bytesFromData = std::min(m_fontData->size() - m_offset, bytesToRead);
-        memcpy(buffer, m_fontData->data() + m_offset, bytesFromData);
-        if (m_offset < m_overlayDst + m_overlayLength && m_offset + bytesFromData >= m_overlayDst) {
-            size_t dstOffset = std::max<int>(m_overlayDst - m_offset, 0);
-            size_t srcOffset = std::max<int>(0, m_offset - m_overlayDst);
-            size_t bytesToCopy = std::min(bytesFromData - dstOffset, m_overlayLength - srcOffset);
-            memcpy(reinterpret_cast<char*>(buffer) + dstOffset, m_fontData->data() + m_overlaySrc + srcOffset, bytesToCopy);
-        }
-        m_offset += bytesFromData;
-        bytesToRead -= bytesFromData;
-    }
-    return count - bytesToRead;
-}
-
-static unsigned long WINAPIV readEmbedProc(void* stream, void* buffer, unsigned long length)
-{
-    return static_cast<EOTStream*>(stream)->read(buffer, length);
-}
-
 // Creates a unique and unpredictable font name, in order to avoid collisions and to
 // not allow access from CSS.
 static String createUniqueFontName()
@@ -245,38 +172,22 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
 #if PLATFORM(WIN_OS)
-    // Introduce the font to GDI. AddFontMemResourceEx cannot be used, because it will pollute the process's
+    // Introduce the font to GDI. AddFontMemResourceEx should be used with care, because it will pollute the process's
     // font namespace (Windows has no API for creating an HFONT from data without exposing the font to the
-    // entire process first). TTLoadEmbeddedFont lets us override the font family name, so using a unique name
-    // we avoid namespace collisions.
-
+    // entire process first).
     String fontName = createUniqueFontName();
-
-    // TTLoadEmbeddedFont works only with Embedded OpenType (.eot) data,
-    // so we need to create an EOT header and prepend it to the font data.
-    EOTHeader eotHeader;
-    size_t overlayDst;
-    size_t overlaySrc;
-    size_t overlayLength;
-
-    if (!getEOTHeader(buffer, eotHeader, overlayDst, overlaySrc, overlayLength))
+    HANDLE fontReference = renameAndActivateFont(buffer, fontName);
+    if (!fontReference)
         return 0;
-
-    HANDLE fontReference;
-    ULONG privStatus;
-    ULONG status;
-    EOTStream eotStream(eotHeader, buffer, overlayDst, overlaySrc, overlayLength);
-
-    LONG loadEmbeddedFontResult = TTLoadEmbeddedFont(&fontReference, TTLOAD_PRIVATE, &privStatus, LICENSE_PREVIEWPRINT, &status, readEmbedProc, &eotStream, const_cast<LPWSTR>(fontName.charactersWithNullTermination()), 0, 0);
-    if (loadEmbeddedFontResult == E_NONE)
-        fontName = String();
-    else {
-        fontReference = renameAndActivateFont(buffer, fontName);
-        if (!fontReference)
-            return 0;
-    }
-
     return new FontCustomPlatformData(fontReference, fontName);
 #elif PLATFORM(LINUX)
     RemoteFontStream stream(buffer);
diff --git a/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp b/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
index a5a6e1f..1386163 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumLinux.cpp
@@ -46,12 +46,6 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/chromium/IconChromiumMac.cpp b/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
index 93e36ba..23ca698 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumMac.cpp
@@ -39,11 +39,6 @@
  
 namespace WebCore {
 
-PassRefPtr<Icon> Icon::createIconForFile(const String&)
-{
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     return 0;
diff --git a/WebCore/platform/graphics/chromium/IconChromiumWin.cpp b/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
index b419e6f..b0145f8 100644
--- a/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/IconChromiumWin.cpp
@@ -52,26 +52,11 @@ Icon::~Icon()
         DestroyIcon(m_icon);
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    SHFILEINFO sfi;
-    memset(&sfi, 0, sizeof(sfi));
-
-    String tmpFilename = filename;
-    if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
-        return 0;
-
-    return adoptRef(new Icon(sfi.hIcon));
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    // FIXME: support multiple files.
+    // FIXME: We can't access icons directly from renderer processes.
     // http://code.google.com/p/chromium/issues/detail?id=4092
-    if (!filenames.size())
-        return 0;
-
-    return createIconForFile(filenames[0]);
+    return 0;
 }
 
 void Icon::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index 7957d5a..6dcd595 100644
--- a/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -275,7 +275,7 @@ void TransparencyWin::setupLayerForWhiteLayer()
     if (!m_validLayer)
         return;
 
-    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white);
+    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white, DeviceColorSpace);
     // Layer rect represents the part of the original layer.
 }
 
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 2364cc4..f362148 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -111,10 +111,10 @@ void FEBlend::apply(Filter* filter)
     if (!getEffectContext())
         return;
 
-    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
     RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
 
     IntRect imageRect(IntPoint(), resultImage()->size());
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index a2ed9bd..f422157 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -164,7 +164,7 @@ void FEColorMatrix::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
     PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 0d76d8d..1d9cfff 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -165,7 +165,7 @@ void FEComponentTransfer::apply(Filter* filter)
     for (unsigned channel = 0; channel < 4; channel++)
         (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
 
-    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect drawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
     CanvasPixelArray* srcPixelArray(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 1b41165..c540cb7 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -133,32 +133,32 @@ void FEComposite::apply(Filter* filter)
     FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
-        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->subRegion()), m_in2->resultImage());
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->scaledSubRegion()), m_in2->resultImage());
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
         filterContext->restore();
         break;
     case FECOMPOSITE_OPERATOR_OUT:
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()), srcRect, CompositeDestinationOut);
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()), srcRect, CompositeDestinationOut);
         break;
     case FECOMPOSITE_OPERATOR_ATOP:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeSourceAtop);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeSourceAtop);
         break;
     case FECOMPOSITE_OPERATOR_XOR:
-        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
-        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeXOR);
+        filterContext->drawImage(m_in2->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in2->scaledSubRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, calculateDrawingRect(m_in->scaledSubRegion()), srcRect, CompositeXOR);
         break;
     case FECOMPOSITE_OPERATOR_ARITHMETIC: {
-        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
         RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
         RefPtr<ImageData> imageData(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
         CanvasPixelArray* srcPixelArrayB(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index f480f10..0b97e39 100644
--- a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -32,6 +32,8 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
+using std::max;
+
 namespace WebCore {
 
 FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
@@ -111,10 +113,12 @@ void FEGaussianBlur::apply(Filter* filter)
     if (m_x == 0 || m_y == 0)
         return;
 
-    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
-    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdx = static_cast<unsigned>(floor(m_x * filter->filterResolution().width() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * filter->filterResolution().height() * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    sdx = max(sdx, static_cast<unsigned>(1));
+    sdy = max(sdy, static_cast<unsigned>(1));
 
-    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
     RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
     CanvasPixelArray* srcPixelArray(srcImageData->data());
 
diff --git a/WebCore/platform/graphics/filters/Filter.h b/WebCore/platform/graphics/filters/Filter.h
index ee97afc..8924b94 100644
--- a/WebCore/platform/graphics/filters/Filter.h
+++ b/WebCore/platform/graphics/filters/Filter.h
@@ -22,6 +22,7 @@
 
 #if ENABLE(FILTERS)
 #include "FloatRect.h"
+#include "FloatSize.h"
 #include "ImageBuffer.h"
 #include "StringHash.h"
 
@@ -40,15 +41,21 @@ namespace WebCore {
         void setSourceImage(PassOwnPtr<ImageBuffer> sourceImage) { m_sourceImage = sourceImage; }
         ImageBuffer* sourceImage() { return m_sourceImage.get(); }
 
-        virtual FloatRect sourceImageRect() = 0;
-        virtual FloatRect filterRegion() = 0;
+        FloatSize filterResolution() const { return m_filterResolution; }
+        void setFilterResolution(const FloatSize& filterResolution) { m_filterResolution = filterResolution; }
+
+        virtual FloatRect sourceImageRect() const = 0;
+        virtual FloatRect filterRegion() const = 0;
 
         // SVG specific
-        virtual void calculateEffectSubRegion(FilterEffect*) = 0;
-        virtual bool effectBoundingBoxMode() = 0;
+        virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+        virtual FloatSize maxImageSize() const = 0;
+        virtual bool effectBoundingBoxMode() const = 0;
 
     private:
         OwnPtr<ImageBuffer> m_sourceImage;
+        FloatSize m_filterResolution;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 68900b5..5583813 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -58,21 +58,21 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
 
 IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
 {
-    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
-                                                   subRegion().y() - effectRect.y()));
+    IntPoint location = roundedIntPoint(FloatPoint(scaledSubRegion().x() - effectRect.x(),
+                                                   scaledSubRegion().y() - effectRect.y()));
     return IntRect(location, resultImage()->size());
 }
 
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
-    FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
+    FloatPoint startPoint = FloatPoint(srcRect.x() - scaledSubRegion().x(), srcRect.y() - scaledSubRegion().y());
     FloatRect drawingRect = FloatRect(startPoint, srcRect.size());
     return drawingRect;
 }
 
 GraphicsContext* FilterEffect::getEffectContext()
 {
-    IntRect bufferRect = enclosingIntRect(subRegion());
+    IntRect bufferRect = enclosingIntRect(scaledSubRegion());
     m_effectBuffer = ImageBuffer::create(bufferRect.size(), LinearRGB);
     return m_effectBuffer->context();
 }
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index b30e513..a46d795 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -44,6 +44,12 @@ namespace WebCore {
         FloatRect subRegion() const { return m_subRegion; }
         void setSubRegion(const FloatRect& subRegion) { m_subRegion = subRegion; }
 
+        FloatRect scaledSubRegion() const { return m_scaledSubRegion; }
+        void setScaledSubRegion(const FloatRect& scaledSubRegion) { m_scaledSubRegion = scaledSubRegion; }
+
+        FloatRect effectBoundaries() const { return m_effectBoundaries; }
+        void setEffectBoundaries(const FloatRect& effectBoundaries) { m_effectBoundaries = effectBoundaries; }
+
         bool hasX() { return m_hasX; }
         void setHasX(bool value) { m_hasX = value; }
 
@@ -96,7 +102,9 @@ namespace WebCore {
 
         bool m_alphaImage;
 
+        FloatRect m_effectBoundaries;
         FloatRect m_subRegion;
+        FloatRect m_scaledSubRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
         mutable OwnPtr<ImageBuffer> m_effectBuffer;
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.cpp b/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
new file mode 100644
index 0000000..33953d6
--- /dev/null
+++ b/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "ImageBufferFilter.h"
+
+#include "FloatSize.h"
+
+namespace WebCore {
+
+ImageBufferFilter::ImageBufferFilter()
+    : Filter()
+{
+    setFilterResolution(FloatSize(1.f, 1.f));
+}
+
+PassRefPtr<ImageBufferFilter> ImageBufferFilter::create()
+{
+    return adoptRef(new ImageBufferFilter());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.h b/WebCore/platform/graphics/filters/ImageBufferFilter.h
new file mode 100644
index 0000000..a2775ea
--- /dev/null
+++ b/WebCore/platform/graphics/filters/ImageBufferFilter.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *  Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ *
+ *   This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  aint with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageBufferFilter_h
+#define ImageBufferFilter_h
+
+#if ENABLE(FILTERS)
+#include "Filter.h"
+#include "FilterEffect.h"
+#include "FloatRect.h"
+#include "FloatSize.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class ImageBufferFilter : public Filter {
+public:
+    static PassRefPtr<ImageBufferFilter> create();
+
+    virtual FloatRect filterRegion() const { return FloatRect(); }
+    virtual FloatRect sourceImageRect() const { return FloatRect(); }
+
+    // SVG specific
+    virtual bool effectBoundingBoxMode() const { return false; }
+
+    virtual FloatSize maxImageSize() const { return FloatSize(); }
+    virtual void calculateEffectSubRegion(FilterEffect*) { }
+
+private:
+    ImageBufferFilter();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
+
+#endif // ImageBufferFilter_h
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 1b6309b..539bb44 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -50,6 +50,8 @@ FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -64,7 +66,7 @@ void SourceAlpha::apply(Filter* filter)
     FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
     filterContext->save();
     filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
-    filterContext->fillRect(imageRect, Color::black);
+    filterContext->fillRect(imageRect, Color::black, DeviceColorSpace);
     filterContext->restore();
 }
 
diff --git a/WebCore/platform/graphics/filters/SourceGraphic.cpp b/WebCore/platform/graphics/filters/SourceGraphic.cpp
index 023eeac..cc55618 100644
--- a/WebCore/platform/graphics/filters/SourceGraphic.cpp
+++ b/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -49,6 +49,8 @@ FloatRect SourceGraphic::calculateEffectRect(Filter* filter)
     if (filter->sourceImageRect().y() < filter->filterRegion().y())
         clippedSourceRect.setY(filter->filterRegion().y());
     setSubRegion(clippedSourceRect);
+    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setScaledSubRegion(clippedSourceRect);
     return filter->filterRegion();
 }
 
@@ -58,7 +60,7 @@ void SourceGraphic::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    filterContext->drawImage(filter->sourceImage()->image(), IntPoint());
+    filterContext->drawImage(filter->sourceImage()->image(), DeviceColorSpace, IntPoint());
 }
 
 void SourceGraphic::dump()
diff --git a/WebCore/platform/graphics/gtk/FontGtk.cpp b/WebCore/platform/graphics/gtk/FontGtk.cpp
index ee86f96..5c320e0 100644
--- a/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -259,7 +259,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 
     // Re-enable the platform shadow we disabled earlier
     if (hasShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     // Pango sometimes leaves behind paths we don't want
     cairo_new_path(cr);
diff --git a/WebCore/platform/graphics/gtk/IconGtk.cpp b/WebCore/platform/graphics/gtk/IconGtk.cpp
index e08c1ab..3563a59 100644
--- a/WebCore/platform/graphics/gtk/IconGtk.cpp
+++ b/WebCore/platform/graphics/gtk/IconGtk.cpp
@@ -87,23 +87,25 @@ static String lookupIconName(String MIMEType)
     return GTK_STOCK_FILE;
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    if (!g_path_skip_root(filename.utf8().data()))
+    if (filenames.isEmpty())
         return 0;
 
-    String MIMEType = MIMETypeRegistry::getMIMETypeForPath(filename);
-    String iconName = lookupIconName(MIMEType);
+    if (filenames.size() == 1) {
+        if (!g_path_skip_root(filenames[0].utf8().data()))
+            return 0;
 
-    RefPtr<Icon> icon = adoptRef(new Icon);
-    icon->m_icon = gtk_icon_theme_load_icon(gtk_icon_theme_get_default(), iconName.utf8().data(), 16, GTK_ICON_LOOKUP_USE_BUILTIN, NULL);
-    if (!icon->m_icon)
-        return 0;
-    return icon.release();
-}
+        String MIMEType = MIMETypeRegistry::getMIMETypeForPath(filenames[0]);
+        String iconName = lookupIconName(MIMEType);
+
+        RefPtr<Icon> icon = adoptRef(new Icon);
+        icon->m_icon = gtk_icon_theme_load_icon(gtk_icon_theme_get_default(), iconName.utf8().data(), 16, GTK_ICON_LOOKUP_USE_BUILTIN, 0);
+        if (!icon->m_icon)
+            return 0;
+        return icon.release();
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
-{
     //FIXME: Implement this
     return 0;
 }
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
index 8d1d261..a023dae 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
@@ -46,7 +46,7 @@
 #include <gst/video/video.h>
 #include <limits>
 #include <math.h>
-#include <wtf/GOwnPtr.h>
+#include <wtf/gtk/GOwnPtr.h>
 
 using namespace std;
 
@@ -66,11 +66,15 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
         LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
 
         error = MediaPlayer::Empty;
-        if (err->domain == GST_CORE_ERROR || err->domain == GST_LIBRARY_ERROR)
-            error = MediaPlayer::DecodeError;
-        else if (err->domain == GST_RESOURCE_ERROR)
+        if (err->code == GST_STREAM_ERROR_CODEC_NOT_FOUND
+            || err->code == GST_STREAM_ERROR_WRONG_TYPE
+            || err->code == GST_STREAM_ERROR_FAILED
+            || err->code == GST_CORE_ERROR_MISSING_PLUGIN
+            || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
             error = MediaPlayer::FormatError;
         else if (err->domain == GST_STREAM_ERROR)
+            error = MediaPlayer::DecodeError;
+        else if (err->domain == GST_RESOURCE_ERROR)
             error = MediaPlayer::NetworkError;
 
         if (mp)
@@ -95,6 +99,33 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
     return true;
 }
 
+static float playbackPosition(GstElement* playbin)
+{
+
+    float ret = 0.0;
+
+    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
+    if (!gst_element_query(playbin, query)) {
+        LOG_VERBOSE(Media, "Position query failed...");
+        gst_query_unref(query);
+        return ret;
+    }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+
+    // Position is available only if the pipeline is not in NULL or
+    // READY state.
+    if (position !=  static_cast<gint64>(GST_CLOCK_TIME_NONE))
+        ret = static_cast<float>(position) / static_cast<float>(GST_SECOND);
+
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
+    gst_query_unref(query);
+
+    return ret;
+}
+
 void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivate* playerPrivate)
 {
     g_return_if_fail(GST_IS_BUFFER(buffer));
@@ -115,16 +146,34 @@ void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
 
 static bool gstInitialized = false;
 
-static void do_gst_init()
+static bool do_gst_init()
 {
     // FIXME: We should pass the arguments from the command line
     if (!gstInitialized) {
-        gst_init(0, 0);
-        gstInitialized = true;
-        gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
-                             WEBKIT_TYPE_DATA_SRC);
+        GOwnPtr<GError> error;
+        gstInitialized = gst_init_check(0, 0, &error.outPtr());
+        if (!gstInitialized)
+            LOG_VERBOSE(Media, "Could not initialize GStreamer: %s",
+                        error ? error->message : "unknown error occurred");
+        else
+            gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
+                                 WEBKIT_TYPE_DATA_SRC);
 
     }
+    return gstInitialized;
+}
+
+bool MediaPlayerPrivate::isAvailable()
+{
+    if (!do_gst_init())
+        return false;
+
+    GstElementFactory* factory = gst_element_factory_find("playbin2");
+    if (factory) {
+        gst_object_unref(GST_OBJECT(factory));
+        return true;
+    }
+    return false;
 }
 
 MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
@@ -132,6 +181,8 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_playBin(0)
     , m_videoSink(0)
     , m_source(0)
+    , m_seekTime(0)
+    , m_changingRate(false)
     , m_endTime(numeric_limits<float>::infinity())
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
@@ -181,14 +232,26 @@ void MediaPlayerPrivate::load(const String& url)
 
 void MediaPlayerPrivate::play()
 {
-    LOG_VERBOSE(Media, "Play");
-    gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if (state != GST_STATE_PLAYING && pending != GST_STATE_PLAYING) {
+        LOG_VERBOSE(Media, "Play");
+        gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+    }
 }
 
 void MediaPlayerPrivate::pause()
 {
-    LOG_VERBOSE(Media, "Pause");
-    gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if (state != GST_STATE_PAUSED  && pending != GST_STATE_PAUSED) {
+        LOG_VERBOSE(Media, "Pause");
+        gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    }
 }
 
 float MediaPlayerPrivate::duration() const
@@ -202,7 +265,7 @@ float MediaPlayerPrivate::duration() const
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || timeLength == GST_CLOCK_TIME_NONE) {
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE) {
         LOG_VERBOSE(Media, "Time duration query failed.");
         return numeric_limits<float>::infinity();
     }
@@ -221,23 +284,11 @@ float MediaPlayerPrivate::currentTime() const
     if (m_errorOccured)
         return 0;
 
-    float ret = 0.0;
+    if (m_seeking)
+        return m_seekTime;
 
-    GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
-    if (!gst_element_query(m_playBin, query)) {
-        LOG_VERBOSE(Media, "Position query failed...");
-        gst_query_unref(query);
-        return ret;
-    }
+    return playbackPosition(m_playBin);
 
-    gint64 position;
-    gst_query_parse_position(query, 0, &position);
-    ret = (float) (position / 1000000000.0);
-    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
-
-    gst_query_unref(query);
-
-    return ret;
 }
 
 void MediaPlayerPrivate::seek(float time)
@@ -260,8 +311,10 @@ void MediaPlayerPrivate::seek(float time)
             GST_SEEK_TYPE_SET, sec,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
-    else
+    else {
         m_seeking = true;
+        m_seekTime = sec;
+    }
 }
 
 void MediaPlayerPrivate::setEndTime(float time)
@@ -310,10 +363,10 @@ IntSize MediaPlayerPrivate::naturalSize() const
         gfloat pixelAspectRatio;
         gint pixelAspectRatioNumerator, pixelAspectRatioDenominator;
 
-        if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps) ||
-            !gst_video_format_parse_caps(caps, NULL, &width, &height) ||
-            !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
-                                                           &pixelAspectRatioDenominator)) {
+        if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps)
+            || !gst_video_format_parse_caps(caps, 0, &width, &height)
+            || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                        &pixelAspectRatioDenominator)) {
             gst_object_unref(GST_OBJECT(pad));
             return IntSize();
         }
@@ -353,16 +406,50 @@ void MediaPlayerPrivate::setVolume(float volume)
 
 void MediaPlayerPrivate::setRate(float rate)
 {
-    if (rate == 0.0) {
-        gst_element_set_state(m_playBin, GST_STATE_PAUSED);
+    GstState state;
+    GstState pending;
+
+    gst_element_get_state(m_playBin, &state, &pending, 0);
+    if ((state != GST_STATE_PLAYING && state != GST_STATE_PAUSED)
+        || (pending == GST_STATE_PAUSED))
         return;
-    }
 
     if (m_isStreaming)
         return;
 
+    m_changingRate = true;
+    float currentPosition = playbackPosition(m_playBin) * GST_SECOND;
+    GstSeekFlags flags = (GstSeekFlags)(GST_SEEK_FLAG_FLUSH);
+    gint64 start, end;
+    bool mute = false;
+
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
-    seek(currentTime());
+    if (rate >= 0) {
+        // Mute the sound if the playback rate is too extreme.
+        // TODO: in other cases we should perform pitch adjustments.
+        mute = (bool) (rate < 0.8 || rate > 2);
+        start = currentPosition;
+        end = GST_CLOCK_TIME_NONE;
+    } else {
+        start = 0;
+        mute = true;
+
+        // If we are at beginning of media, start from the end to
+        // avoid immediate EOS.
+        if (currentPosition <= 0)
+            end = duration() * GST_SECOND;
+        else
+            end = currentPosition;
+    }
+
+    LOG_VERBOSE(Media, "Need to mute audio: %d", (int) mute);
+
+    if (!gst_element_seek(m_playBin, rate, GST_FORMAT_TIME, flags,
+                          GST_SEEK_TYPE_SET, start,
+                          GST_SEEK_TYPE_SET, end))
+        LOG_VERBOSE(Media, "Set rate to %f failed", rate);
+    else
+        g_object_set(m_playBin, "mute", mute, NULL);
 }
 
 int MediaPlayerPrivate::dataRate() const
@@ -497,6 +584,11 @@ void MediaPlayerPrivate::updateStates()
         } else
             m_paused = true;
 
+        if (m_changingRate) {
+            m_player->rateChanged();
+            m_changingRate = false;
+        }
+
         if (m_seeking) {
             shouldUpdateAfterSeek = true;
             m_seeking = false;
@@ -560,11 +652,6 @@ void MediaPlayerPrivate::loadStateChanged()
     updateStates();
 }
 
-void MediaPlayerPrivate::rateChanged()
-{
-    updateStates();
-}
-
 void MediaPlayerPrivate::sizeChanged()
 {
     notImplemented();
@@ -624,54 +711,36 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     int width = 0, height = 0;
-    int pixelAspectRatioNumerator = 0;
-    int pixelAspectRatioDenominator = 0;
-    double doublePixelAspectRatioNumerator = 0;
-    double doublePixelAspectRatioDenominator = 0;
-    double displayWidth;
-    double displayHeight;
-    double scale, gapHeight, gapWidth;
-
     GstCaps *caps = gst_buffer_get_caps(m_buffer);
+    GstVideoFormat format;
 
-    if (!gst_video_format_parse_caps(caps, NULL, &width, &height) ||
-        !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator, &pixelAspectRatioDenominator)) {
+    if (!gst_video_format_parse_caps(caps, &format, &width, &height)) {
       gst_caps_unref(caps);
       return;
     }
 
-    displayWidth = width;
-    displayHeight = height;
-    doublePixelAspectRatioNumerator = pixelAspectRatioNumerator;
-    doublePixelAspectRatioDenominator = pixelAspectRatioDenominator;
+    cairo_format_t cairoFormat;
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA)
+        cairoFormat = CAIRO_FORMAT_ARGB32;
+    else
+        cairoFormat = CAIRO_FORMAT_RGB24;
 
     cairo_t* cr = context->platformContext();
     cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(m_buffer),
-                                                               CAIRO_FORMAT_RGB24,
+                                                               cairoFormat,
                                                                width, height,
                                                                4 * width);
 
     cairo_save(cr);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-
-    displayWidth *= doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator;
-    displayHeight *= doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator;
 
-    scale = MIN (rect.width () / displayWidth, rect.height () / displayHeight);
-    displayWidth *= scale;
-    displayHeight *= scale;
+    // translate and scale the context to correct size
+    cairo_translate(cr, rect.x(), rect.y());
+    cairo_scale(cr, static_cast<double>(rect.width()) / width, static_cast<double>(rect.height()) / height);
 
-    // Calculate gap between border an picture
-    gapWidth = (rect.width() - displayWidth) / 2.0;
-    gapHeight = (rect.height() - displayHeight) / 2.0;
-
-    // paint the rectangle on the context and draw the surface inside.
-    cairo_translate(cr, rect.x() + gapWidth, rect.y() + gapHeight);
-    cairo_rectangle(cr, 0, 0, rect.width(), rect.height());
-    cairo_scale(cr, doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator,
-                doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator);
-    cairo_scale(cr, scale, scale);
+    // And paint it.
     cairo_set_source_surface(cr, src, 0, 0);
+    cairo_pattern_set_extend(cairo_get_source(cr), CAIRO_EXTEND_PAD);
+    cairo_rectangle(cr, 0, 0, width, height);
     cairo_fill(cr);
     cairo_restore(cr);
 
@@ -688,76 +757,91 @@ static HashSet<String> mimeTypeCache()
     static bool typeListInitialized = false;
 
     if (!typeListInitialized) {
-        // These subtypes are already beeing supported by WebKit itself
-        HashSet<String> ignoredApplicationSubtypes;
-        ignoredApplicationSubtypes.add(String("javascript"));
-        ignoredApplicationSubtypes.add(String("ecmascript"));
-        ignoredApplicationSubtypes.add(String("x-javascript"));
-        ignoredApplicationSubtypes.add(String("xml"));
-        ignoredApplicationSubtypes.add(String("xhtml+xml"));
-        ignoredApplicationSubtypes.add(String("rss+xml"));
-        ignoredApplicationSubtypes.add(String("atom+xml"));
-        ignoredApplicationSubtypes.add(String("x-ftp-directory"));
-        ignoredApplicationSubtypes.add(String("x-java-applet"));
-        ignoredApplicationSubtypes.add(String("x-java-bean"));
-        ignoredApplicationSubtypes.add(String("x-java-vm"));
-        ignoredApplicationSubtypes.add(String("x-shockwave-flash"));
+        // Build a whitelist of mime-types known to be supported by
+        // GStreamer.
+        HashSet<String> handledApplicationSubtypes;
+        handledApplicationSubtypes.add(String("ogg"));
+        handledApplicationSubtypes.add(String("x-3gp"));
+        handledApplicationSubtypes.add(String("vnd.rn-realmedia"));
+        handledApplicationSubtypes.add(String("x-pn-realaudio"));
 
         GList* factories = gst_type_find_factory_get_list();
         for (GList* iterator = factories; iterator; iterator = iterator->next) {
             GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
             GstCaps* caps = gst_type_find_factory_get_caps(factory);
 
-            // Splitting the capability by comma and taking the first part
-            // as capability can be something like "audio/x-wavpack, framed=(boolean)false"
-            GOwnPtr<gchar> capabilityString(gst_caps_to_string(caps));
-            gchar** capability = g_strsplit(capabilityString.get(), ",", 2);
-            gchar** mimetype = g_strsplit(capability[0], "/", 2);
-
-            // GStreamer plugins can be capable of supporting types which WebKit supports
-            // by default. In that case, we should not consider these types supportable by GStreamer.
-            // Examples of what GStreamer can support but should not be added:
-            // text/plain, text/html, image/jpeg, application/xml
-            if (g_str_equal(mimetype[0], "audio") ||
-                    g_str_equal(mimetype[0], "video") ||
-                    (g_str_equal(mimetype[0], "application") &&
-                        !ignoredApplicationSubtypes.contains(String(mimetype[1])))) {
-                cache.add(String(capability[0]));
-
-                // These formats are supported by GStreamer, but not correctly advertised
-                if (g_str_equal(capability[0], "video/x-h264") ||
-                    g_str_equal(capability[0], "audio/x-m4a")) {
+            if (!caps)
+                continue;
+
+            for (guint structureIndex = 0; structureIndex < gst_caps_get_size(caps); structureIndex++) {
+                GstStructure* structure = gst_caps_get_structure(caps, structureIndex);
+                const gchar* name = gst_structure_get_name(structure);
+                bool cached = false;
+
+                // These formats are supported by GStreamer, but not
+                // correctly advertised.
+                if (g_str_equal(name, "video/x-h264")
+                    || g_str_equal(name, "audio/x-m4a")) {
                     cache.add(String("video/mp4"));
                     cache.add(String("audio/aac"));
+                    cached = true;
                 }
 
-                if (g_str_equal(capability[0], "video/x-theora"))
+                if (g_str_equal(name, "video/x-theora")) {
                     cache.add(String("video/ogg"));
+                    cached = true;
+                }
 
-                if (g_str_equal(capability[0], "audio/x-wav"))
-                    cache.add(String("audio/wav"));
+                if (g_str_equal(name, "audio/x-vorbis")) {
+                    cache.add(String("audio/ogg"));
+                    cached = true;
+                }
 
-                if (g_str_equal(capability[0], "audio/mpeg")) {
-                    // This is what we are handling: mpegversion=(int)1, layer=(int)[ 1, 3 ]
-                    gchar** versionAndLayer = g_strsplit(capability[1], ",", 2);
+                if (g_str_equal(name, "audio/x-wav")) {
+                    cache.add(String("audio/wav"));
+                    cached = true;
+                }
 
-                    if (g_str_has_suffix (versionAndLayer[0], "(int)1")) {
-                        for (int i = 0; versionAndLayer[1][i] != '\0'; i++) {
-                            if (versionAndLayer[1][i] == '1')
+                if (g_str_equal(name, "audio/mpeg")) {
+                    cache.add(String(name));
+                    cached = true;
+
+                    // This is what we are handling:
+                    // mpegversion=(int)1, layer=(int)[ 1, 3 ]
+                    gint mpegVersion = 0;
+                    if (gst_structure_get_int(structure, "mpegversion", &mpegVersion) && (mpegVersion == 1)) {
+                        const GValue* layer = gst_structure_get_value(structure, "layer");
+                        if (G_VALUE_TYPE(layer) == GST_TYPE_INT_RANGE) {
+                            gint minLayer = gst_value_get_int_range_min(layer);
+                            gint maxLayer = gst_value_get_int_range_max(layer);
+                            if (minLayer <= 1 <= maxLayer)
                                 cache.add(String("audio/mp1"));
-                            else if (versionAndLayer[1][i] == '2')
+                            if (minLayer <= 2 <= maxLayer)
                                 cache.add(String("audio/mp2"));
-                            else if (versionAndLayer[1][i] == '3')
+                            if (minLayer <= 3 <= maxLayer)
                                 cache.add(String("audio/mp3"));
                         }
                     }
+                }
 
-                    g_strfreev(versionAndLayer);
+                if (!cached) {
+                    // GStreamer plugins can be capable of supporting
+                    // types which WebKit supports by default. In that
+                    // case, we should not consider these types
+                    // supportable by GStreamer.  Examples of what
+                    // GStreamer can support but should not be added:
+                    // text/plain, text/html, image/jpeg,
+                    // application/xml
+                    gchar** mimetype = g_strsplit(name, "/", 2);
+                    if (g_str_equal(mimetype[0], "audio")
+                        || g_str_equal(mimetype[0], "video")
+                        || (g_str_equal(mimetype[0], "application")
+                            && handledApplicationSubtypes.contains(String(mimetype[1]))))
+                        cache.add(String(name));
+
+                    g_strfreev(mimetype);
                 }
             }
-
-            g_strfreev(capability);
-            g_strfreev(mimetype);
         }
 
         gst_plugin_feature_list_free(factories);
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
index 54da420..6ab8edb 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
@@ -29,6 +29,7 @@
 
 #include <cairo.h>
 #include <glib.h>
+#include <gst/gst.h>
 
 typedef struct _WebKitVideoSink WebKitVideoSink;
 typedef struct _GstBuffer GstBuffer;
@@ -89,7 +90,6 @@ namespace WebCore {
             void setSize(const IntSize&);
 
             void loadStateChanged();
-            void rateChanged();
             void sizeChanged();
             void timeChanged();
             void volumeChanged();
@@ -109,7 +109,7 @@ namespace WebCore {
 
             static void getSupportedTypes(HashSet<String>&);
             static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
-            static bool isAvailable() { return true; }
+            static bool isAvailable();
 
             void updateStates();
             void cancelSeek();
@@ -124,6 +124,8 @@ namespace WebCore {
             GstElement* m_playBin;
             GstElement* m_videoSink;
             GstElement* m_source;
+            GstClockTime m_seekTime;
+            bool m_changingRate;
             float m_endTime;
             bool m_isEndReached;
             MediaPlayer::NetworkState m_networkState;
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
index 9a616f4..df25393 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
@@ -39,8 +39,6 @@
 #include "FontDescription.h"
 #include "GlyphBuffer.h"
 #include <cairo.h>
-#include <unicode/uchar.h>
-#include <unicode/unorm.h>
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
index b5e1a8b..5e0f8e2 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
@@ -37,21 +37,15 @@ static GstStaticPadTemplate sinktemplate = GST_STATIC_PAD_TEMPLATE("sink",
                                                                    GST_PAD_SINK, GST_PAD_ALWAYS,
 // CAIRO_FORMAT_RGB24 used to render the video buffers is little/big endian dependant.
 #if G_BYTE_ORDER == G_LITTLE_ENDIAN
-                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx)
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx ";" GST_VIDEO_CAPS_BGRA)
 #else
-                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB)
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB ";" GST_VIDEO_CAPS_ARGB)
 #endif
 );
 
 GST_DEBUG_CATEGORY_STATIC(webkit_video_sink_debug);
 #define GST_CAT_DEFAULT webkit_video_sink_debug
 
-static GstElementDetails webkit_video_sink_details =
-    GST_ELEMENT_DETAILS((gchar*) "WebKit video sink",
-                        (gchar*) "Sink/Video",
-                        (gchar*) "Sends video data from a GStreamer pipeline to a Cairo surface",
-                        (gchar*) "Alp Toker <alp@atoker.com>");
-
 enum {
     REPAINT_REQUESTED,
     LAST_SIGNAL
@@ -98,7 +92,9 @@ webkit_video_sink_base_init(gpointer g_class)
     GstElementClass* element_class = GST_ELEMENT_CLASS(g_class);
 
     gst_element_class_add_pad_template(element_class, gst_static_pad_template_get(&sinktemplate));
-    gst_element_class_set_details(element_class, &webkit_video_sink_details);
+    gst_element_class_set_details_simple(element_class, "WebKit video sink",
+            "Sink/Video", "Sends video data from a GStreamer pipeline to a Cairo surface",
+            "Alp Toker <alp@atoker.com>");
 }
 
 static void
@@ -129,11 +125,6 @@ webkit_video_sink_timeout_func(gpointer data)
         return FALSE;
     }
 
-    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
-        buffer = gst_buffer_make_metadata_writable(buffer);
-        gst_buffer_set_caps(buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(sink)));
-    }
-
     g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0, buffer);
     gst_buffer_unref(buffer);
     g_cond_signal(priv->data_cond);
@@ -157,6 +148,71 @@ webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
 
     priv->buffer = gst_buffer_ref(buffer);
 
+    // For the unlikely case where the buffer has no caps, the caps
+    // are implicitely the caps of the pad. This shouldn't happen.
+    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
+        buffer = priv->buffer = gst_buffer_make_metadata_writable(priv->buffer);
+        gst_buffer_set_caps(priv->buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(bsink)));
+    }
+
+    GstCaps *caps = GST_BUFFER_CAPS(buffer);
+    GstVideoFormat format;
+    int width, height;
+    if (G_UNLIKELY(!gst_video_format_parse_caps(caps, &format, &width, &height))) {
+        gst_buffer_unref(buffer);
+        g_mutex_unlock(priv->buffer_mutex);
+        return GST_FLOW_ERROR;
+    }
+
+    // Cairo's ARGB has pre-multiplied alpha while GStreamer's doesn't.
+    // Here we convert to Cairo's ARGB.
+    if (format == GST_VIDEO_FORMAT_ARGB || format == GST_VIDEO_FORMAT_BGRA) {
+        // Because GstBaseSink::render() only owns the buffer reference in the
+        // method scope we can't use gst_buffer_make_writable() here. Also
+        // The buffer content should not be changed here because the same buffer
+        // could be passed multiple times to this method (in theory)
+        GstBuffer *newBuffer = gst_buffer_try_new_and_alloc(GST_BUFFER_SIZE(buffer));
+
+        // Check if allocation failed
+        if (G_UNLIKELY(!newBuffer)) {
+            gst_buffer_unref(buffer);
+            g_mutex_unlock(priv->buffer_mutex);
+            return GST_FLOW_ERROR;
+        }
+
+        gst_buffer_copy_metadata(newBuffer, buffer, (GstBufferCopyFlags) GST_BUFFER_COPY_ALL);
+
+        // We don't use Color::premultipliedARGBFromColor() here because
+        // one function call per video pixel is just too expensive:
+        // For 720p/PAL for example this means 1280*720*25=23040000
+        // function calls per second!
+        unsigned short alpha;
+        const guint8 *source = GST_BUFFER_DATA(buffer);
+        guint8 *destination = GST_BUFFER_DATA(newBuffer);
+
+        for (int x = 0; x < height; x++) {
+            for (int y = 0; y < width; y++) {
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                alpha = source[3];
+                destination[0] = (source[0] * alpha + 128) / 255;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = alpha;
+#else
+                alpha = source[0];
+                destination[0] = alpha;
+                destination[1] = (source[1] * alpha + 128) / 255;
+                destination[2] = (source[2] * alpha + 128) / 255;
+                destination[3] = (source[3] * alpha + 128) / 255;
+#endif
+                source += 4;
+                destination += 4;
+            }
+        }
+        gst_buffer_unref(buffer);
+        buffer = priv->buffer = newBuffer;
+    }
+
     // Use HIGH_IDLE+20 priority, like Gtk+ for redrawing operations.
     priv->timeout_id = g_timeout_add_full(G_PRIORITY_HIGH_IDLE + 20, 0,
                                           webkit_video_sink_timeout_func,
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
index c23b8a9..4728d56 100644
--- a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -152,7 +152,7 @@ void GraphicsContext::drawConvexPolygon(size_t pointsLength, const FloatPoint* p
         m_data->m_view->StrokePolygon(bPoints, pointsLength, true, getHaikuStrokeStyle());
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -169,7 +169,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !color.alpha())
         return;
@@ -477,7 +477,7 @@ void GraphicsContext::setPlatformFont(const Font& font)
     m_data->m_view->SetFont(font.primaryFont()->platformData().font());
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -519,7 +519,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     m_data->m_view->SetPenSize(thickness);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -532,7 +532,7 @@ void GraphicsContext::clearPlatformShadow()
     notImplemented();
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&, ColorSpace)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/haiku/IconHaiku.cpp b/WebCore/platform/graphics/haiku/IconHaiku.cpp
index dccac4a..3663ee2 100644
--- a/WebCore/platform/graphics/haiku/IconHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/IconHaiku.cpp
@@ -36,12 +36,6 @@ Icon::~Icon()
     notImplemented();
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/haiku/ImageHaiku.cpp b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
index 323d6ab..df08822 100644
--- a/WebCore/platform/graphics/haiku/ImageHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
@@ -83,7 +83,7 @@ void BitmapImage::invalidatePlatformData()
 }
 
 // Drawing Routines
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     startAnimation();
 
@@ -92,7 +92,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -109,7 +109,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
     ctxt->restore();
 }
 
-void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, CompositeOperator op, const FloatRect& dstRect)
+void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, ColorSpace, CompositeOperator op, const FloatRect& dstRect)
 {
     // FIXME: finish this to support also phased position (srcPoint)
     startAnimation();
diff --git a/WebCore/platform/graphics/mac/CoreTextController.cpp b/WebCore/platform/graphics/mac/ComplexTextController.cpp
index b2682e4..265b2c3 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.cpp
+++ b/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,30 +10,24 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "CoreTextController.h"
-
-#if USE(CORE_TEXT)
+#include "ComplexTextController.h"
 
 #include "CharacterNames.h"
 #include "Font.h"
-#include "FontCache.h"
-#include "SimpleFontData.h"
 #include "TextBreakIterator.h"
-#include <wtf/MathExtras.h>
 
 using namespace std;
 
@@ -53,54 +47,7 @@ static inline CGFloat ceilCGFloat(CGFloat f)
     return static_cast<CGFloat>(ceil(f));
 }
 
-CoreTextController::CoreTextRun::CoreTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
-    : m_CTRun(ctRun)
-    , m_fontData(fontData)
-    , m_characters(characters)
-    , m_stringLocation(stringLocation)
-    , m_stringLength(stringLength)
-{
-    m_glyphCount = CTRunGetGlyphCount(ctRun);
-    m_indices = CTRunGetStringIndicesPtr(ctRun);
-    if (!m_indices) {
-        m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
-        CFDataIncreaseLength(m_indicesData.get(), m_glyphCount * sizeof(CFIndex));
-        m_indices = reinterpret_cast<const CFIndex*>(CFDataGetMutableBytePtr(m_indicesData.get()));
-        CTRunGetStringIndices(ctRun, CFRangeMake(0, 0), const_cast<CFIndex*>(m_indices));
-    }
-}
-
-// Missing glyphs run constructor. Core Text will not generate a run of missing glyphs, instead falling back on
-// glyphs from LastResort. We want to use the primary font's missing glyph in order to match the fast text code path.
-CoreTextController::CoreTextRun::CoreTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
-    : m_fontData(fontData)
-    , m_characters(characters)
-    , m_stringLocation(stringLocation)
-    , m_stringLength(stringLength)
-{
-    Vector<CFIndex, 16> indices;
-    unsigned r = 0;
-    while (r < stringLength) {
-        indices.append(r);
-        if (U_IS_SURROGATE(characters[r])) {
-            ASSERT(r + 1 < stringLength);
-            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
-            ASSERT(U_IS_TRAIL(characters[r + 1]));
-            r += 2;
-        } else
-            r++;
-    }
-    m_glyphCount = indices.size();
-    if (!ltr) {
-        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
-            std::swap(indices[r], indices[end]);
-    }
-    m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
-    CFDataAppendBytes(m_indicesData.get(), reinterpret_cast<const UInt8*>(indices.data()), m_glyphCount * sizeof(CFIndex));
-    m_indices = reinterpret_cast<const CFIndex*>(CFDataGetBytePtr(m_indicesData.get()));
-}
-
-CoreTextController::CoreTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection, HashSet<const SimpleFontData*>* fallbackFonts)
+ComplexTextController::ComplexTextController(const Font* font, const TextRun& run, bool mayUseNaturalWritingDirection, HashSet<const SimpleFontData*>* fallbackFonts)
     : m_font(*font)
     , m_run(run)
     , m_mayUseNaturalWritingDirection(mayUseNaturalWritingDirection)
@@ -111,6 +58,7 @@ CoreTextController::CoreTextController(const Font* font, const TextRun& run, boo
     , m_numGlyphsSoFar(0)
     , m_currentRun(0)
     , m_glyphInCurrentRun(0)
+    , m_characterInCurrentGlyph(0)
     , m_finalRoundingWidth(0)
     , m_fallbackFonts(fallbackFonts)
     , m_lastRoundingGlyph(0)
@@ -130,16 +78,12 @@ CoreTextController::CoreTextController(const Font* font, const TextRun& run, boo
             m_padPerSpace = ceilf(m_run.padding() / numSpaces);
     }
 
-    collectCoreTextRuns();
+    collectComplexTextRuns();
     adjustGlyphsAndAdvances();
 }
 
-int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
+int ComplexTextController::offsetForPosition(int h, bool includePartialGlyphs)
 {
-    // FIXME: For positions occurring within a ligature, we should return the closest "ligature caret" or
-    // approximate it by dividing the width of the ligature by the number of characters it encompasses.
-    // However, Core Text does not expose a low-level API for directly finding
-    // out how many characters a ligature encompasses (the "attachment count").
     if (h >= m_totalWidth)
         return m_run.ltr() ? m_end : 0;
     if (h < 0)
@@ -147,17 +91,27 @@ int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
 
     CGFloat x = h;
 
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
     size_t offsetIntoAdjustedGlyphs = 0;
 
     for (size_t r = 0; r < runCount; ++r) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[r];
-        for (unsigned j = 0; j < coreTextRun.glyphCount(); ++j) {
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[r];
+        for (unsigned j = 0; j < complexTextRun.glyphCount(); ++j) {
             CGFloat adjustedAdvance = m_adjustedAdvances[offsetIntoAdjustedGlyphs + j].width;
-            if (x <= adjustedAdvance) {
-                CFIndex hitIndex = coreTextRun.indexAt(j);
-                int stringLength = coreTextRun.stringLength();
-                TextBreakIterator* cursorPositionIterator = cursorMovementIterator(coreTextRun.characters(), stringLength);
+            if (x < adjustedAdvance) {
+                CFIndex hitGlyphStart = complexTextRun.indexAt(j);
+                CFIndex hitGlyphEnd;
+                if (m_run.ltr())
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j + 1 < complexTextRun.glyphCount() ? complexTextRun.indexAt(j + 1) : complexTextRun.stringLength());
+                else
+                    hitGlyphEnd = max<CFIndex>(hitGlyphStart, j > 0 ? complexTextRun.indexAt(j - 1) : complexTextRun.stringLength());
+
+                // FIXME: Instead of dividing the glyph's advance equially between the characters, this
+                // could use the glyph's "ligature carets". However, there is no Core Text API to get the
+                // ligature carets.
+                CFIndex hitIndex = hitGlyphStart + (hitGlyphEnd - hitGlyphStart) * (m_run.ltr() ? x / adjustedAdvance : 1 - x / adjustedAdvance);
+                int stringLength = complexTextRun.stringLength();
+                TextBreakIterator* cursorPositionIterator = cursorMovementIterator(complexTextRun.characters(), stringLength);
                 int clusterStart;
                 if (isTextBreak(cursorPositionIterator, hitIndex))
                     clusterStart = hitIndex;
@@ -168,45 +122,49 @@ int CoreTextController::offsetForPosition(int h, bool includePartialGlyphs)
                 }
 
                 if (!includePartialGlyphs)
-                    return coreTextRun.stringLocation() + clusterStart;
+                    return complexTextRun.stringLocation() + clusterStart;
 
                 int clusterEnd = textBreakFollowing(cursorPositionIterator, hitIndex);
                 if (clusterEnd == TextBreakDone)
                     clusterEnd = stringLength;
 
-                CGFloat clusterWidth = adjustedAdvance;
-                // FIXME: The search stops at the boundaries of coreTextRun. In theory, it should go on into neighboring CoreTextRuns
+                CGFloat clusterWidth;
+                // FIXME: The search stops at the boundaries of complexTextRun. In theory, it should go on into neighboring ComplexTextRuns
                 // derived from the same CTLine. In practice, we do not expect there to be more than one CTRun in a CTLine, as no
                 // reordering and on font fallback should occur within a CTLine.
                 if (clusterEnd - clusterStart > 1) {
+                    clusterWidth = adjustedAdvance;
                     int firstGlyphBeforeCluster = j - 1;
-                    while (firstGlyphBeforeCluster >= 0 && coreTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
+                    while (firstGlyphBeforeCluster >= 0 && complexTextRun.indexAt(firstGlyphBeforeCluster) >= clusterStart && complexTextRun.indexAt(firstGlyphBeforeCluster) < clusterEnd) {
                         CGFloat width = m_adjustedAdvances[offsetIntoAdjustedGlyphs + firstGlyphBeforeCluster].width;
                         clusterWidth += width;
                         x += width;
                         firstGlyphBeforeCluster--;
                     }
                     unsigned firstGlyphAfterCluster = j + 1;
-                    while (firstGlyphAfterCluster < coreTextRun.glyphCount() && coreTextRun.indexAt(firstGlyphAfterCluster) >= clusterStart && coreTextRun.indexAt(firstGlyphAfterCluster) < clusterEnd) {
+                    while (firstGlyphAfterCluster < complexTextRun.glyphCount() && complexTextRun.indexAt(firstGlyphAfterCluster) >= clusterStart && complexTextRun.indexAt(firstGlyphAfterCluster) < clusterEnd) {
                         clusterWidth += m_adjustedAdvances[offsetIntoAdjustedGlyphs + firstGlyphAfterCluster].width;
                         firstGlyphAfterCluster++;
                     }
+                } else {
+                    clusterWidth = adjustedAdvance / (hitGlyphEnd - hitGlyphStart);
+                    x -=  clusterWidth * (m_run.ltr() ? hitIndex - hitGlyphStart : hitGlyphEnd - hitIndex - 1);
                 }
                 if (x <= clusterWidth / 2)
-                    return coreTextRun.stringLocation() + (m_run.ltr() ? clusterStart : clusterEnd);
+                    return complexTextRun.stringLocation() + (m_run.ltr() ? clusterStart : clusterEnd);
                 else
-                    return coreTextRun.stringLocation() + (m_run.ltr() ? clusterEnd : clusterStart);
+                    return complexTextRun.stringLocation() + (m_run.ltr() ? clusterEnd : clusterStart);
             }
             x -= adjustedAdvance;
         }
-        offsetIntoAdjustedGlyphs += coreTextRun.glyphCount();
+        offsetIntoAdjustedGlyphs += complexTextRun.glyphCount();
     }
 
     ASSERT_NOT_REACHED();
     return 0;
 }
 
-void CoreTextController::collectCoreTextRuns()
+void ComplexTextController::collectComplexTextRuns()
 {
     if (!m_end)
         return;
@@ -227,7 +185,7 @@ void CoreTextController::collectCoreTextRuns()
     static const UChar hyphen = '-';
 
     if (hasTrailingSoftHyphen && m_run.rtl()) {
-        collectCoreTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
+        collectComplexTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
         indexOfFontTransition--;
         curr--;
     }
@@ -290,7 +248,7 @@ void CoreTextController::collectCoreTextRuns()
         if (nextGlyphData.fontData != glyphData.fontData || nextIsSmallCaps != isSmallCaps || !nextGlyphData.glyph != !glyphData.glyph) {
             int itemStart = m_run.rtl() ? index + 1 : indexOfFontTransition;
             int itemLength = m_run.rtl() ? indexOfFontTransition - index : index - indexOfFontTransition;
-            collectCoreTextRunsForCharacters((isSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, glyphData.glyph ? glyphData.fontData : 0);
+            collectComplexTextRunsForCharacters((isSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, glyphData.glyph ? glyphData.fontData : 0);
             indexOfFontTransition = index;
         }
     }
@@ -298,19 +256,15 @@ void CoreTextController::collectCoreTextRuns()
     int itemLength = m_run.rtl() ? indexOfFontTransition + 1 : m_end - indexOfFontTransition - (hasTrailingSoftHyphen ? 1 : 0);
     if (itemLength) {
         int itemStart = m_run.rtl() ? 0 : indexOfFontTransition;
-        collectCoreTextRunsForCharacters((nextIsSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, nextGlyphData.glyph ? nextGlyphData.fontData : 0);
+        collectComplexTextRunsForCharacters((nextIsSmallCaps ? m_smallCapsBuffer.data() : cp) + itemStart, itemLength, itemStart, nextGlyphData.glyph ? nextGlyphData.fontData : 0);
     }
 
     if (hasTrailingSoftHyphen && m_run.ltr())
-        collectCoreTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
+        collectComplexTextRunsForCharacters(&hyphen, 1, m_end - 1, m_font.glyphDataForCharacter(hyphen, false).fontData);
 }
 
-void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
+void ComplexTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
 {
-    // FIXME: For offsets falling inside a ligature, we should advance only as far as the appropriate "ligature caret"
-    // or divide the width of the ligature by the number of offsets it encompasses and make an advance proportional
-    // to the offsets into the ligature. However, Core Text does not expose a low-level API for
-    // directly finding out how many characters a ligature encompasses (the "attachment count").
     if (static_cast<int>(offset) > m_end)
         offset = m_end;
 
@@ -319,24 +273,44 @@ void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
 
     m_currentCharacter = offset;
 
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
 
     bool ltr = m_run.ltr();
 
     unsigned k = ltr ? m_numGlyphsSoFar : m_adjustedGlyphs.size() - 1 - m_numGlyphsSoFar;
     while (m_currentRun < runCount) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[ltr ? m_currentRun : runCount - 1 - m_currentRun];
-        size_t glyphCount = coreTextRun.glyphCount();
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[ltr ? m_currentRun : runCount - 1 - m_currentRun];
+        size_t glyphCount = complexTextRun.glyphCount();
         unsigned g = ltr ? m_glyphInCurrentRun : glyphCount - 1 - m_glyphInCurrentRun;
         while (m_glyphInCurrentRun < glyphCount) {
-            if (coreTextRun.indexAt(g) + coreTextRun.stringLocation() >= m_currentCharacter)
-                return;
+            unsigned glyphStartOffset = complexTextRun.indexAt(g);
+            unsigned glyphEndOffset;
+            if (ltr)
+                glyphEndOffset = max<unsigned>(glyphStartOffset, g + 1 < glyphCount ? complexTextRun.indexAt(g + 1) : complexTextRun.stringLength());
+            else
+                glyphEndOffset = max<unsigned>(glyphStartOffset, g > 0 ? complexTextRun.indexAt(g - 1) : complexTextRun.stringLength());
+
             CGSize adjustedAdvance = m_adjustedAdvances[k];
-            if (glyphBuffer)
-                glyphBuffer->add(m_adjustedGlyphs[k], coreTextRun.fontData(), adjustedAdvance);
-            m_runWidthSoFar += adjustedAdvance.width;
+
+            if (glyphStartOffset + complexTextRun.stringLocation() >= m_currentCharacter)
+                return;
+
+            if (glyphBuffer && !m_characterInCurrentGlyph)
+                glyphBuffer->add(m_adjustedGlyphs[k], complexTextRun.fontData(), adjustedAdvance);
+
+            unsigned oldCharacterInCurrentGlyph = m_characterInCurrentGlyph;
+            m_characterInCurrentGlyph = min(m_currentCharacter - complexTextRun.stringLocation(), glyphEndOffset) - glyphStartOffset;
+            // FIXME: Instead of dividing the glyph's advance equially between the characters, this
+            // could use the glyph's "ligature carets". However, there is no Core Text API to get the
+            // ligature carets.
+            m_runWidthSoFar += adjustedAdvance.width * (m_characterInCurrentGlyph - oldCharacterInCurrentGlyph) / (glyphEndOffset - glyphStartOffset);
+
+            if (glyphEndOffset + complexTextRun.stringLocation() > m_currentCharacter)
+                return;
+
             m_numGlyphsSoFar++;
             m_glyphInCurrentRun++;
+            m_characterInCurrentGlyph = 0;
             if (ltr) {
                 g++;
                 k++;
@@ -352,100 +326,35 @@ void CoreTextController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
         m_runWidthSoFar += m_finalRoundingWidth;
 }
 
-void CoreTextController::collectCoreTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
-{
-    if (!fontData) {
-        // Create a run of missing glyphs from the primary font.
-        m_coreTextRuns.append(CoreTextRun(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
-        return;
-    }
-
-    if (m_fallbackFonts && fontData != m_font.primaryFont())
-        m_fallbackFonts->add(fontData);
-
-    RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
-
-    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
-
-    RetainPtr<CTTypesetterRef> typesetter;
-
-    if (!m_mayUseNaturalWritingDirection || m_run.directionalOverride()) {
-        static const void* optionKeys[] = { kCTTypesetterOptionForcedEmbeddingLevel };
-        static const void* ltrOptionValues[] = { kCFBooleanFalse };
-        static const void* rtlOptionValues[] = { kCFBooleanTrue };
-        static CFDictionaryRef ltrTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, ltrOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        typesetter.adoptCF(CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
-    } else
-        typesetter.adoptCF(CTTypesetterCreateWithAttributedString(attributedString.get()));
-
-    RetainPtr<CTLineRef> line(AdoptCF, CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
-
-    CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
-
-    CFIndex runCount = CFArrayGetCount(runArray);
-
-    for (CFIndex r = 0; r < runCount; r++) {
-        CTRunRef ctRun = static_cast<CTRunRef>(CFArrayGetValueAtIndex(runArray, r));
-        ASSERT(CFGetTypeID(ctRun) == CTRunGetTypeID());
-        m_coreTextRuns.append(CoreTextRun(ctRun, fontData, cp, stringLocation, length));
-    }
-}
-
-void CoreTextController::adjustGlyphsAndAdvances()
+void ComplexTextController::adjustGlyphsAndAdvances()
 {
-    size_t runCount = m_coreTextRuns.size();
+    size_t runCount = m_complexTextRuns.size();
     for (size_t r = 0; r < runCount; ++r) {
-        const CoreTextRun& coreTextRun = m_coreTextRuns[r];
-        unsigned glyphCount = coreTextRun.glyphCount();
-        const SimpleFontData* fontData = coreTextRun.fontData();
-
-        Vector<CGGlyph, 256> glyphsVector;
-        const CGGlyph* glyphs;
-
-        Vector<CGSize, 256> advancesVector;
-        const CGSize* advances;
-
-        if (coreTextRun.ctRun()) {
-            glyphs = CTRunGetGlyphsPtr(coreTextRun.ctRun());
-            if (!glyphs) {
-                glyphsVector.grow(glyphCount);
-                CTRunGetGlyphs(coreTextRun.ctRun(), CFRangeMake(0, 0), glyphsVector.data());
-                glyphs = glyphsVector.data();
-            }
+        const ComplexTextRun& complexTextRun = *m_complexTextRuns[r];
+        unsigned glyphCount = complexTextRun.glyphCount();
+        const SimpleFontData* fontData = complexTextRun.fontData();
 
-            advances = CTRunGetAdvancesPtr(coreTextRun.ctRun());
-            if (!advances) {
-                advancesVector.grow(glyphCount);
-                CTRunGetAdvances(coreTextRun.ctRun(), CFRangeMake(0, 0), advancesVector.data());
-                advances = advancesVector.data();
-            }
-        } else {
-            // Synthesize a run of missing glyphs.
-            glyphsVector.fill(0, glyphCount);
-            glyphs = glyphsVector.data();
-            advancesVector.fill(CGSizeMake(fontData->widthForGlyph(0), 0), glyphCount);
-            advances = advancesVector.data();
-        }
+        const CGGlyph* glyphs = complexTextRun.glyphs();
+        const CGSize* advances = complexTextRun.advances();
 
         bool lastRun = r + 1 == runCount;
-        const UChar* cp = coreTextRun.characters();
+        const UChar* cp = complexTextRun.characters();
         CGFloat roundedSpaceWidth = roundCGFloat(fontData->spaceWidth());
         bool roundsAdvances = !m_font.isPrinterFont() && fontData->platformData().roundsGlyphAdvances();
         bool hasExtraSpacing = (m_font.letterSpacing() || m_font.wordSpacing() || m_padding) && !m_run.spacingDisabled();
 
 
         for (unsigned i = 0; i < glyphCount; i++) {
-            CFIndex characterIndex = coreTextRun.indexAt(i);
+            CFIndex characterIndex = complexTextRun.indexAt(i);
             UChar ch = *(cp + characterIndex);
             bool lastGlyph = lastRun && i + 1 == glyphCount;
             UChar nextCh;
             if (lastGlyph)
                 nextCh = ' ';
             else if (i + 1 < glyphCount)
-                nextCh = *(cp + coreTextRun.indexAt(i + 1));
+                nextCh = *(cp + complexTextRun.indexAt(i + 1));
             else
-                nextCh = *(m_coreTextRuns[r + 1].characters() + m_coreTextRuns[r + 1].indexAt(0));
+                nextCh = *(m_complexTextRuns[r + 1]->characters() + m_complexTextRuns[r + 1]->indexAt(0));
 
             bool treatAsSpace = Font::treatAsSpace(ch);
             CGGlyph glyph = treatAsSpace ? fontData->spaceGlyph() : glyphs[i];
@@ -533,5 +442,3 @@ void CoreTextController::adjustGlyphsAndAdvances()
 }
 
 } // namespace WebCore
-
-#endif // USE(CORE_TEXT)
diff --git a/WebCore/platform/graphics/mac/ComplexTextController.h b/WebCore/platform/graphics/mac/ComplexTextController.h
new file mode 100644
index 0000000..7a915e2
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ComplexTextController_h
+#define ComplexTextController_h
+
+#include "GlyphBuffer.h"
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+class Font;
+class SimpleFontData;
+class TextRun;
+
+class ComplexTextController {
+public:
+    ComplexTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false, HashSet<const SimpleFontData*>* fallbackFonts = 0);
+
+    // Advance and emit glyphs up to the specified character.
+    void advance(unsigned to, GlyphBuffer* = 0);
+
+    // Compute the character offset for a given x coordinate.
+    int offsetForPosition(int x, bool includePartialGlyphs);
+
+    // Returns the width of everything we've consumed so far.
+    float runWidthSoFar() const { return m_runWidthSoFar; }
+
+    float totalWidth() const { return m_totalWidth; }
+
+    // Extra width to the left of the leftmost glyph.
+    float finalRoundingWidth() const { return m_finalRoundingWidth; }
+
+private:
+    class ComplexTextRun : public RefCounted<ComplexTextRun> {
+    public:
+#if USE(CORE_TEXT)
+        static PassRefPtr<ComplexTextRun> create(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+        {
+            return adoptRef(new ComplexTextRun(ctRun, fontData, characters, stringLocation, stringLength));
+        }
+#elif USE(ATSUI)
+        static PassRefPtr<ComplexTextRun> create(ATSUTextLayout atsuTextLayout, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride)
+        {
+            return adoptRef(new ComplexTextRun(atsuTextLayout, fontData, characters, stringLocation, stringLength, ltr, directionalOverride));
+        }
+#endif
+        static PassRefPtr<ComplexTextRun> create(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+        {
+            return adoptRef(new ComplexTextRun(fontData, characters, stringLocation, stringLength, ltr));
+        }
+
+        unsigned glyphCount() const { return m_glyphCount; }
+        const SimpleFontData* fontData() const { return m_fontData; }
+        const UChar* characters() const { return m_characters; }
+        unsigned stringLocation() const { return m_stringLocation; }
+        size_t stringLength() const { return m_stringLength; }
+        CFIndex indexAt(size_t i) const { return m_indices[i]; }
+        const CGGlyph* glyphs() const { return m_glyphs; }
+        const CGSize* advances() const { return m_advances; }
+
+    private:
+#if USE(CORE_TEXT)
+        ComplexTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength);
+#elif USE(ATSUI)
+        ComplexTextRun(ATSUTextLayout, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride);
+#endif
+        ComplexTextRun(const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr);
+
+#if USE(ATSUI)
+#ifdef BUILDING_ON_TIGER
+        typedef UInt32 URefCon;
+#endif
+        static OSStatus overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef, URefCon, void*, ATSULayoutOperationCallbackStatus*);
+#endif
+
+#if USE(CORE_TEXT)
+        RetainPtr<CTRunRef> m_CTRun;
+#endif
+        unsigned m_glyphCount;
+        const SimpleFontData* m_fontData;
+        const UChar* m_characters;
+        unsigned m_stringLocation;
+        size_t m_stringLength;
+#if USE(CORE_TEXT)
+        RetainPtr<CFMutableDataRef> m_indicesData;
+        const CFIndex* m_indices;
+#elif USE(ATSUI)
+        Vector<CFIndex, 64> m_indices;
+#endif
+        Vector<CGGlyph, 64> m_glyphsVector;
+        const CGGlyph* m_glyphs;
+        Vector<CGSize, 64> m_advancesVector;
+        const CGSize* m_advances;
+#if USE(ATSUI)
+        bool m_ltr;
+        bool m_directionalOverride;
+#endif
+    };
+
+    void collectComplexTextRuns();
+    void collectComplexTextRunsForCharacters(const UChar*, unsigned length, unsigned stringLocation, const SimpleFontData*);
+    void adjustGlyphsAndAdvances();
+
+    const Font& m_font;
+    const TextRun& m_run;
+    bool m_mayUseNaturalWritingDirection;
+
+    Vector<UChar, 256> m_smallCapsBuffer;
+
+    Vector<RefPtr<ComplexTextRun>, 16> m_complexTextRuns;
+    Vector<CGSize, 256> m_adjustedAdvances;
+    Vector<CGGlyph, 256> m_adjustedGlyphs;
+ 
+    unsigned m_currentCharacter;
+    int m_end;
+
+    CGFloat m_totalWidth;
+
+    float m_runWidthSoFar;
+    unsigned m_numGlyphsSoFar;
+    size_t m_currentRun;
+    unsigned m_glyphInCurrentRun;
+    unsigned m_characterInCurrentGlyph;
+    float m_finalRoundingWidth;
+    float m_padding;
+    float m_padPerSpace;
+
+    HashSet<const SimpleFontData*>* m_fallbackFonts;
+
+    unsigned m_lastRoundingGlyph;
+};
+
+} // namespace WebCore
+
+#endif // ComplexTextController_h
diff --git a/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp b/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
new file mode 100644
index 0000000..78c588f
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2000 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ComplexTextController.h"
+
+#if USE(ATSUI)
+
+#include "CharacterNames.h"
+#include "Font.h"
+#include "ShapeArabic.h"
+
+#ifdef __LP64__
+// ATSUTextInserted() is SPI in 64-bit.
+extern "C" {
+OSStatus ATSUTextInserted(ATSUTextLayout iTextLayout,  UniCharArrayOffset iInsertionLocation, UniCharCount iInsertionLength);
+}
+#endif
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+OSStatus ComplexTextController::ComplexTextRun::overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef atsuLineRef, URefCon refCon, void*, ATSULayoutOperationCallbackStatus* callbackStatus)
+{
+    ComplexTextRun* complexTextRun = reinterpret_cast<ComplexTextRun*>(refCon);
+    OSStatus status;
+    ItemCount count;
+    ATSLayoutRecord *layoutRecords;
+
+    status = ATSUDirectGetLayoutDataArrayPtrFromLineRef(atsuLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, true, reinterpret_cast<void**>(&layoutRecords), &count);
+    if (status != noErr) {
+        *callbackStatus = kATSULayoutOperationCallbackStatusContinue;
+        return status;
+    }
+
+    count--;
+    ItemCount j = 0;
+    CFIndex indexOffset = 0;
+
+    if (complexTextRun->m_directionalOverride) {
+        j++;
+        count -= 2;
+        indexOffset = -1;
+    }
+
+    complexTextRun->m_glyphCount = count;
+    complexTextRun->m_glyphsVector.reserveCapacity(count);
+    complexTextRun->m_advancesVector.reserveCapacity(count);
+    complexTextRun->m_indices.reserveCapacity(count);
+
+    bool atBeginning = true;
+    CGFloat lastX = 0;
+
+    for (ItemCount i = 0; i < count; ++i, ++j) {
+        if (layoutRecords[j].glyphID == kATSDeletedGlyphcode) {
+            complexTextRun->m_glyphCount--;
+            continue;
+        }
+        complexTextRun->m_glyphsVector.uncheckedAppend(layoutRecords[j].glyphID);
+        complexTextRun->m_indices.uncheckedAppend(layoutRecords[j].originalOffset / 2 + indexOffset);
+        CGFloat x = FixedToFloat(layoutRecords[j].realPos);
+        if (!atBeginning)
+            complexTextRun->m_advancesVector.uncheckedAppend(CGSizeMake(x - lastX, 0));
+        lastX = x;
+        atBeginning = false;
+    }
+
+    complexTextRun->m_advancesVector.uncheckedAppend(CGSizeMake(FixedToFloat(layoutRecords[j].realPos) - lastX, 0));
+
+    complexTextRun->m_glyphs = complexTextRun->m_glyphsVector.data();
+    complexTextRun->m_advances = complexTextRun->m_advancesVector.data();
+
+    status = ATSUDirectReleaseLayoutDataArrayPtr(atsuLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, reinterpret_cast<void**>(&layoutRecords));
+    *callbackStatus = kATSULayoutOperationCallbackStatusContinue;
+    return noErr;
+}
+
+static inline bool isArabicLamWithAlefLigature(UChar c)
+{
+    return c >= 0xfef5 && c <= 0xfefc;
+}
+
+static void shapeArabic(const UChar* source, UChar* dest, unsigned totalLength)
+{
+    unsigned shapingStart = 0;
+    while (shapingStart < totalLength) {
+        unsigned shapingEnd;
+        // We do not want to pass a Lam with Alef ligature followed by a space to the shaper,
+        // since we want to be able to identify this sequence as the result of shaping a Lam
+        // followed by an Alef and padding with a space.
+        bool foundLigatureSpace = false;
+        for (shapingEnd = shapingStart; !foundLigatureSpace && shapingEnd < totalLength - 1; ++shapingEnd)
+            foundLigatureSpace = isArabicLamWithAlefLigature(source[shapingEnd]) && source[shapingEnd + 1] == ' ';
+        shapingEnd++;
+
+        UErrorCode shapingError = U_ZERO_ERROR;
+        unsigned charsWritten = shapeArabic(source + shapingStart, shapingEnd - shapingStart, dest + shapingStart, shapingEnd - shapingStart, U_SHAPE_LETTERS_SHAPE | U_SHAPE_LENGTH_FIXED_SPACES_NEAR, &shapingError);
+
+        if (U_SUCCESS(shapingError) && charsWritten == shapingEnd - shapingStart) {
+            for (unsigned j = shapingStart; j < shapingEnd - 1; ++j) {
+                if (isArabicLamWithAlefLigature(dest[j]) && dest[j + 1] == ' ')
+                    dest[++j] = zeroWidthSpace;
+            }
+            if (foundLigatureSpace) {
+                dest[shapingEnd] = ' ';
+                shapingEnd++;
+            } else if (isArabicLamWithAlefLigature(dest[shapingEnd - 1])) {
+                // u_shapeArabic quirk: if the last two characters in the source string are a Lam and an Alef,
+                // the space is put at the beginning of the string, despite U_SHAPE_LENGTH_FIXED_SPACES_NEAR.
+                ASSERT(dest[shapingStart] == ' ');
+                dest[shapingStart] = zeroWidthSpace;
+            }
+        } else {
+            // Something went wrong. Abandon shaping and just copy the rest of the buffer.
+            LOG_ERROR("u_shapeArabic failed(%d)", shapingError);
+            shapingEnd = totalLength;
+            memcpy(dest + shapingStart, source + shapingStart, (shapingEnd - shapingStart) * sizeof(UChar));
+        }
+        shapingStart = shapingEnd;
+    }
+}
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(ATSUTextLayout atsuTextLayout, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr, bool directionalOverride)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+    , m_ltr(ltr)
+    , m_directionalOverride(directionalOverride)
+{
+    OSStatus status;
+
+    status = ATSUSetTextLayoutRefCon(atsuTextLayout, reinterpret_cast<URefCon>(this));
+
+    ATSLineLayoutOptions lineLayoutOptions = kATSLineKeepSpacesOutOfMargin | kATSLineHasNoHangers;
+
+    Boolean rtl = !ltr;
+
+    Vector<UChar, 256> substituteCharacters;
+    bool shouldCheckForMirroring = !ltr && !fontData->m_ATSUMirrors;
+    bool shouldCheckForArabic = !fontData->shapesArabic();
+    bool shouldShapeArabic = false;
+
+    bool mirrored = false;
+    for (size_t i = 0; i < stringLength; ++i) {
+        if (shouldCheckForMirroring) {
+            UChar mirroredChar = u_charMirror(characters[i]);
+            if (mirroredChar != characters[i]) {
+                if (!mirrored) {
+                    mirrored = true;
+                    substituteCharacters.grow(stringLength);
+                    memcpy(substituteCharacters.data(), characters, stringLength * sizeof(UChar));
+                    ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+                }
+                substituteCharacters[i] = mirroredChar;
+            }
+        }
+        if (shouldCheckForArabic && isArabicChar(characters[i])) {
+            shouldCheckForArabic = false;
+            shouldShapeArabic = true;
+        }
+    }
+
+    if (shouldShapeArabic) {
+        Vector<UChar, 256> shapedArabic(stringLength);
+        shapeArabic(substituteCharacters.isEmpty() ? characters : substituteCharacters.data(), shapedArabic.data(), stringLength);
+        substituteCharacters.swap(shapedArabic);
+        ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+    }
+
+    if (directionalOverride) {
+        UChar override = ltr ? leftToRightOverride : rightToLeftOverride;
+        if (substituteCharacters.isEmpty()) {
+            substituteCharacters.grow(stringLength + 2);
+            substituteCharacters[0] = override;
+            memcpy(substituteCharacters.data() + 1, characters, stringLength * sizeof(UChar));
+            substituteCharacters[stringLength + 1] = popDirectionalFormatting;
+            ATSUTextMoved(atsuTextLayout, substituteCharacters.data());
+        } else {
+            substituteCharacters.prepend(override);
+            substituteCharacters.append(popDirectionalFormatting);
+        }
+        ATSUTextInserted(atsuTextLayout, 0, 2);
+    }
+
+    ATSULayoutOperationOverrideSpecifier overrideSpecifier;
+    overrideSpecifier.operationSelector = kATSULayoutOperationPostLayoutAdjustment;
+    overrideSpecifier.overrideUPP = overrideLayoutOperation;
+
+    ATSUAttributeTag tags[] = { kATSULineLayoutOptionsTag, kATSULineDirectionTag, kATSULayoutOperationOverrideTag };
+    ByteCount sizes[] = { sizeof(ATSLineLayoutOptions), sizeof(Boolean), sizeof(ATSULayoutOperationOverrideSpecifier) };
+    ATSUAttributeValuePtr values[] = { &lineLayoutOptions, &rtl, &overrideSpecifier };
+
+    status = ATSUSetLayoutControls(atsuTextLayout, 3, tags, sizes, values);
+
+    ItemCount boundsCount;
+    status = ATSUGetGlyphBounds(atsuTextLayout, 0, 0, 0, m_stringLength, kATSUseFractionalOrigins, 0, 0, &boundsCount);
+
+    status = ATSUDisposeTextLayout(atsuTextLayout);
+}
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    m_indices.reserveCapacity(stringLength);
+    unsigned r = 0;
+    while (r < stringLength) {
+        m_indices.uncheckedAppend(r);
+        if (U_IS_SURROGATE(characters[r])) {
+            ASSERT(r + 1 < stringLength);
+            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
+            ASSERT(U_IS_TRAIL(characters[r + 1]));
+            r += 2;
+        } else
+            r++;
+    }
+    m_glyphCount = m_indices.size();
+    if (!ltr) {
+        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
+            std::swap(m_indices[r], m_indices[end]);
+    }
+
+    m_glyphsVector.fill(0, m_glyphCount);
+    m_glyphs = m_glyphsVector.data();
+    m_advancesVector.fill(CGSizeMake(fontData->widthForGlyph(0), 0), m_glyphCount);
+    m_advances = m_advancesVector.data();
+}
+
+static bool fontHasMirroringInfo(ATSUFontID fontID)
+{
+    ByteCount propTableSize;
+    OSStatus status = ATSFontGetTable(fontID, 'prop', 0, 0, 0, &propTableSize);
+    if (status == noErr)    // naively assume that if a 'prop' table exists then it contains mirroring info
+        return true;
+    else if (status != kATSInvalidFontTableAccess) // anything other than a missing table is logged as an error
+        LOG_ERROR("ATSFontGetTable failed (%d)", static_cast<int>(status));
+
+    return false;
+}
+
+static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
+{
+    // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
+    // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
+    // See bugzilla 5166.
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
+        return;
+
+    ATSUFontFeatureType featureTypes[] = { kLigaturesType };
+    ATSUFontFeatureSelector featureSelectors[] = { kCommonLigaturesOffSelector };
+    OSStatus status = ATSUSetFontFeatures(fontData->m_ATSUStyle, 1, featureTypes, featureSelectors);
+    if (status != noErr)
+        LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", static_cast<int>(status));
+}
+
+static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
+{
+    if (fontData->m_ATSUStyleInitialized)
+        return;
+
+    ATSUFontID fontID = fontData->platformData().m_atsuFontID;
+    if (!fontID) {
+        LOG_ERROR("unable to get ATSUFontID for %p", fontData->platformData().font());
+        return;
+    }
+
+    OSStatus status = ATSUCreateStyle(&fontData->m_ATSUStyle);
+    if (status != noErr)
+        LOG_ERROR("ATSUCreateStyle failed (%d)", static_cast<int>(status));
+
+    Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
+    Fract kerningInhibitFactor = FloatToFract(1);
+    static CGAffineTransform verticalFlip = CGAffineTransformMakeScale(1, -1);
+
+    ByteCount styleSizes[4] = { sizeof(fontSize), sizeof(fontID), sizeof(verticalFlip), sizeof(kerningInhibitFactor) };
+    ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
+    ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &verticalFlip, &kerningInhibitFactor };
+
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    status = ATSUSetAttributes(fontData->m_ATSUStyle, allowKerning ? 3 : 4, styleTags, styleSizes, styleValues);
+    if (status != noErr)
+        LOG_ERROR("ATSUSetAttributes failed (%d)", static_cast<int>(status));
+
+    fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
+
+    disableLigatures(fontData, textMode);
+
+    fontData->m_ATSUStyleInitialized = true;
+}
+
+void ComplexTextController::collectComplexTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
+{
+    if (!fontData) {
+        // Create a run of missing glyphs from the primary font.
+        m_complexTextRuns.append(ComplexTextRun::create(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
+        return;
+    }
+
+    if (m_fallbackFonts && fontData != m_font.primaryFont())
+        m_fallbackFonts->add(fontData);
+
+    initializeATSUStyle(fontData, m_font.fontDescription().textRenderingMode());
+
+    OSStatus status;
+    ATSUTextLayout atsuTextLayout;
+    UniCharCount runLength = length;
+
+    status = ATSUCreateTextLayoutWithTextPtr(cp, 0, length, length, 1, &runLength, &fontData->m_ATSUStyle, &atsuTextLayout);
+    if (status != noErr) {
+        LOG_ERROR("ATSUCreateTextLayoutWithTextPtr failed with error %d", static_cast<int>(status));
+        return;
+    }
+    m_complexTextRuns.append(ComplexTextRun::create(atsuTextLayout, fontData, cp, stringLocation, length, m_run.ltr(), m_run.directionalOverride()));
+}
+
+} // namespace WebCore
+
+#endif // USE(ATSUI)
diff --git a/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
new file mode 100644
index 0000000..c9daf84
--- /dev/null
+++ b/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ComplexTextController.h"
+
+#if USE(CORE_TEXT)
+
+#include "Font.h"
+
+namespace WebCore {
+
+ComplexTextController::ComplexTextRun::ComplexTextRun(CTRunRef ctRun, const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength)
+    : m_CTRun(ctRun)
+    , m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    m_glyphCount = CTRunGetGlyphCount(m_CTRun.get());
+    m_indices = CTRunGetStringIndicesPtr(m_CTRun.get());
+    if (!m_indices) {
+        m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
+        CFDataIncreaseLength(m_indicesData.get(), m_glyphCount * sizeof(CFIndex));
+        m_indices = reinterpret_cast<const CFIndex*>(CFDataGetMutableBytePtr(m_indicesData.get()));
+        CTRunGetStringIndices(m_CTRun.get(), CFRangeMake(0, 0), const_cast<CFIndex*>(m_indices));
+    }
+
+    m_glyphs = CTRunGetGlyphsPtr(m_CTRun.get());
+    if (!m_glyphs) {
+        m_glyphsVector.grow(m_glyphCount);
+        CTRunGetGlyphs(m_CTRun.get(), CFRangeMake(0, 0), m_glyphsVector.data());
+        m_glyphs = m_glyphsVector.data();
+    }
+
+    m_advances = CTRunGetAdvancesPtr(m_CTRun.get());
+    if (!m_advances) {
+        m_advancesVector.grow(m_glyphCount);
+        CTRunGetAdvances(m_CTRun.get(), CFRangeMake(0, 0), m_advancesVector.data());
+        m_advances = m_advancesVector.data();
+    }
+
+}
+
+// Missing glyphs run constructor. Core Text will not generate a run of missing glyphs, instead falling back on
+// glyphs from LastResort. We want to use the primary font's missing glyph in order to match the fast text code path.
+ComplexTextController::ComplexTextRun::ComplexTextRun(const SimpleFontData* fontData, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr)
+    : m_fontData(fontData)
+    , m_characters(characters)
+    , m_stringLocation(stringLocation)
+    , m_stringLength(stringLength)
+{
+    Vector<CFIndex, 16> indices;
+    unsigned r = 0;
+    while (r < stringLength) {
+        indices.append(r);
+        if (U_IS_SURROGATE(characters[r])) {
+            ASSERT(r + 1 < stringLength);
+            ASSERT(U_IS_SURROGATE_LEAD(characters[r]));
+            ASSERT(U_IS_TRAIL(characters[r + 1]));
+            r += 2;
+        } else
+            r++;
+    }
+    m_glyphCount = indices.size();
+    if (!ltr) {
+        for (unsigned r = 0, end = m_glyphCount - 1; r < m_glyphCount / 2; ++r, --end)
+            std::swap(indices[r], indices[end]);
+    }
+    m_indicesData.adoptCF(CFDataCreateMutable(kCFAllocatorDefault, m_glyphCount * sizeof(CFIndex)));
+    CFDataAppendBytes(m_indicesData.get(), reinterpret_cast<const UInt8*>(indices.data()), m_glyphCount * sizeof(CFIndex));
+    m_indices = reinterpret_cast<const CFIndex*>(CFDataGetBytePtr(m_indicesData.get()));
+
+    // Synthesize a run of missing glyphs.
+    m_glyphsVector.fill(0, m_glyphCount);
+    m_glyphs = m_glyphsVector.data();
+    m_advancesVector.fill(CGSizeMake(m_fontData->widthForGlyph(0), 0), m_glyphCount);
+    m_advances = m_advancesVector.data();
+}
+
+void ComplexTextController::collectComplexTextRunsForCharacters(const UChar* cp, unsigned length, unsigned stringLocation, const SimpleFontData* fontData)
+{
+    if (!fontData) {
+        // Create a run of missing glyphs from the primary font.
+        m_complexTextRuns.append(ComplexTextRun::create(m_font.primaryFont(), cp, stringLocation, length, m_run.ltr()));
+        return;
+    }
+
+    if (m_fallbackFonts && fontData != m_font.primaryFont())
+        m_fallbackFonts->add(fontData);
+
+    RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
+
+    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
+
+    RetainPtr<CTTypesetterRef> typesetter;
+
+    if (!m_mayUseNaturalWritingDirection || m_run.directionalOverride()) {
+        static const void* optionKeys[] = { kCTTypesetterOptionForcedEmbeddingLevel };
+        static const void* ltrOptionValues[] = { kCFBooleanFalse };
+        static const void* rtlOptionValues[] = { kCFBooleanTrue };
+        static CFDictionaryRef ltrTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, ltrOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, sizeof(optionKeys) / sizeof(*optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+        typesetter.adoptCF(CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
+    } else
+        typesetter.adoptCF(CTTypesetterCreateWithAttributedString(attributedString.get()));
+
+    RetainPtr<CTLineRef> line(AdoptCF, CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
+
+    CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
+
+    CFIndex runCount = CFArrayGetCount(runArray);
+
+    for (CFIndex r = 0; r < runCount; r++) {
+        CTRunRef ctRun = static_cast<CTRunRef>(CFArrayGetValueAtIndex(runArray, r));
+        ASSERT(CFGetTypeID(ctRun) == CTRunGetTypeID());
+        m_complexTextRuns.append(ComplexTextRun::create(ctRun, fontData, cp, stringLocation, length));
+    }
+}
+
+} // namespace WebCore
+
+#endif // USE(CORE_TEXT)
diff --git a/WebCore/platform/graphics/mac/CoreTextController.h b/WebCore/platform/graphics/mac/CoreTextController.h
deleted file mode 100644
index 4dd6f93..0000000
--- a/WebCore/platform/graphics/mac/CoreTextController.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef CoreTextController_h
-#define CoreTextController_h
-
-#if USE(CORE_TEXT)
-
-#include "Font.h"
-#include "GlyphBuffer.h"
-#include <wtf/RetainPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class CoreTextController {
-public:
-    CoreTextController(const Font*, const TextRun&, bool mayUseNaturalWritingDirection = false, HashSet<const SimpleFontData*>* fallbackFonts = 0);
-
-    // Advance and emit glyphs up to the specified character.
-    void advance(unsigned to, GlyphBuffer* = 0);
-
-    // Compute the character offset for a given x coordinate.
-    int offsetForPosition(int x, bool includePartialGlyphs);
-
-    // Returns the width of everything we've consumed so far.
-    float runWidthSoFar() const { return m_runWidthSoFar; }
-
-    float totalWidth() const { return m_totalWidth; }
-
-    // Extra width to the left of the leftmost glyph.
-    float finalRoundingWidth() const { return m_finalRoundingWidth; }
-
-private:
-    class CoreTextRun {
-    public:
-        CoreTextRun(CTRunRef, const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength);
-        CoreTextRun(const SimpleFontData*, const UChar* characters, unsigned stringLocation, size_t stringLength, bool ltr);
-
-        CTRunRef ctRun() const { return m_CTRun.get(); }
-        unsigned glyphCount() const { return m_glyphCount; }
-        const SimpleFontData* fontData() const { return m_fontData; }
-        const UChar* characters() const { return m_characters; }
-        unsigned stringLocation() const { return m_stringLocation; }
-        size_t stringLength() const { return m_stringLength; }
-        CFIndex indexAt(size_t i) const { return m_indices[i]; }
-
-    private:
-        RetainPtr<CTRunRef> m_CTRun;
-        unsigned m_glyphCount;
-        const SimpleFontData* m_fontData;
-        const UChar* m_characters;
-        unsigned m_stringLocation;
-        size_t m_stringLength;
-        const CFIndex* m_indices;
-        // Used only if CTRunGet*Ptr fails or if this is a missing glyphs run.
-        RetainPtr<CFMutableDataRef> m_indicesData;
-    };
-
-    void collectCoreTextRuns();
-    void collectCoreTextRunsForCharacters(const UChar*, unsigned length, unsigned stringLocation, const SimpleFontData*);
-    void adjustGlyphsAndAdvances();
-
-    const Font& m_font;
-    const TextRun& m_run;
-    bool m_mayUseNaturalWritingDirection;
-
-    Vector<UChar, 256> m_smallCapsBuffer;
-
-    Vector<CoreTextRun, 16> m_coreTextRuns;
-    Vector<CGSize, 256> m_adjustedAdvances;
-    Vector<CGGlyph, 256> m_adjustedGlyphs;
- 
-    unsigned m_currentCharacter;
-    int m_end;
-
-    CGFloat m_totalWidth;
-
-    float m_runWidthSoFar;
-    unsigned m_numGlyphsSoFar;
-    size_t m_currentRun;
-    unsigned m_glyphInCurrentRun;
-    float m_finalRoundingWidth;
-    float m_padding;
-    float m_padPerSpace;
-
-    HashSet<const SimpleFontData*>* m_fallbackFonts;
-
-    unsigned m_lastRoundingGlyph;
-};
-
-} // namespace WebCore
-#endif // USE(CORE_TEXT)
-#endif // CoreTextController_h
diff --git a/WebCore/platform/graphics/mac/FontMacCoreText.cpp b/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index 9dffc7a..0db2601 100644
--- a/WebCore/platform/graphics/mac/FontMacCoreText.cpp
+++ b/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,25 +10,22 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "Font.h"
 
-#if USE(CORE_TEXT)
-
-#include "CoreTextController.h"
+#include "ComplexTextController.h"
 #include "FontFallbackList.h"
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
@@ -41,7 +38,7 @@ namespace WebCore {
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h,
                                             int from, int to) const
 {
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     controller.advance(from);
     float beforeWidth = controller.runWidthSoFar();
     controller.advance(to);
@@ -63,7 +60,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     GlyphBuffer glyphBuffer;
 
     float startX = point.x();
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     controller.advance(from);
     float beforeWidth = controller.runWidthSoFar();
     controller.advance(to, &glyphBuffer);
@@ -88,15 +85,14 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
 {
-    CoreTextController controller(this, run, true, fallbackFonts);
+    ComplexTextController controller(this, run, true, fallbackFonts);
     return controller.totalWidth();
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool includePartialGlyphs) const
 {
-    CoreTextController controller(this, run);
+    ComplexTextController controller(this, run);
     return controller.offsetForPosition(x, includePartialGlyphs);
 }
 
-}
-#endif // USE(CORE_TEXT)
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index 5e72101..256b5a4 100644
--- a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -24,6 +24,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+#include "OpenTypeSanitizer.h"
 
 namespace WebCore {
 
@@ -43,6 +44,14 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
 {
     ASSERT_ARG(buffer, buffer);
 
+#if ENABLE(OPENTYPE_SANITIZER)
+    OpenTypeSanitizer sanitizer(buffer);
+    RefPtr<SharedBuffer> transcodeBuffer = sanitizer.sanitize();
+    if (!transcodeBuffer)
+        return 0; // validation failed.
+    buffer = transcodeBuffer.get();
+#endif
+
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;
 
diff --git a/WebCore/platform/graphics/mac/FontMac.mm b/WebCore/platform/graphics/mac/FontMac.mm
index b2b9a5c..bb9561e 100644
--- a/WebCore/platform/graphics/mac/FontMac.mm
+++ b/WebCore/platform/graphics/mac/FontMac.mm
@@ -115,6 +115,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     IntSize shadowSize;
     int shadowBlur;
     Color shadowColor;
+    ColorSpace fillColorSpace = context->fillColorSpace();
     context->getShadow(shadowSize, shadowBlur, shadowColor);
 
     bool hasSimpleShadow = context->textDrawingMode() == cTextFill && shadowColor.isValid() && !shadowBlur;
@@ -123,14 +124,14 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         context->clearShadow();
         Color fillColor = context->fillColor();
         Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        context->setFillColor(shadowFillColor);
+        context->setFillColor(shadowFillColor, fillColorSpace);
         CGContextSetTextPosition(cgContext, point.x() + shadowSize.width(), point.y() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         if (font->syntheticBoldOffset()) {
             CGContextSetTextPosition(cgContext, point.x() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
-        context->setFillColor(fillColor);
+        context->setFillColor(fillColor, fillColorSpace);
     }
 
     CGContextSetTextPosition(cgContext, point.x(), point.y());
@@ -141,7 +142,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     }
 
     if (hasSimpleShadow)
-        context->setShadow(shadowSize, shadowBlur, shadowColor);
+        context->setShadow(shadowSize, shadowBlur, shadowColor, fillColorSpace);
 
     if (originalShouldUseFontSmoothing != newShouldUseFontSmoothing)
         CGContextSetShouldSmoothFonts(cgContext, originalShouldUseFontSmoothing);
diff --git a/WebCore/platform/graphics/mac/FontMacATSUI.mm b/WebCore/platform/graphics/mac/FontMacATSUI.mm
deleted file mode 100644
index 409bda4..0000000
--- a/WebCore/platform/graphics/mac/FontMacATSUI.mm
+++ /dev/null
@@ -1,635 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#import "config.h"
-#import "Font.h"
-
-#if USE(ATSUI)
-
-#import "CharacterNames.h"
-#import "GraphicsContext.h"
-#import "Logging.h"
-#import "ShapeArabic.h"
-#import "SimpleFontData.h"
-#import <AppKit/NSGraphicsContext.h>
-#import <wtf/OwnArrayPtr.h>
-
-#define SYNTHETIC_OBLIQUE_ANGLE 14
-
-#ifdef __LP64__
-#define URefCon void*
-#else
-#define URefCon UInt32
-#endif
-
-using namespace std;
-
-namespace WebCore {
-
-struct ATSULayoutParameters : Noncopyable
-{
-    ATSULayoutParameters(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts = 0)
-        : m_run(run)
-        , m_font(0)
-        , m_hasSyntheticBold(false)
-        , m_syntheticBoldPass(false)
-        , m_padPerSpace(0)
-        , m_fallbackFonts(fallbackFonts)
-    {
-    }
-
-    ~ATSULayoutParameters()
-    {
-        ATSUDisposeTextLayout(m_layout);
-    }
-
-    void initialize(const Font*, const GraphicsContext* = 0);
-
-    const TextRun& m_run;
-    
-    const Font* m_font;
-    
-    ATSUTextLayout m_layout;
-    OwnArrayPtr<const SimpleFontData*> m_fonts;
-    
-    OwnArrayPtr<UChar> m_charBuffer;
-    bool m_hasSyntheticBold;
-    bool m_syntheticBoldPass;
-    float m_padPerSpace;
-    HashSet<const SimpleFontData*>* m_fallbackFonts;
-};
-
-static TextRun copyRunForDirectionalOverrideIfNecessary(const TextRun& run, OwnArrayPtr<UChar>& charactersWithOverride)
-{
-    if (!run.directionalOverride())
-        return run;
-
-    charactersWithOverride.set(new UChar[run.length() + 2]);
-    charactersWithOverride[0] = run.rtl() ? rightToLeftOverride : leftToRightOverride;
-    memcpy(&charactersWithOverride[1], run.data(0), sizeof(UChar) * run.length());
-    charactersWithOverride[run.length() + 1] = popDirectionalFormatting;
-
-    TextRun result = run;
-    result.setText(charactersWithOverride.get(), run.length() + 2);
-    return result;
-}
-
-static bool fontHasMirroringInfo(ATSUFontID fontID)
-{
-    ByteCount propTableSize;
-    OSStatus status = ATSFontGetTable(fontID, 'prop', 0, 0, 0, &propTableSize);
-    if (status == noErr)    // naively assume that if a 'prop' table exists then it contains mirroring info
-        return true;
-    else if (status != kATSInvalidFontTableAccess) // anything other than a missing table is logged as an error
-        LOG_ERROR("ATSFontGetTable failed (%d)", status);
-
-    return false;
-}
-
-static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
-{
-    // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
-    // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
-    // See bugzilla 5166.
-    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
-        return;
-
-    ATSUFontFeatureType featureTypes[] = { kLigaturesType };
-    ATSUFontFeatureSelector featureSelectors[] = { kCommonLigaturesOffSelector };
-    OSStatus status = ATSUSetFontFeatures(fontData->m_ATSUStyle, 1, featureTypes, featureSelectors);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", status);
-}
-
-static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
-{
-    if (fontData->m_ATSUStyleInitialized)
-        return;
-
-    ATSUFontID fontID = fontData->platformData().m_atsuFontID;
-    if (!fontID) {
-        LOG_ERROR("unable to get ATSUFontID for %@", fontData->platformData().font());
-        return;
-    }
-
-    OSStatus status = ATSUCreateStyle(&fontData->m_ATSUStyle);
-    if (status != noErr)
-        // Who knows how many ATSU functions will crash when passed a NULL style...
-        LOG_ERROR("ATSUCreateStyle failed (%d)", status);
-
-    CGAffineTransform transform = CGAffineTransformMakeScale(1, -1);
-    if (fontData->platformData().m_syntheticOblique)
-        transform = CGAffineTransformConcat(transform, CGAffineTransformMake(1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, 0, 0));
-    Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
-    ByteCount styleSizes[4] = { sizeof(Fixed), sizeof(ATSUFontID), sizeof(CGAffineTransform), sizeof(Fract) };
-    
-    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
-    if (!allowKerning) {
-        // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
-        Fract kerningInhibitFactor = FloatToFract(1.0);
-        ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
-        ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
-        status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
-        if (status != noErr)
-            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
-    } else {
-        ATSUAttributeTag styleTags[3] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag };
-        ATSUAttributeValuePtr styleValues[3] = { &fontSize, &fontID, &transform, };
-        status = ATSUSetAttributes(fontData->m_ATSUStyle, 3, styleTags, styleSizes, styleValues);
-        if (status != noErr)
-            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
-    }
-
-    fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
-
-    // Turn off ligatures such as 'fi' to match the CG code path's behavior, until bug 6135 is fixed.
-    disableLigatures(fontData, textMode);
-
-    fontData->m_ATSUStyleInitialized = true;
-}
-
-static OSStatus overrideLayoutOperation(ATSULayoutOperationSelector, ATSULineRef iLineRef, URefCon iRefCon, void*, ATSULayoutOperationCallbackStatus* oCallbackStatus)
-{
-    ATSULayoutParameters* params = reinterpret_cast<ATSULayoutParameters*>(iRefCon);
-    OSStatus status;
-    ItemCount count;
-    ATSLayoutRecord *layoutRecords;
-
-    if (params->m_run.applyWordRounding()) {
-        status = ATSUDirectGetLayoutDataArrayPtrFromLineRef(iLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, true, (void **)&layoutRecords, &count);
-        if (status != noErr) {
-            *oCallbackStatus = kATSULayoutOperationCallbackStatusContinue;
-            return status;
-        }
-        
-        Fixed lastNativePos = 0;
-        float lastAdjustedPos = 0;
-        const UChar* characters = params->m_charBuffer ? params->m_charBuffer.get() : params->m_run.characters();
-        const SimpleFontData** renderers = params->m_fonts.get();
-        const SimpleFontData* renderer;
-        const SimpleFontData* lastRenderer = 0;
-        ByteCount offset = layoutRecords[0].originalOffset;
-        UChar nextCh = *(UChar *)(((char *)characters)+offset);
-        bool shouldRound = false;
-        bool syntheticBoldPass = params->m_syntheticBoldPass;
-        Fixed syntheticBoldOffset = 0;
-        bool hasExtraSpacing = (params->m_font->letterSpacing() || params->m_font->wordSpacing() || params->m_run.padding()) && !params->m_run.spacingDisabled();
-        float padding = params->m_run.padding();
-        // In the CoreGraphics code path, the rounding hack is applied in logical order.
-        // Here it is applied in visual left-to-right order, which may be better.
-        ItemCount lastRoundingChar = 0;
-        ItemCount i;
-        for (i = 1; i < count; i++) {
-            bool isLastChar = i == count - 1;
-            renderer = renderers[offset / 2];
-            float width;
-            if (nextCh == zeroWidthSpace || Font::treatAsZeroWidthSpace(nextCh) && !Font::treatAsSpace(nextCh)) {
-                width = 0;
-                layoutRecords[i-1].glyphID = renderer->spaceGlyph();
-            } else {
-                width = FixedToFloat(layoutRecords[i].realPos - lastNativePos);
-                if (renderer != lastRenderer && width) {
-                    lastRenderer = renderer;
-                    // The CoreGraphics interpretation of NSFontAntialiasedIntegerAdvancementsRenderingMode seems
-                    // to be "round each glyph's width to the nearest integer". This is not the same as ATSUI
-                    // does in any of its device-metrics modes.
-                    shouldRound = renderer->platformData().roundsGlyphAdvances();
-                    if (syntheticBoldPass)
-                        syntheticBoldOffset = FloatToFixed(renderer->syntheticBoldOffset());
-                    if (params->m_fallbackFonts && renderer != params->m_font->primaryFont())
-                        params->m_fallbackFonts->add(renderer);
-                }
-                if (shouldRound)
-                    width = roundf(width);
-                width += renderer->syntheticBoldOffset();
-                if (renderer->pitch() == FixedPitch ? width == renderer->spaceWidth() : (layoutRecords[i-1].flags & kATSGlyphInfoIsWhiteSpace))
-                    width = renderer->adjustedSpaceWidth();
-            }
-            lastNativePos = layoutRecords[i].realPos;
-
-            if (hasExtraSpacing) {
-                if (width && params->m_font->letterSpacing())
-                    width +=params->m_font->letterSpacing();
-                if (Font::treatAsSpace(nextCh)) {
-                    if (params->m_run.padding()) {
-                        if (padding < params->m_padPerSpace) {
-                            width += padding;
-                            padding = 0;
-                        } else {
-                            width += params->m_padPerSpace;
-                            padding -= params->m_padPerSpace;
-                        }
-                    }
-                    if (offset != 0 && !Font::treatAsSpace(*((UChar *)(((char *)characters)+offset) - 1)) && params->m_font->wordSpacing())
-                        width += params->m_font->wordSpacing();
-                }
-            }
-
-            UChar ch = nextCh;
-            offset = layoutRecords[i].originalOffset;
-            // Use space for nextCh at the end of the loop so that we get inside the rounding hack code.
-            // We won't actually round unless the other conditions are satisfied.
-            nextCh = isLastChar ? ' ' : *(UChar *)(((char *)characters)+offset);
-
-            if (Font::isRoundingHackCharacter(ch))
-                width = ceilf(width);
-            lastAdjustedPos = lastAdjustedPos + width;
-            if (Font::isRoundingHackCharacter(nextCh) && (!isLastChar || params->m_run.applyRunRounding())){
-                if (params->m_run.ltr())
-                    lastAdjustedPos = ceilf(lastAdjustedPos);
-                else {
-                    float roundingWidth = ceilf(lastAdjustedPos) - lastAdjustedPos;
-                    Fixed rw = FloatToFixed(roundingWidth);
-                    ItemCount j;
-                    for (j = lastRoundingChar; j < i; j++)
-                        layoutRecords[j].realPos += rw;
-                    lastRoundingChar = i;
-                    lastAdjustedPos += roundingWidth;
-                }
-            }
-            if (syntheticBoldPass) {
-                if (syntheticBoldOffset)
-                    layoutRecords[i-1].realPos += syntheticBoldOffset;
-                else
-                    layoutRecords[i-1].glyphID = renderer->spaceGlyph();
-            }
-            layoutRecords[i].realPos = FloatToFixed(lastAdjustedPos);
-        }
-        
-        status = ATSUDirectReleaseLayoutDataArrayPtr(iLineRef, kATSUDirectDataLayoutRecordATSLayoutRecordCurrent, (void **)&layoutRecords);
-    }
-    *oCallbackStatus = kATSULayoutOperationCallbackStatusHandled;
-    return noErr;
-}
-
-static inline bool isArabicLamWithAlefLigature(UChar c)
-{
-    return c >= 0xfef5 && c <= 0xfefc;
-}
-
-static void shapeArabic(const UChar* source, UChar* dest, unsigned totalLength, unsigned shapingStart)
-{
-    while (shapingStart < totalLength) {
-        unsigned shapingEnd;
-        // We do not want to pass a Lam with Alef ligature followed by a space to the shaper,
-        // since we want to be able to identify this sequence as the result of shaping a Lam
-        // followed by an Alef and padding with a space.
-        bool foundLigatureSpace = false;
-        for (shapingEnd = shapingStart; !foundLigatureSpace && shapingEnd < totalLength - 1; ++shapingEnd)
-            foundLigatureSpace = isArabicLamWithAlefLigature(source[shapingEnd]) && source[shapingEnd + 1] == ' ';
-        shapingEnd++;
-
-        UErrorCode shapingError = U_ZERO_ERROR;
-        unsigned charsWritten = shapeArabic(source + shapingStart, shapingEnd - shapingStart, dest + shapingStart, shapingEnd - shapingStart, U_SHAPE_LETTERS_SHAPE | U_SHAPE_LENGTH_FIXED_SPACES_NEAR, &shapingError);
-
-        if (U_SUCCESS(shapingError) && charsWritten == shapingEnd - shapingStart) {
-            for (unsigned j = shapingStart; j < shapingEnd - 1; ++j) {
-                if (isArabicLamWithAlefLigature(dest[j]) && dest[j + 1] == ' ')
-                    dest[++j] = zeroWidthSpace;
-            }
-            if (foundLigatureSpace) {
-                dest[shapingEnd] = ' ';
-                shapingEnd++;
-            } else if (isArabicLamWithAlefLigature(dest[shapingEnd - 1])) {
-                // u_shapeArabic quirk: if the last two characters in the source string are a Lam and an Alef,
-                // the space is put at the beginning of the string, despite U_SHAPE_LENGTH_FIXED_SPACES_NEAR.
-                ASSERT(dest[shapingStart] == ' ');
-                dest[shapingStart] = zeroWidthSpace;
-            }
-        } else {
-            // Something went wrong. Abandon shaping and just copy the rest of the buffer.
-            LOG_ERROR("u_shapeArabic failed(%d)", shapingError);
-            shapingEnd = totalLength;
-            memcpy(dest + shapingStart, source + shapingStart, (shapingEnd - shapingStart) * sizeof(UChar));
-        }
-        shapingStart = shapingEnd;
-    }
-}
-
-void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* graphicsContext)
-{
-    m_font = font;
-    
-    const SimpleFontData* fontData = font->primaryFont();
-    m_fonts.set(new const SimpleFontData*[m_run.length()]);
-    if (font->isSmallCaps())
-        m_charBuffer.set(new UChar[m_run.length()]);
-    
-    ATSUTextLayout layout;
-    OSStatus status;
-    ATSULayoutOperationOverrideSpecifier overrideSpecifier;
-    
-    initializeATSUStyle(fontData, m_font->fontDescription().textRenderingMode());
-    
-    // FIXME: This is currently missing the following required features that the CoreGraphics code path has:
-    // - \n, \t, and nonbreaking space render as a space.
-
-    UniCharCount runLength = m_run.length();
-
-    if (m_charBuffer)
-        memcpy(m_charBuffer.get(), m_run.characters(), runLength * sizeof(UChar));
-    
-    status = ATSUCreateTextLayoutWithTextPtr(
-            (m_charBuffer ? m_charBuffer.get() : m_run.characters()),
-            0,        // offset
-            runLength,      // length
-            runLength,    // total length
-            1,              // styleRunCount
-            &runLength,     // length of style run
-            &fontData->m_ATSUStyle, 
-            &layout);
-    if (status != noErr)
-        LOG_ERROR("ATSUCreateTextLayoutWithTextPtr failed(%d)", status);
-    m_layout = layout;
-    ATSUSetTextLayoutRefCon(m_layout, (URefCon)this);
-
-    // FIXME: There are certain times when this method is called, when we don't have access to a GraphicsContext
-    // measuring text runs with floatWidthForComplexText is one example.
-    // ATSUI requires that we pass a valid CGContextRef to it when specifying kATSUCGContextTag (crashes when passed 0)
-    // ATSUI disables sub-pixel rendering if kATSUCGContextTag is not specified!  So we're in a bind.
-    // Sometimes [[NSGraphicsContext currentContext] graphicsPort] may return the wrong (or no!) context.  Nothing we can do about it (yet).
-    CGContextRef cgContext = graphicsContext ? graphicsContext->platformContext() : (CGContextRef)[[NSGraphicsContext currentContext] graphicsPort];
-    
-    ATSLineLayoutOptions lineLayoutOptions = kATSLineKeepSpacesOutOfMargin | kATSLineHasNoHangers;
-    Boolean rtl = m_run.rtl();
-    overrideSpecifier.operationSelector = kATSULayoutOperationPostLayoutAdjustment;
-    overrideSpecifier.overrideUPP = overrideLayoutOperation;
-    ATSUAttributeTag tags[] = { kATSUCGContextTag, kATSULineLayoutOptionsTag, kATSULineDirectionTag, kATSULayoutOperationOverrideTag };
-    ByteCount sizes[] = { sizeof(CGContextRef), sizeof(ATSLineLayoutOptions), sizeof(Boolean), sizeof(ATSULayoutOperationOverrideSpecifier) };
-    ATSUAttributeValuePtr values[] = { &cgContext, &lineLayoutOptions, &rtl, &overrideSpecifier };
-    
-    status = ATSUSetLayoutControls(layout, (m_run.applyWordRounding() ? 4 : 3), tags, sizes, values);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetLayoutControls failed(%d)", status);
-
-    status = ATSUSetTransientFontMatching(layout, YES);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetTransientFontMatching failed(%d)", status);
-
-    m_hasSyntheticBold = false;
-    ATSUFontID ATSUSubstituteFont;
-    UniCharArrayOffset substituteOffset = 0;
-    UniCharCount substituteLength;
-    UniCharArrayOffset lastOffset;
-    const SimpleFontData* substituteFontData = 0;
-
-    while (substituteOffset < runLength) {
-        // FIXME: Using ATSUMatchFontsToText() here results in several problems: the CSS font family list is not necessarily followed for the 2nd
-        // and onwards unmatched characters; segmented fonts do not work correctly; behavior does not match the simple text and Uniscribe code
-        // paths. Change this function to use Font::glyphDataForCharacter() for each character instead. 
-        lastOffset = substituteOffset;
-        status = ATSUMatchFontsToText(layout, substituteOffset, kATSUToTextEnd, &ATSUSubstituteFont, &substituteOffset, &substituteLength);
-        if (status == kATSUFontsMatched || status == kATSUFontsNotMatched) {
-            const FontData* fallbackFontData = m_font->fontDataForCharacters(m_run.characters() + substituteOffset, substituteLength);
-            substituteFontData = fallbackFontData ? fallbackFontData->fontDataForCharacter(m_run[0]) : 0;
-            if (substituteFontData) {
-                initializeATSUStyle(substituteFontData, m_font->fontDescription().textRenderingMode());
-                if (substituteFontData->m_ATSUStyle)
-                    ATSUSetRunStyle(layout, substituteFontData->m_ATSUStyle, substituteOffset, substituteLength);
-            } else
-                substituteFontData = fontData;
-        } else {
-            substituteOffset = runLength;
-            substituteLength = 0;
-        }
-
-        bool shapedArabic = false;
-        bool isSmallCap = false;
-        UniCharArrayOffset firstSmallCap = 0;
-        const SimpleFontData *r = fontData;
-        UniCharArrayOffset i;
-        for (i = lastOffset;  ; i++) {
-            if (i == substituteOffset || i == substituteOffset + substituteLength) {
-                if (isSmallCap) {
-                    isSmallCap = false;
-                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()), m_font->fontDescription().textRenderingMode());
-                    ATSUSetRunStyle(layout, r->smallCapsFontData(m_font->fontDescription())->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
-                }
-                if (i == substituteOffset && substituteLength > 0)
-                    r = substituteFontData;
-                else
-                    break;
-            }
-            if (!shapedArabic && WTF::Unicode::isArabicChar(m_run[i]) && !r->shapesArabic()) {
-                shapedArabic = true;
-                if (!m_charBuffer) {
-                    m_charBuffer.set(new UChar[runLength]);
-                    memcpy(m_charBuffer.get(), m_run.characters(), i * sizeof(UChar));
-                    ATSUTextMoved(layout, m_charBuffer.get());
-                }
-                shapeArabic(m_run.characters(), m_charBuffer.get(), runLength, i);
-            }
-            if (m_run.rtl() && !r->m_ATSUMirrors) {
-                UChar mirroredChar = u_charMirror(m_run[i]);
-                if (mirroredChar != m_run[i]) {
-                    if (!m_charBuffer) {
-                        m_charBuffer.set(new UChar[runLength]);
-                        memcpy(m_charBuffer.get(), m_run.characters(), runLength * sizeof(UChar));
-                        ATSUTextMoved(layout, m_charBuffer.get());
-                    }
-                    m_charBuffer[i] = mirroredChar;
-                }
-            }
-            if (m_font->isSmallCaps()) {
-                const SimpleFontData* smallCapsData = r->smallCapsFontData(m_font->fontDescription());
-                UChar c = m_charBuffer[i];
-                UChar newC;
-                if (U_GET_GC_MASK(c) & U_GC_M_MASK)
-                    m_fonts[i] = isSmallCap ? smallCapsData : r;
-                else if (!u_isUUppercase(c) && (newC = u_toupper(c)) != c) {
-                    m_charBuffer[i] = newC;
-                    if (!isSmallCap) {
-                        isSmallCap = true;
-                        firstSmallCap = i;
-                    }
-                    m_fonts[i] = smallCapsData;
-                } else {
-                    if (isSmallCap) {
-                        isSmallCap = false;
-                        initializeATSUStyle(smallCapsData, m_font->fontDescription().textRenderingMode());
-                        ATSUSetRunStyle(layout, smallCapsData->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
-                    }
-                    m_fonts[i] = r;
-                }
-            } else
-                m_fonts[i] = r;
-            if (m_fonts[i]->syntheticBoldOffset())
-                m_hasSyntheticBold = true;
-        }
-        substituteOffset += substituteLength;
-    }
-    if (m_run.padding()) {
-        float numSpaces = 0;
-        unsigned k;
-        for (k = 0; k < runLength; k++)
-            if (Font::treatAsSpace(m_run[k]))
-                numSpaces++;
-
-        if (numSpaces == 0)
-            m_padPerSpace = 0;
-        else
-            m_padPerSpace = ceilf(m_run.padding() / numSpaces);
-    } else
-        m_padPerSpace = 0;
-}
-
-FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& point, int h, int from, int to) const
-{
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-    if (run.directionalOverride()) {
-        from++;
-        to++;
-    }
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this);
-
-    ATSTrapezoid firstGlyphBounds;
-    ItemCount actualNumBounds;
-    
-    OSStatus status = ATSUGetGlyphBounds(params.m_layout, 0, 0, from, to - from, kATSUseFractionalOrigins, 1, &firstGlyphBounds, &actualNumBounds);
-    if (status != noErr || actualNumBounds != 1) {
-        static ATSTrapezoid zeroTrapezoid = { {0, 0}, {0, 0}, {0, 0}, {0, 0} };
-        firstGlyphBounds = zeroTrapezoid;
-    }
-    
-    float beforeWidth = min(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
-    float afterWidth = max(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
-    
-    FloatRect rect(point.x() + floorf(beforeWidth), point.y(), roundf(afterWidth) - floorf(beforeWidth), h);
-
-    return rect;
-}
-
-void Font::drawComplexText(GraphicsContext* graphicsContext, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
-    OSStatus status;
-    
-    int drawPortionLength = to - from;
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-    if (run.directionalOverride())
-        from++;
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this, graphicsContext);
-    
-    // ATSUI can't draw beyond -32768 to +32767 so we translate the CTM and tell ATSUI to draw at (0, 0).
-    CGContextRef context = graphicsContext->platformContext();
-    CGContextTranslateCTM(context, point.x(), point.y());
-
-    IntSize shadowSize;
-    int shadowBlur;
-    Color shadowColor;
-    graphicsContext->getShadow(shadowSize, shadowBlur, shadowColor);
-
-    bool hasSimpleShadow = graphicsContext->textDrawingMode() == cTextFill && shadowColor.isValid() && !shadowBlur;
-    if (hasSimpleShadow) {
-        // Paint simple shadows ourselves instead of relying on CG shadows, to avoid losing subpixel antialiasing.
-        graphicsContext->clearShadow();
-        Color fillColor = graphicsContext->fillColor();
-        Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        graphicsContext->setFillColor(shadowFillColor);
-        CGContextTranslateCTM(context, shadowSize.width(), shadowSize.height());
-        status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-        if (status == noErr && params.m_hasSyntheticBold) {
-            // Force relayout for the bold pass
-            ATSUClearLayoutCache(params.m_layout, 0);
-            params.m_syntheticBoldPass = true;
-            status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-            // Force relayout for the next pass
-            ATSUClearLayoutCache(params.m_layout, 0);
-            params.m_syntheticBoldPass = false;
-        }
-        CGContextTranslateCTM(context, -shadowSize.width(), -shadowSize.height());
-        graphicsContext->setFillColor(fillColor);
-    }
-
-    status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-    if (status == noErr && params.m_hasSyntheticBold) {
-        // Force relayout for the bold pass
-        ATSUClearLayoutCache(params.m_layout, 0);
-        params.m_syntheticBoldPass = true;
-        status = ATSUDrawText(params.m_layout, from, drawPortionLength, 0, 0);
-    }
-    CGContextTranslateCTM(context, -point.x(), -point.y());
-
-    if (status != noErr)
-        // Nothing to do but report the error (dev build only).
-        LOG_ERROR("ATSUDrawText() failed(%d)", status);
-
-    if (hasSimpleShadow)
-        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor);
-}
-
-float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
-{
-    if (run.length() == 0)
-        return 0;
-
-    ATSULayoutParameters params(run, fallbackFonts);
-    params.initialize(this);
-    
-    OSStatus status;
-    
-    ATSTrapezoid firstGlyphBounds;
-    ItemCount actualNumBounds;
-    status = ATSUGetGlyphBounds(params.m_layout, 0, 0, 0, run.length(), kATSUseFractionalOrigins, 1, &firstGlyphBounds, &actualNumBounds);    
-    if (status != noErr)
-        LOG_ERROR("ATSUGetGlyphBounds() failed(%d)", status);
-    if (actualNumBounds != 1)
-        LOG_ERROR("unexpected result from ATSUGetGlyphBounds(): actualNumBounds(%d) != 1", actualNumBounds);
-
-    return max(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
-           min(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
-}
-
-int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool /*includePartialGlyphs*/) const
-{
-    OwnArrayPtr<UChar> charactersWithOverride;
-    TextRun adjustedRun = copyRunForDirectionalOverrideIfNecessary(run, charactersWithOverride);
-
-    ATSULayoutParameters params(adjustedRun);
-    params.initialize(this);
-
-    UniCharArrayOffset primaryOffset = 0;
-    
-    // FIXME: No idea how to avoid including partial glyphs.
-    // Not even sure if that's the behavior this yields now.
-    Boolean isLeading;
-    UniCharArrayOffset secondaryOffset = 0;
-    OSStatus status = ATSUPositionToOffset(params.m_layout, FloatToFixed(x), FloatToFixed(-1), &primaryOffset, &isLeading, &secondaryOffset);
-    unsigned offset;
-    if (status == noErr) {
-        offset = (unsigned)primaryOffset;
-        if (run.directionalOverride() && offset > 0)
-            offset--;
-    } else
-        // Failed to find offset!  Return 0 offset.
-        offset = 0;
-
-    return offset;
-}
-
-}
-#endif // USE(ATSUI)
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
index 47617d8..41f63a9 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -30,18 +30,18 @@
 #include "GraphicsContext3D.h"
 
 #include "CachedImage.h"
-#include "CanvasActiveInfo.h"
-#include "CanvasArray.h"
-#include "CanvasBuffer.h"
-#include "CanvasFramebuffer.h"
-#include "CanvasFloatArray.h"
-#include "CanvasIntArray.h"
+#include "WebGLActiveInfo.h"
+#include "WebGLArray.h"
+#include "WebGLBuffer.h"
+#include "WebGLFramebuffer.h"
+#include "WebGLFloatArray.h"
+#include "WebGLIntArray.h"
 #include "CanvasObject.h"
-#include "CanvasProgram.h"
-#include "CanvasRenderbuffer.h"
-#include "CanvasShader.h"
-#include "CanvasTexture.h"
-#include "CanvasUnsignedByteArray.h"
+#include "WebGLProgram.h"
+#include "WebGLRenderbuffer.h"
+#include "WebGLShader.h"
+#include "WebGLTexture.h"
+#include "WebGLUnsignedByteArray.h"
 #include "CString.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
@@ -175,21 +175,12 @@ GraphicsContext3D::~GraphicsContext3D()
     }
 }
 
-void GraphicsContext3D::checkError() const
-{
-    // FIXME: This needs to only be done in the debug context. It will probably throw an exception
-    // on error and print the error message to the debug console
-    GLenum error = ::glGetError();
-    if (error != GL_NO_ERROR)
-        notImplemented();
-}
-
 void GraphicsContext3D::makeContextCurrent()
 {
     CGLSetCurrentContext(m_contextObj);
 }
 
-void GraphicsContext3D::beginPaint(CanvasRenderingContext3D* context)
+void GraphicsContext3D::beginPaint(WebGLRenderingContext* context)
 {
     UNUSED_PARAM(context);
 }
@@ -246,43 +237,42 @@ void GraphicsContext3D::activeTexture(unsigned long texture)
     ::glActiveTexture(texture);
 }
 
-void GraphicsContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+void GraphicsContext3D::attachShader(WebGLProgram* program, WebGLShader* shader)
 {
-    if (!program || !shader)
-        return;
+    ASSERT(program);
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glAttachShader((GLuint) program->object(), (GLuint) shader->object());
 }
 
-void GraphicsContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+void GraphicsContext3D::bindAttribLocation(WebGLProgram* program, unsigned long index, const String& name)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     ensureContext(m_contextObj);
     ::glBindAttribLocation((GLuint) program->object(), index, name.utf8().data());
 }
 
-void GraphicsContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+void GraphicsContext3D::bindBuffer(unsigned long target, WebGLBuffer* buffer)
 {
     ensureContext(m_contextObj);
     ::glBindBuffer(target, buffer ? (GLuint) buffer->object() : 0);
 }
 
 
-void GraphicsContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+void GraphicsContext3D::bindFramebuffer(unsigned long target, WebGLFramebuffer* buffer)
 {
     ensureContext(m_contextObj);
     ::glBindFramebufferEXT(target, buffer ? (GLuint) buffer->object() : m_fbo);
 }
 
-void GraphicsContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+void GraphicsContext3D::bindRenderbuffer(unsigned long target, WebGLRenderbuffer* renderbuffer)
 {
     ensureContext(m_contextObj);
-    ::glBindBuffer(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
+    ::glBindRenderbufferEXT(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
 }
 
 
-void GraphicsContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+void GraphicsContext3D::bindTexture(unsigned long target, WebGLTexture* texture)
 {
     ensureContext(m_contextObj);
     ::glBindTexture(target, texture ? (GLuint) texture->object() : 0);
@@ -324,22 +314,22 @@ void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long
     ensureContext(m_contextObj);
     ::glBufferData(target, size, 0, usage);
 }
-void GraphicsContext3D::bufferData(unsigned long target, CanvasArray* array, unsigned long usage)
+void GraphicsContext3D::bufferData(unsigned long target, WebGLArray* array, unsigned long usage)
 {
     if (!array || !array->length())
         return;
     
     ensureContext(m_contextObj);
-    ::glBufferData(target, array->sizeInBytes(), array->baseAddress(), usage);
+    ::glBufferData(target, array->byteLength(), array->baseAddress(), usage);
 }
 
-void GraphicsContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* array)
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, WebGLArray* array)
 {
     if (!array || !array->length())
         return;
     
     ensureContext(m_contextObj);
-    ::glBufferSubData(target, offset, array->sizeInBytes(), array->baseAddress());
+    ::glBufferSubData(target, offset, array->byteLength(), array->baseAddress());
 }
 
 unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
@@ -378,11 +368,9 @@ void GraphicsContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
     ::glColorMask(red, green, blue, alpha);
 }
 
-void GraphicsContext3D::compileShader(CanvasShader* shader)
+void GraphicsContext3D::compileShader(WebGLShader* shader)
 {
-    if (!shader)
-        return;
-    
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glCompileShader((GLuint) shader->object());
 }
@@ -423,11 +411,10 @@ void GraphicsContext3D::depthRange(double zNear, double zFar)
     ::glDepthRange(zNear, zFar);
 }
 
-void GraphicsContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+void GraphicsContext3D::detachShader(WebGLProgram* program, WebGLShader* shader)
 {
-    if (!program || !shader)
-        return;
-    
+    ASSERT(program);
+    ASSERT(shader);
     ensureContext(m_contextObj);
     ::glDetachShader((GLuint) program->object(), (GLuint) shader->object());
 }
@@ -480,22 +467,16 @@ void GraphicsContext3D::flush()
     ::glFlush();
 }
 
-void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, WebGLRenderbuffer* buffer)
 {
-    if (!buffer)
-        return;
-    
     ensureContext(m_contextObj);
-    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, (GLuint) buffer->object());
+    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, buffer ? (GLuint) buffer->object() : 0);
 }
 
-void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, WebGLTexture* texture, long level)
 {
-    if (!texture)
-        return;
-    
     ensureContext(m_contextObj);
-    ::glFramebufferTexture2DEXT(target, attachment, textarget, (GLuint) texture->object(), level);
+    ::glFramebufferTexture2DEXT(target, attachment, textarget, texture ? (GLuint) texture->object() : 0, level);
 }
 
 void GraphicsContext3D::frontFace(unsigned long mode)
@@ -510,10 +491,12 @@ void GraphicsContext3D::generateMipmap(unsigned long target)
     ::glGenerateMipmapEXT(target);
 }
 
-bool GraphicsContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+bool GraphicsContext3D::getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo& info)
 {
-    if (!program->object())
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
         return false;
+    }
     ensureContext(m_contextObj);
     GLint maxAttributeSize = 0;
     ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxAttributeSize);
@@ -530,10 +513,12 @@ bool GraphicsContext3D::getActiveAttrib(CanvasProgram* program, unsigned long in
     return true;
 }
     
-bool GraphicsContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+bool GraphicsContext3D::getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo& info)
 {
-    if (!program->object())
+    if (!program->object()) {
+        synthesizeGLError(INVALID_VALUE);
         return false;
+    }
     ensureContext(m_contextObj);
     GLint maxUniformSize = 0;
     ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxUniformSize);
@@ -550,7 +535,7 @@ bool GraphicsContext3D::getActiveUniform(CanvasProgram* program, unsigned long i
     return true;
 }
 
-int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+int GraphicsContext3D::getAttribLocation(WebGLProgram* program, const String& name)
 {
     if (!program)
         return -1;
@@ -561,6 +546,13 @@ int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& n
 
 unsigned long GraphicsContext3D::getError()
 {
+    if (m_syntheticErrors.size() > 0) {
+        ListHashSet<unsigned long>::iterator iter = m_syntheticErrors.begin();
+        unsigned long err = *iter;
+        m_syntheticErrors.remove(iter);
+        return err;
+    }
+
     ensureContext(m_contextObj);
     return ::glGetError();
 }
@@ -577,7 +569,7 @@ void GraphicsContext3D::hint(unsigned long target, unsigned long mode)
     ::glHint(target, mode);
 }
 
-bool GraphicsContext3D::isBuffer(CanvasBuffer* buffer)
+bool GraphicsContext3D::isBuffer(WebGLBuffer* buffer)
 {
     if (!buffer)
         return false;
@@ -592,7 +584,7 @@ bool GraphicsContext3D::isEnabled(unsigned long cap)
     return ::glIsEnabled(cap);
 }
 
-bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+bool GraphicsContext3D::isFramebuffer(WebGLFramebuffer* framebuffer)
 {
     if (!framebuffer)
         return false;
@@ -601,7 +593,7 @@ bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
     return ::glIsFramebufferEXT((GLuint) framebuffer->object());
 }
 
-bool GraphicsContext3D::isProgram(CanvasProgram* program)
+bool GraphicsContext3D::isProgram(WebGLProgram* program)
 {
     if (!program)
         return false;
@@ -610,7 +602,7 @@ bool GraphicsContext3D::isProgram(CanvasProgram* program)
     return ::glIsProgram((GLuint) program->object());
 }
 
-bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+bool GraphicsContext3D::isRenderbuffer(WebGLRenderbuffer* renderbuffer)
 {
     if (!renderbuffer)
         return false;
@@ -619,7 +611,7 @@ bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
     return ::glIsRenderbufferEXT((GLuint) renderbuffer->object());
 }
 
-bool GraphicsContext3D::isShader(CanvasShader* shader)
+bool GraphicsContext3D::isShader(WebGLShader* shader)
 {
     if (!shader)
         return false;
@@ -628,7 +620,7 @@ bool GraphicsContext3D::isShader(CanvasShader* shader)
     return ::glIsShader((GLuint) shader->object());
 }
 
-bool GraphicsContext3D::isTexture(CanvasTexture* texture)
+bool GraphicsContext3D::isTexture(WebGLTexture* texture)
 {
     if (!texture)
         return false;
@@ -643,11 +635,9 @@ void GraphicsContext3D::lineWidth(double width)
     ::glLineWidth(static_cast<float>(width));
 }
 
-void GraphicsContext3D::linkProgram(CanvasProgram* program)
+void GraphicsContext3D::linkProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
-    
+    ASSERT(program);
     ensureContext(m_contextObj);
     ::glLinkProgram((GLuint) program->object());
 }
@@ -664,7 +654,7 @@ void GraphicsContext3D::polygonOffset(double factor, double units)
     ::glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
 }
 
-PassRefPtr<CanvasArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+PassRefPtr<WebGLArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
 {
     ensureContext(m_contextObj);
     
@@ -675,7 +665,7 @@ PassRefPtr<CanvasArray> GraphicsContext3D::readPixels(long x, long y, unsigned l
     if (type != GL_UNSIGNED_BYTE || format != GL_RGBA)
         return 0;
         
-    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(width * height * 4);
+    RefPtr<WebGLUnsignedByteArray> array = WebGLUnsignedByteArray::create(width * height * 4);
     ::glReadPixels(x, y, width, height, format, type, (GLvoid*) array->data());
     return array;    
 }
@@ -705,10 +695,9 @@ void GraphicsContext3D::scissor(long x, long y, unsigned long width, unsigned lo
     ::glScissor(x, y, width, height);
 }
 
-void GraphicsContext3D::shaderSource(CanvasShader* shader, const String& string)
+void GraphicsContext3D::shaderSource(WebGLShader* shader, const String& string)
 {
-    if (!shader)
-        return;
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
     const CString& cs = string.utf8();
@@ -889,19 +878,17 @@ void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* a
     ::glUniformMatrix4fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::useProgram(CanvasProgram* program)
+void GraphicsContext3D::useProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     ::glUseProgram((GLuint) program->object());
 }
 
-void GraphicsContext3D::validateProgram(CanvasProgram* program)
+void GraphicsContext3D::validateProgram(WebGLProgram* program)
 {
-    if (!program)
-        return;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     ::glValidateProgram((GLuint) program->object());
@@ -967,567 +954,156 @@ void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned l
     ::glViewport(static_cast<GLint>(x), static_cast<GLint>(y), static_cast<GLsizei>(width), static_cast<GLsizei>(height));
 }
 
-static int sizeForGetParam(unsigned long pname)
-{
-    switch(pname) {
-        case GL_ACTIVE_TEXTURE:                  return 1;
-        case GL_ALIASED_LINE_WIDTH_RANGE:        return 2;
-        case GL_ALIASED_POINT_SIZE_RANGE:        return 2;
-        case GL_ALPHA_BITS:                      return 1;
-        case GL_ARRAY_BUFFER_BINDING:            return 1; // (* actually a CanvasBuffer*)
-        case GL_BLEND:                           return 1;
-        case GL_BLEND_COLOR:                     return 4;
-        case GL_BLEND_DST_ALPHA:                 return 1;
-        case GL_BLEND_DST_RGB:                   return 1;
-        case GL_BLEND_EQUATION_ALPHA:            return 1;
-        case GL_BLEND_EQUATION_RGB:              return 1;
-        case GL_BLEND_SRC_ALPHA:                 return 1;
-        case GL_BLEND_SRC_RGB:                   return 1;
-        case GL_BLUE_BITS:                       return 1;
-        case GL_COLOR_CLEAR_VALUE:               return 4;
-        case GL_COLOR_WRITEMASK:                 return 4;
-        case GL_COMPRESSED_TEXTURE_FORMATS:      return GL_NUM_COMPRESSED_TEXTURE_FORMATS;
-        case GL_CULL_FACE:                       return 1;
-        case GL_CULL_FACE_MODE:                  return 1;
-        case GL_CURRENT_PROGRAM:                 return 1; // (* actually a CanvasProgram*)
-        case GL_DEPTH_BITS:                      return 1;
-        case GL_DEPTH_CLEAR_VALUE:               return 1;
-        case GL_DEPTH_FUNC:                      return 1;
-        case GL_DEPTH_RANGE:                     return 2;
-        case GL_DEPTH_TEST:                      return 1;
-        case GL_DEPTH_WRITEMASK:                 return 1;
-        case GL_DITHER:                          return 1;
-        case GL_ELEMENT_ARRAY_BUFFER_BINDING:    return 1; // (* actually a CanvasBuffer*)
-        case GL_FRAMEBUFFER_BINDING_EXT:         return 1; // (* actually a CanvasFramebuffer*)
-        case GL_FRONT_FACE:                      return 1;
-        case GL_GENERATE_MIPMAP_HINT:            return 1;
-        case GL_GREEN_BITS:                      return 1;
-            //case GL_IMPLEMENTATION_COLOR_READ_FORMAT:return 1;
-            //case GL_IMPLEMENTATION_COLOR_READ_TYPE:  return 1;
-        case GL_LINE_WIDTH:                      return 1;
-        case GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS:return 1;
-        case GL_MAX_CUBE_MAP_TEXTURE_SIZE:       return 1;
-            //case GL_MAX_FRAGMENT_UNIFORM_VECTORS:    return 1;
-        case GL_MAX_RENDERBUFFER_SIZE_EXT:       return 1;
-        case GL_MAX_TEXTURE_IMAGE_UNITS:         return 1;
-        case GL_MAX_TEXTURE_SIZE:                return 1;
-            //case GL_MAX_VARYING_VECTORS:             return 1;
-        case GL_MAX_VERTEX_ATTRIBS:              return 1;
-        case GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS:  return 1;
-            //case GL_MAX_VERTEX_UNIFORM_VECTORS:      return 1;
-        case GL_MAX_VIEWPORT_DIMS:               return 2;
-        case GL_NUM_COMPRESSED_TEXTURE_FORMATS:  return 1;
-            //case GL_NUM_SHADER_BINARY_FORMATS:       return 1;
-        case GL_PACK_ALIGNMENT:                  return 1;
-        case GL_POLYGON_OFFSET_FACTOR:           return 1;
-        case GL_POLYGON_OFFSET_FILL:             return 1;
-        case GL_POLYGON_OFFSET_UNITS:            return 1;
-        case GL_RED_BITS:                        return 1;
-        case GL_RENDERBUFFER_BINDING_EXT:        return 1; // (* actually a CanvasRenderbuffer*)
-        case GL_SAMPLE_BUFFERS:                  return 1;
-        case GL_SAMPLE_COVERAGE_INVERT:          return 1;
-        case GL_SAMPLE_COVERAGE_VALUE:           return 1;
-        case GL_SAMPLES:                         return 1;
-        case GL_SCISSOR_BOX:                     return 4;
-        case GL_SCISSOR_TEST:                    return 1;
-            //case GL_SHADER_BINARY_FORMATS:           return GL_NUM_SHADER_BINARY_FORMATS;
-            //case GL_SHADER_COMPILER:                 return 1;
-        case GL_STENCIL_BACK_FAIL:               return 1;
-        case GL_STENCIL_BACK_FUNC:               return 1;
-        case GL_STENCIL_BACK_PASS_DEPTH_FAIL:    return 1;
-        case GL_STENCIL_BACK_PASS_DEPTH_PASS:    return 1;
-        case GL_STENCIL_BACK_REF:                return 1;
-        case GL_STENCIL_BACK_VALUE_MASK:         return 1;
-        case GL_STENCIL_BACK_WRITEMASK:          return 1;
-        case GL_STENCIL_BITS:                    return 1;
-        case GL_STENCIL_CLEAR_VALUE:             return 1;
-        case GL_STENCIL_FAIL:                    return 1;
-        case GL_STENCIL_FUNC:                    return 1;
-        case GL_STENCIL_PASS_DEPTH_FAIL:         return 1;
-        case GL_STENCIL_PASS_DEPTH_PASS:         return 1;
-        case GL_STENCIL_REF:                     return 1;
-        case GL_STENCIL_TEST:                    return 1;
-        case GL_STENCIL_VALUE_MASK:              return 1;
-        case GL_STENCIL_WRITEMASK:               return 1;
-        case GL_SUBPIXEL_BITS:                   return 1;
-        case GL_TEXTURE_BINDING_2D:              return 1; // (* actually a CanvasTexture*)
-        case GL_TEXTURE_BINDING_CUBE_MAP:        return 1; // (* actually a CanvasTexture*)
-        case GL_UNPACK_ALIGNMENT:                return 1;
-        case GL_VIEWPORT:                        return 4;
-    }
-    
-    return -1;
-}
-
-bool GraphicsContext3D::getBoolean(unsigned long pname)
-{
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLboolean buf[4];
-    GLboolean* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
-        isAlloced = true;
-    }
-            
-    ::glGetBooleanv(pname, pbuf);
-    
-    bool value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
-}
-
-PassRefPtr<CanvasUnsignedByteArray> GraphicsContext3D::getBooleanv(unsigned long pname)
-{
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(size);
-    bool isAlloced = false;
-    GLboolean buf[4];
-    GLboolean* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
-        isAlloced = true;
-    }
-            
-    ::glGetBooleanv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<unsigned char>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
-}
-
-float GraphicsContext3D::getFloat(unsigned long pname)
+void GraphicsContext3D::getBooleanv(unsigned long pname, unsigned char* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLfloat buf[4];
-    GLfloat* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
-        isAlloced = true;
-    }
-            
-    ::glGetFloatv(pname, pbuf);
-    
-    float value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
+    ::glGetBooleanv(pname, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getFloatv(unsigned long pname)
+void GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname, int* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
-    bool isAlloced = false;
-    GLfloat buf[4];
-    GLfloat* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
-        isAlloced = true;
-    }
-            
-    ::glGetFloatv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<float>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
+    ::glGetBufferParameteriv(target, pname, value);
 }
 
-int GraphicsContext3D::getInteger(unsigned long pname)
+void GraphicsContext3D::getFloatv(unsigned long pname, float* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    bool isAlloced = false;
-    GLint buf[4];
-    GLint* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLint*) malloc(size * sizeof(GLint));
-        isAlloced = true;
-    }
-            
-    ::glGetIntegerv(pname, pbuf);
-    
-    int value = pbuf[0];
-
-    if (isAlloced)
-        free(pbuf);
-    
-    return value;
+    ::glGetFloatv(pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getIntegerv(unsigned long pname)
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname, int* value)
 {
-    int size = sizeForGetParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
-    bool isAlloced = false;
-    GLint buf[4];
-    GLint* pbuf = buf;
-            
-    if (size > 4) {
-        pbuf = (GLint*) malloc(size * sizeof(GLint));
-        isAlloced = true;
-    }
-            
-    ::glGetIntegerv(pname, pbuf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<int>(pbuf[i]));
-            
-    if (isAlloced)
-        free(pbuf);
-    
-    return array;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, value);
 }
 
-int GraphicsContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getIntegerv(unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    return data;
+    ::glGetIntegerv(pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getProgramiv(WebGLProgram* program, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetProgramiv((GLuint) program->object(), pname, value);
 }
 
-int GraphicsContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+String GraphicsContext3D::getProgramInfoLog(WebGLProgram* program)
 {
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-int GraphicsContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetProgramiv((GLuint) program->object(), pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetProgramiv((GLuint) program->object(), pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-String GraphicsContext3D::getProgramInfoLog(CanvasProgram* program)
-{
-    if (!program)
-        return String();
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     GLint length;
     ::glGetProgramiv((GLuint) program->object(), GL_INFO_LOG_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+
     ::glGetProgramInfoLog((GLuint) program->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
-int GraphicsContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetBufferParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetRenderbufferParameterivEXT(target, pname, value);
 }
 
-int GraphicsContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+void GraphicsContext3D::getShaderiv(WebGLShader* shader, unsigned long pname, int* value)
 {
-    if (!shader)
-        return 0;
-    
-    ensureContext(m_contextObj);
-    GLint data;
-    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
-    return data;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
-{
-    if (!shader)
-        return 0;
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
+    ::glGetShaderiv((GLuint) shader->object(), pname, value);
 }
 
-String GraphicsContext3D::getShaderInfoLog(CanvasShader* shader)
+String GraphicsContext3D::getShaderInfoLog(WebGLShader* shader)
 {
-    if (!shader)
-        return String();
+    ASSERT(shader);
     
     ensureContext(m_contextObj);
     GLint length;
     ::glGetShaderiv((GLuint) shader->object(), GL_INFO_LOG_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+        
     ::glGetShaderInfoLog((GLuint) shader->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
-String GraphicsContext3D::getShaderSource(CanvasShader* shader)
+String GraphicsContext3D::getShaderSource(WebGLShader* shader)
 {
-    if (!shader)
-        return String();
-    
+    ASSERT(shader);
+
     ensureContext(m_contextObj);
     GLint length;
     ::glGetShaderiv((GLuint) shader->object(), GL_SHADER_SOURCE_LENGTH, &length);
     
     GLsizei size;
-    GLchar* info = (GLchar*) malloc(length);
+    GLchar* info = (GLchar*) fastMalloc(length);
+    if (!info)
+        return "";
+        
     ::glGetShaderSource((GLuint) shader->object(), length, &size, info);
     String s(info);
-    free(info);
+    fastFree(info);
     return s;
 }
 
 
-float GraphicsContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname, float* value)
 {
     ensureContext(m_contextObj);
-    GLfloat data;
-    ::glGetTexParameterfv(target, pname, &data);
-    return data;
+    ::glGetTexParameterfv(target, pname, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(1);
-    GLfloat data;
-    ::glGetTexParameterfv(target, pname, &data);
-    array->set(0, static_cast<float>(data));
-    
-    return array;
+    ::glGetTexParameteriv(target, pname, value);
 }
 
-int GraphicsContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getUniformfv(WebGLProgram* program, long location, float* value)
 {
     ensureContext(m_contextObj);
-    GLint data;
-    ::glGetTexParameteriv(target, pname, &data);
-    return data;
+    ::glGetUniformfv((GLuint) program->object(), location, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+void GraphicsContext3D::getUniformiv(WebGLProgram* program, long location, int* value)
 {
     ensureContext(m_contextObj);
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
-    GLint data;
-    ::glGetTexParameteriv(target, pname, &data);
-    array->set(0, static_cast<int>(data));
-    
-    return array;
-}
-
-float GraphicsContext3D::getUniformf(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
+    ::glGetUniformiv((GLuint) program->object(), location, value);
 }
 
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getUniformfv(CanvasProgram* program, long location)
+long GraphicsContext3D::getUniformLocation(WebGLProgram* program, const String& name)
 {
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-int GraphicsContext3D::getUniformi(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getUniformiv(CanvasProgram* program, long location)
-{
-    // FIXME: We need to query glGetUniformLocation to determine the size needed
-    UNUSED_PARAM(program);
-    UNUSED_PARAM(location);
-    notImplemented();
-    return 0;
-}
-
-long GraphicsContext3D::getUniformLocation(CanvasProgram* program, const String& name)
-{
-    if (!program)
-        return -1;
+    ASSERT(program);
     
     ensureContext(m_contextObj);
     return ::glGetUniformLocation((GLuint) program->object(), name.utf8().data());
 }
 
-static int sizeForGetVertexAttribParam(unsigned long pname)
-{
-    switch(pname) {
-        case GL_VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:     return 1; // (* actually a CanvasBuffer*)
-        case GL_VERTEX_ATTRIB_ARRAY_ENABLED:            return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_SIZE:               return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_STRIDE:             return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_TYPE:               return 1;
-        case GL_VERTEX_ATTRIB_ARRAY_NORMALIZED:         return 1;
-        case GL_CURRENT_VERTEX_ATTRIB:                  return 4;
-    }
-    
-    return -1;
-}
-
-float GraphicsContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
-{
-    ensureContext(m_contextObj);
-    GLfloat buf[4];
-    ::glGetVertexAttribfv(index, pname, buf);
-    return buf[0];
-}
-
-PassRefPtr<CanvasFloatArray> GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
-{
-    int size = sizeForGetVertexAttribParam(pname);
-    if (size < 1) 
-        return 0;
-    
-    ensureContext(m_contextObj);
-    
-    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
-    GLfloat buf[4];
-    ::glGetVertexAttribfv(index, pname, buf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<float>(buf[i]));
-    
-    return array;
-}
-
-int GraphicsContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+void GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname, float* value)
 {
     ensureContext(m_contextObj);
-    GLint buf[4];
-    ::glGetVertexAttribiv(index, pname, buf);
-    return buf[0];
+    ::glGetVertexAttribfv(index, pname, value);
 }
 
-PassRefPtr<CanvasIntArray> GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+void GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname, int* value)
 {
-    int size = sizeForGetVertexAttribParam(pname);
-    if (size < 1) 
-        return 0;
-    
     ensureContext(m_contextObj);
-    
-    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
-    GLint buf[4];
-    ::glGetVertexAttribiv(index, pname, buf);
-            
-    for (int i = 0; i < size; ++i)
-        array->set(i, static_cast<int>(buf[i]));
-    
-    return array;
+    ::glGetVertexAttribiv(index, pname, value);
 }
 
 long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
@@ -1552,18 +1128,21 @@ static void imageToTexture(Image* image, unsigned target, unsigned level)
     size_t textureWidth = CGImageGetWidth(textureImage);
     size_t textureHeight = CGImageGetHeight(textureImage);
     
-    GLubyte* textureData = (GLubyte*) malloc(textureWidth * textureHeight * 4);
+    GLubyte* textureData = (GLubyte*) fastMalloc(textureWidth * textureHeight * 4);
+    if (!textureData)
+        return;
+        
     CGContextRef textureContext = CGBitmapContextCreate(textureData, textureWidth, textureHeight, 8, textureWidth * 4, 
                                                         CGImageGetColorSpace(textureImage), kCGImageAlphaPremultipliedLast);
-    
+    CGContextSetBlendMode(textureContext, kCGBlendModeCopy);
     CGContextDrawImage(textureContext, CGRectMake(0, 0, (CGFloat)textureWidth, (CGFloat)textureHeight), textureImage);
     CGContextRelease(textureContext);
     
     ::glTexImage2D(target, level, GL_RGBA, textureWidth, textureHeight, 0, GL_RGBA, GL_UNSIGNED_BYTE, textureData);
-    free(textureData);
+    fastFree(textureData);
 }
 
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, CanvasArray* pixels)
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, WebGLArray* pixels)
 {
     // FIXME: Need to do bounds checking on the buffer here.
     ::glTexImage2D(target, level, internalformat, width, height, border, format, type, pixels->baseAddress());
@@ -1585,39 +1164,15 @@ int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned inte
     return -1;
 }
 
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, Image* image, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: need to support flipY and premultiplyAlpha
     UNUSED_PARAM(flipY);
     UNUSED_PARAM(premultiplyAlpha);
-    
-    if (!image)
-        return -1;
+    ASSERT(image);
     
     ensureContext(m_contextObj);
-    CachedImage* cachedImage = image->cachedImage();
-    if (!cachedImage)
-        return -1;
-    
-    imageToTexture(cachedImage->image(), target, level);
-    return 0;
-}
-
-int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
-{
-    // FIXME: need to support flipY and premultiplyAlpha
-    UNUSED_PARAM(flipY);
-    UNUSED_PARAM(premultiplyAlpha);
-    
-    if (!canvas)
-        return -1;
-    
-    ensureContext(m_contextObj);
-    ImageBuffer* buffer = canvas->buffer();
-    if (!buffer)
-        return -1;
-    
-    imageToTexture(buffer->image(), target, level);
+    imageToTexture(image, target, level);
     return 0;
 }
 
@@ -1634,7 +1189,7 @@ int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElem
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, CanvasArray* pixels)
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, WebGLArray* pixels)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
     UNUSED_PARAM(target);
@@ -1664,7 +1219,7 @@ int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned x
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, Image* image, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
     UNUSED_PARAM(target);
@@ -1681,23 +1236,6 @@ int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned x
     return -1;
 }
 
-int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
-{
-    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
-    UNUSED_PARAM(target);
-    UNUSED_PARAM(level);
-    UNUSED_PARAM(xoff);
-    UNUSED_PARAM(yoff);
-    UNUSED_PARAM(width);
-    UNUSED_PARAM(height);
-    UNUSED_PARAM(canvas);
-
-    // FIXME: need to support flipY and premultiplyAlpha    
-    UNUSED_PARAM(flipY);
-    UNUSED_PARAM(premultiplyAlpha);
-    return -1;
-}
-
 int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
 {
     // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
@@ -1745,7 +1283,7 @@ unsigned GraphicsContext3D::createRenderbuffer()
     return o;
 }
 
-unsigned GraphicsContext3D::createShader(ShaderType type)
+unsigned GraphicsContext3D::createShader(unsigned long type)
 {
     ensureContext(m_contextObj);
     return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);
@@ -1817,6 +1355,11 @@ int GraphicsContext3D::sizeInBytes(int type)
     }
 }
 
+void GraphicsContext3D::synthesizeGLError(unsigned long error)
+{
+    m_syntheticErrors.add(error);
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index 8cf51b4..8024091 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -54,6 +54,7 @@ public:
     // for hosting this GraphicsLayer in a native layer hierarchy
     virtual NativeLayer nativeLayer() const;
 
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
     virtual void addChild(GraphicsLayer*);
     virtual void addChildAtIndex(GraphicsLayer*, int index);
     virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index b351956..dea6bfc 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -47,6 +47,7 @@
 #import "WebLayer.h"
 #import "WebTiledLayer.h"
 #import <limits.h>
+#import <objc/objc-auto.h>
 #import <wtf/CurrentTime.h>
 #import <wtf/UnusedParam.h>
 #import <wtf/RetainPtr.h>
@@ -298,6 +299,18 @@ static void clearLayerBackgroundColor(PlatformLayer* layer)
     [layer setBackgroundColor:0];
 }
 
+static void safeSetSublayers(CALayer* layer, NSArray* sublayers)
+{
+    // Workaround for <rdar://problem/7390716>: -[CALayer setSublayers:] crashes if sublayers is an empty array, or nil, under GC.
+    if (objc_collectingEnabled() && ![sublayers count]) {
+        while ([[layer sublayers] count])
+            [[[layer sublayers] objectAtIndex:0] removeFromSuperlayer];
+        return;
+    }
+    
+    [layer setSublayers:sublayers];
+}
+
 static bool caValueFunctionSupported()
 {
     static bool sHaveValueFunction = [CAPropertyAnimation instancesRespondToSelector:@selector(setValueFunction:)];
@@ -315,18 +328,6 @@ GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoord
     return CompositingCoordinatesBottomUp;
 }
 
-bool GraphicsLayer::showDebugBorders()
-{
-    static bool showDebugBorders = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerBorders"];
-    return showDebugBorders;
-}
-
-bool GraphicsLayer::showRepaintCounter()
-{
-    static bool showRepaintCounter = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerRepaintCounter"];
-    return showRepaintCounter;
-}
-
 static NSDictionary* nullActionsDictionary()
 {
     NSNull* nullValue = [NSNull null];
@@ -352,13 +353,13 @@ PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 }
 
 GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
-: GraphicsLayer(client)
-, m_contentsLayerPurpose(NoContentsLayer)
-, m_contentsLayerHasBackgroundColor(false)
-, m_uncommittedChanges(NoChange)
+    : GraphicsLayer(client)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+    , m_uncommittedChanges(NoChange)
 #if ENABLE(3D_CANVAS)
-, m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
-, m_platformTexture(NullPlatform3DObject)
+    , m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
+    , m_platformTexture(NullPlatform3DObject)
 #endif
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
@@ -409,6 +410,15 @@ NativeLayer GraphicsLayerCA::nativeLayer() const
     return m_layer.get();
 }
 
+bool GraphicsLayerCA::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    if (childrenChanged)
+        noteLayerPropertyChanged(ChildrenChanged);
+    
+    return childrenChanged;
+}
+
 void GraphicsLayerCA::addChild(GraphicsLayer* childLayer)
 {
     GraphicsLayer::addChild(childLayer);
@@ -882,17 +892,16 @@ void GraphicsLayerCA::updateSublayerList()
     [newSublayers makeObjectsPerformSelector:@selector(removeFromSuperlayer)];
 
     if (m_transformLayer) {
-        [m_transformLayer.get() setSublayers:newSublayers];
+        safeSetSublayers(m_transformLayer.get(), newSublayers);
 
         if (m_contentsLayer) {
             // If we have a transform layer, then the contents layer is parented in the 
             // primary layer (which is itself a child of the transform layer).
-            [m_layer.get() setSublayers:nil];
+            safeSetSublayers(m_layer.get(), nil);
             [m_layer.get() addSublayer:m_contentsLayer.get()];
         }
-    } else {
-        [m_layer.get() setSublayers:newSublayers];
-    }
+    } else
+        safeSetSublayers(m_layer.get(), newSublayers);
 
     [newSublayers release];
 }
@@ -1757,7 +1766,7 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer)
     }
     
     [m_layer.get() setLayerOwner:this];
-    [m_layer.get() setSublayers:[oldLayer.get() sublayers]];
+    safeSetSublayers(m_layer.get(), [oldLayer.get() sublayers]);
     
     [[oldLayer.get() superlayer] replaceSublayer:oldLayer.get() with:m_layer.get()];
 
diff --git a/WebCore/platform/graphics/mac/IconMac.mm b/WebCore/platform/graphics/mac/IconMac.mm
index 63abe59..aee7234 100644
--- a/WebCore/platform/graphics/mac/IconMac.mm
+++ b/WebCore/platform/graphics/mac/IconMac.mm
@@ -39,27 +39,32 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    // Don't pass relative filenames -- we don't want a result that depends on the current directory.
-    // Need 0U here to disambiguate String::operator[] from operator(NSString*, int)[]
-    if (filename.isEmpty() || filename[0U] != '/')
+    if (filenames.isEmpty())
         return 0;
 
-    NSImage* image = [[NSWorkspace sharedWorkspace] iconForFile:filename];
-    if (!image)
-        return 0;
+    bool useIconFromFirstFile;
+#ifdef BUILDING_ON_TIGER
+    // FIXME: find a better image for multiple files to use on Tiger.
+    useIconFromFirstFile = true;
+#else
+    useIconFromFirstFile = filenames.size() == 1;
+#endif
+    if (useIconFromFirstFile) {
+        // Don't pass relative filenames -- we don't want a result that depends on the current directory.
+        // Need 0U here to disambiguate String::operator[] from operator(NSString*, int)[]
+        if (filenames[0].isEmpty() || filenames[0][0U] != '/')
+            return 0;
 
-    return adoptRef(new Icon(image));
-}
+        NSImage* image = [[NSWorkspace sharedWorkspace] iconForFile:filenames[0]];
+        if (!image)
+            return 0;
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
-{
-    if (filenames.isEmpty())
-        return 0;
+        return adoptRef(new Icon(image));
+    }
 #ifdef BUILDING_ON_TIGER
-    // FIXME: find a better image to use on Tiger.
-    return createIconForFile(filenames[0]);
+    return 0;
 #else
     NSImage* image = [NSImage imageNamed:NSImageNameMultipleDocuments];
     if (!image)
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 0a63626..7aaf95d 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -101,6 +101,9 @@ private:
     void setVolume(float);
     void setPreservesPitch(bool);
 
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
     void setEndTime(float time);
 
     int dataRate() const;
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index 30d0c82..dfb5958 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -736,8 +736,13 @@ bool MediaPlayerPrivate::hasAudio() const
 }
 
 bool MediaPlayerPrivate::supportsFullscreen() const
-{   
+{
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     return true;
+#else
+    // See <rdar://problem/7389945>
+    return false;
+#endif
 }
 
 void MediaPlayerPrivate::setVolume(float volume)
@@ -746,6 +751,27 @@ void MediaPlayerPrivate::setVolume(float volume)
         [m_qtMovie.get() setVolume:volume];  
 }
 
+bool MediaPlayerPrivate::hasClosedCaptions() const
+{
+    if (!metaDataAvailable())
+        return false;
+    return wkQTMovieHasClosedCaptions(m_qtMovie.get());  
+}
+
+void MediaPlayerPrivate::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    if (metaDataAvailable()) {
+        wkQTMovieSetShowClosedCaptions(m_qtMovie.get(), closedCaptionsVisible);
+
+#if USE(ACCELERATED_COMPOSITING) && (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+    if (closedCaptionsVisible && m_qtVideoLayer) {
+        // Captions will be rendered upsided down unless we flag the movie as flipped (again). See <rdar://7408440>.
+        [m_qtVideoLayer.get() setGeometryFlipped:YES];
+    }
+#endif
+    }
+}
+
 void MediaPlayerPrivate::setRate(float rate)
 {
     if (m_qtMovie)
@@ -1158,10 +1184,10 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& r)
             TextRun textRun(text.characters(), text.length());
             const Color color(255, 0, 0);
             context->scale(FloatSize(1.0f, -1.0f));    
-            context->setStrokeColor(color);
+            context->setStrokeColor(color, styleToUse->colorSpace());
             context->setStrokeStyle(SolidStroke);
             context->setStrokeThickness(1.0f);
-            context->setFillColor(color);
+            context->setFillColor(color, styleToUse->colorSpace());
             context->drawText(styleToUse->font(), textRun, IntPoint(2, -3));
         }
     }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
new file mode 100644
index 0000000..b4cdb09
--- /dev/null
+++ b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(OPENTYPE_SANITIZER)
+#include "OpenTypeSanitizer.h"
+
+#include "SharedBuffer.h"
+#include "opentype-sanitiser.h"
+#include "ots-memory-stream.h"
+#include <wtf/OwnArrayPtr.h>
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> OpenTypeSanitizer::sanitize()
+{
+    if (!m_buffer)
+        return 0;
+
+    // This is the largest web font size which we'll try to transcode.
+    static const size_t maxWebFontSize = 30 * 1024 * 1024; // 30 MB
+    if (m_buffer->size() > maxWebFontSize)
+        return 0;
+
+    // A transcoded font is usually smaller than an original font.
+    // However, it can be slightly bigger than the original one due to
+    // name table replacement and/or padding for glyf table.
+    static const size_t padLen = 20 * 1024; // 20 kB
+
+    OwnArrayPtr<unsigned char> transcodeRawBuffer(new unsigned char[m_buffer->size() + padLen]);
+    ots::MemoryStream output(transcodeRawBuffer.get(), m_buffer->size() + padLen);
+    if (!ots::Process(&output, reinterpret_cast<const uint8_t*>(m_buffer->data()), m_buffer->size()))
+        return 0;
+
+    const size_t transcodeLen = output.Tell();
+    return SharedBuffer::create(transcodeRawBuffer.get(), transcodeLen);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
diff --git a/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
new file mode 100644
index 0000000..3f93448
--- /dev/null
+++ b/WebCore/platform/graphics/opentype/OpenTypeSanitizer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OpenTypeSanitizer_h
+#define OpenTypeSanitizer_h
+
+#if ENABLE(OPENTYPE_SANITIZER)
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class SharedBuffer;
+
+class OpenTypeSanitizer {
+public:
+    explicit OpenTypeSanitizer(SharedBuffer* buffer)
+        : m_buffer(buffer)
+    {
+    }
+
+    PassRefPtr<SharedBuffer> sanitize();
+
+private:
+    SharedBuffer* const m_buffer;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(OPENTYPE_SANITIZER)
+#endif // OpenTypeSanitizer_h
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index b2e3d92..3a60160 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -435,7 +435,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     DWORD numFonts = 0;
     HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
-    if (fontHandle && numFonts != 1) {
+    if (fontHandle && numFonts < 1) {
         RemoveFontMemResourceEx(fontHandle);
         return 0;
     }
diff --git a/WebCore/platform/graphics/qt/FontCacheQt.cpp b/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 1113eae..82fb709 100644
--- a/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -34,260 +34,39 @@
 #include <wtf/ListHashSet.h>
 #include <wtf/StdLibExtras.h>
 
+#include <QFont>
+
 using namespace WTF;
 
 namespace WebCore {
 
-FontCache* fontCache()
+void FontCache::platformInit()
 {
-    DEFINE_STATIC_LOCAL(FontCache, globalFontCache, ());
-    return &globalFontCache;
 }
 
-FontCache::FontCache()
-{
-}
-
-void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
-{
-}
-
-// This type must be consistent with FontPlatformData's ctor - the one which
-// gets FontDescription as it's parameter.
-class FontPlatformDataCacheKey {
-public:
-    FontPlatformDataCacheKey(const FontDescription& description)
-        : m_familyName()
-        , m_size(description.computedPixelSize())
-        , m_bold(false)
-        , m_italic(description.italic())
-        , m_smallCaps(description.smallCaps())
-        , m_hash(0)
-    {
-        // FIXME: Map all FontWeight values to QFont weights in FontPlatformData's ctor and follow it here
-        if (FontPlatformData::toQFontWeight(description.weight()) > QFont::Normal)
-            m_bold = true;
-
-        const FontFamily* family = &description.family();
-        while (family) {
-            m_familyName.append(family->family());
-            family = family->next();
-            if (family)
-                m_familyName.append(',');
-        }
-
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(const FontPlatformData& fontData)
-        : m_familyName(static_cast<String>(fontData.family()))
-        , m_size(fontData.pixelSize())
-        , m_bold(fontData.bold())
-        , m_italic(fontData.italic())
-        , m_smallCaps(fontData.smallCaps())
-        , m_hash(0)
-    {
-        computeHash();
-    }
-
-    FontPlatformDataCacheKey(HashTableDeletedValueType) : m_size(hashTableDeletedSize()) { }
-    bool isHashTableDeletedValue() const { return m_size == hashTableDeletedSize(); }
-
-    enum HashTableEmptyValueType { HashTableEmptyValue };
-
-    FontPlatformDataCacheKey(HashTableEmptyValueType)
-        : m_familyName()
-        , m_size(0)
-        , m_bold(false)
-        , m_italic(false)
-        , m_smallCaps(false)
-        , m_hash(0)
-    {
-    }
-
-    bool operator==(const FontPlatformDataCacheKey& other) const
-    {
-        if (m_hash != other.m_hash)
-            return false;
-
-        return equalIgnoringCase(m_familyName, other.m_familyName) && m_size == other.m_size &&
-            m_bold == other.m_bold && m_italic == other.m_italic && m_smallCaps == other.m_smallCaps;
-    }
-
-    unsigned hash() const
-    {
-        return m_hash;
-    }
-
-    void computeHash()
-    {
-        unsigned hashCodes[] = {
-            CaseFoldingHash::hash(m_familyName),
-            m_size | static_cast<unsigned>(m_bold << sizeof(unsigned) * 8 - 1)
-                | static_cast<unsigned>(m_italic) << sizeof(unsigned) *8 - 2
-                | static_cast<unsigned>(m_smallCaps) << sizeof(unsigned) * 8 - 3
-        };
-        m_hash = StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
-    }
-
-private:
-    String m_familyName;
-    int m_size;
-    bool m_bold;
-    bool m_italic;
-    bool m_smallCaps;
-    unsigned m_hash;
-
-    static unsigned hashTableDeletedSize() { return 0xFFFFFFFFU; }
-};
-
-struct FontPlatformDataCacheKeyHash {
-    static unsigned hash(const FontPlatformDataCacheKey& key)
-    {
-        return key.hash();
-    }
-
-    static bool equal(const FontPlatformDataCacheKey& a, const FontPlatformDataCacheKey& b)
-    {
-        return a == b;
-    }
-
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-struct FontPlatformDataCacheKeyTraits : WTF::GenericHashTraits<FontPlatformDataCacheKey> {
-    static const bool needsDestruction = true;
-    static const FontPlatformDataCacheKey& emptyValue()
-    {
-        DEFINE_STATIC_LOCAL(FontPlatformDataCacheKey, key, (FontPlatformDataCacheKey::HashTableEmptyValue));
-        return key;
-    }
-    static void constructDeletedValue(FontPlatformDataCacheKey& slot)
-    {
-        new (&slot) FontPlatformDataCacheKey(HashTableDeletedValue);
-    }
-    static bool isDeletedValue(const FontPlatformDataCacheKey& value)
-    {
-        return value.isHashTableDeletedValue();
-    }
-};
-
-typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontPlatformDataCache;
-
-// using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
-static FontPlatformDataCache* gFontPlatformDataCache = 0;
-
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString&, bool)
-{
-    if (!gFontPlatformDataCache)
-        gFontPlatformDataCache = new FontPlatformDataCache;
-
-    FontPlatformDataCacheKey key(description);
-    FontPlatformData* platformData = gFontPlatformDataCache->get(key);
-    if (!platformData) {
-        platformData = new FontPlatformData(description);
-        gFontPlatformDataCache->add(key, platformData);
-    }
-    return platformData;
-}
-
-typedef HashMap<FontPlatformDataCacheKey, std::pair<SimpleFontData*, unsigned>, FontPlatformDataCacheKeyHash, FontPlatformDataCacheKeyTraits> FontDataCache;
-
-static FontDataCache* gFontDataCache = 0;
-
-static const int cMaxInactiveFontData = 40;
-static const int cTargetInactiveFontData = 32;
-
-static ListHashSet<const SimpleFontData*>* gInactiveFontDataSet = 0;
-
-SimpleFontData* FontCache::getCachedFontData(const FontPlatformData* fontPlatformData)
-{
-    if (!gFontDataCache) {
-        gFontDataCache = new FontDataCache;
-        gInactiveFontDataSet = new ListHashSet<const SimpleFontData*>;
-    }
-
-    FontPlatformDataCacheKey key(*fontPlatformData);
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    if (it == gFontDataCache->end()) {
-        SimpleFontData* fontData = new SimpleFontData(*fontPlatformData);
-        gFontDataCache->add(key, std::pair<SimpleFontData*, unsigned>(fontData, 1));
-        return fontData;
-    }
-    if (!it->second.second++) {
-        ASSERT(gInactiveFontDataSet->contains(it->second.first));
-        gInactiveFontDataSet->remove(it->second.first);
-    }
-    return it->second.first;
-}
-
-FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription&)
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font&, const UChar*, int)
 {
     return 0;
 }
 
-void FontCache::releaseFontData(const WebCore::SimpleFontData* fontData)
+FontPlatformData* FontCache::getSimilarFontPlatformData(const Font& font)
 {
-    ASSERT(gFontDataCache);
-    ASSERT(!fontData->isCustomFont());
-
-    FontPlatformDataCacheKey key(fontData->platformData());
-    FontDataCache::iterator it = gFontDataCache->find(key);
-    ASSERT(it != gFontDataCache->end());
-    if (!--it->second.second) {
-        gInactiveFontDataSet->add(it->second.first);
-        if (gInactiveFontDataSet->size() > cMaxInactiveFontData)
-            purgeInactiveFontData(gInactiveFontDataSet->size() - cTargetInactiveFontData);
-    }
-}
-
-void FontCache::purgeInactiveFontData(int count)
-{
-    static bool isPurging;  // Guard against reentry when e.g. a deleted FontData releases its small caps FontData.
-    if (isPurging)
-        return;
-
-    isPurging = true;
-
-    ListHashSet<const SimpleFontData*>::iterator it = gInactiveFontDataSet->begin();
-    ListHashSet<const SimpleFontData*>::iterator end = gInactiveFontDataSet->end();
-    for (int i = 0; i < count && it != end; ++i, ++it) {
-        FontPlatformDataCacheKey key = (*it)->platformData();
-        pair<SimpleFontData*, unsigned> fontDataPair = gFontDataCache->take(key);
-        ASSERT(fontDataPair.first != 0);
-        ASSERT(!fontDataPair.second);
-        delete fontDataPair.first;
-
-        FontPlatformData* platformData = gFontPlatformDataCache->take(key);
-        if (platformData)
-            delete platformData;
-    }
-
-    if (it == end) {
-        // Removed everything
-        gInactiveFontDataSet->clear();
-    } else {
-        for (int i = 0; i < count; ++i)
-            gInactiveFontDataSet->remove(gInactiveFontDataSet->begin());
-    }
-
-    isPurging = false;
+    return 0;
 }
 
-void FontCache::addClient(FontSelector*)
+FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
 {
+    const AtomicString fallbackFamily = QFont(fontDescription.family().family()).lastResortFont();
+    return new FontPlatformData(fontDescription, fallbackFamily);
 }
 
-void FontCache::removeClient(FontSelector*)
+void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
 {
 }
 
-void FontCache::invalidate()
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& familyName)
 {
-    if (!gFontPlatformDataCache || !gFontDataCache)
-        return;
-
-    purgeInactiveFontData();
+    return new FontPlatformData(fontDescription, familyName);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp b/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
index a19464e..6e9d053 100644
--- a/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/qt/FontCustomPlatformData.cpp
@@ -43,7 +43,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
         font.setWeight(QFont::Bold);
     font.setItalic(italic);
 
-    return FontPlatformData(font, bold);
+    return FontPlatformData(font);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
deleted file mode 100644
index 8e1e4f6..0000000
--- a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-
-    Replacement of the stock FontFallbackList as Qt is going to find us a
-    replacement font, will do caching and the other stuff we implement in
-    WebKit.
-*/
-
-#include "config.h"
-#include "FontFallbackList.h"
-
-#include "Font.h"
-#include "FontCache.h"
-#include "SegmentedFontData.h"
-
-#include <QDebug>
-
-namespace WebCore {
-
-FontFallbackList::FontFallbackList()
-    : m_pageZero(0)
-    , m_cachedPrimarySimpleFontData(0)
-    , m_fontSelector(0)
-    , m_familyIndex(0)
-    , m_pitch(UnknownPitch)
-    , m_loadingCustomFonts(false)
-    , m_generation(0)
-{
-}
-
-void FontFallbackList::invalidate(WTF::PassRefPtr<WebCore::FontSelector> fontSelector)
-{
-    releaseFontData();
-    m_fontList.clear();
-    m_pageZero = 0;
-    m_pages.clear();
-    m_cachedPrimarySimpleFontData = 0;
-    m_familyIndex = 0;
-    m_pitch = UnknownPitch;
-    m_loadingCustomFonts = false;
-    m_fontSelector = fontSelector;
-    m_generation = 0;
-}
-
-void FontFallbackList::releaseFontData()
-{
-    unsigned numFonts = m_fontList.size();
-    for (unsigned i = 0; i < numFonts; ++i) {
-        if (m_fontList[i].second)
-            delete m_fontList[i].first;
-        else {
-            ASSERT(!m_fontList[i].first->isSegmented());
-            fontCache()->releaseFontData(static_cast<const SimpleFontData*>(m_fontList[i].first));
-        }
-    }
-}
-
-void FontFallbackList::determinePitch(const WebCore::Font* font) const
-{
-    const FontData* fontData = primaryFontData(font);
-    if (!fontData->isSegmented())
-        m_pitch = static_cast<const SimpleFontData*>(fontData)->pitch();
-    else {
-        const SegmentedFontData* segmentedFontData = static_cast<const SegmentedFontData*>(fontData);
-        unsigned numRanges = segmentedFontData->numRanges();
-        if (numRanges == 1)
-            m_pitch = segmentedFontData->rangeAt(0).fontData()->pitch();
-        else
-            m_pitch = VariablePitch;
-    }
-}
-
-const FontData* FontFallbackList::fontDataAt(const WebCore::Font* _font, unsigned index) const
-{
-    if (index != 0)
-        return 0;
-
-    // Search for the WebCore font that is already in the list
-    for (int i = m_fontList.size() - 1; i >= 0; --i) {
-        pair<const FontData*, bool> item = m_fontList[i];
-        // item.second means that the item was created locally or not
-        if (!item.second)
-            return item.first;
-    }
-
-    // Use the FontSelector to get a WebCore font and then fallback to Qt
-    const FontDescription& description = _font->fontDescription();
-    const FontFamily* family = &description.family();
-    while (family) {
-        if (m_fontSelector) {
-            FontData* data = m_fontSelector->getFontData(description, family->family());
-            if (data) {
-                if (data->isLoading())
-                    m_loadingCustomFonts = true;
-                if (!data->isCustomFont()) {
-                    // Custom fonts can be freed anytime so we must not hold them
-                    m_fontList.append(pair<const FontData*, bool>(data, false));
-                }
-                return data;
-            }
-        }
-        family = family->next();
-    }
-
-    if (m_fontList.size())
-        return m_fontList[0].first;
-
-    const FontData* result = new SimpleFontData(FontPlatformData(description, _font->wordSpacing(), _font->letterSpacing()), true);
-    m_fontList.append(pair<const FontData*, bool>(result, true));
-    return result;
-}
-
-const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* font, const UChar*, int) const
-{
-    return primaryFontData(font);
-}
-
-void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData&)
-{
-    m_familyIndex = cAllFamiliesScanned;
-}
-
-}
diff --git a/WebCore/platform/graphics/qt/FontPlatformData.h b/WebCore/platform/graphics/qt/FontPlatformData.h
index 92219fd..4a3f8bc 100644
--- a/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -26,20 +26,62 @@
 
 #include "FontDescription.h"
 #include <QFont>
+#include <QHash>
 
 namespace WebCore {
 
 class String;
+class FontPlatformDataPrivate {
+public:
+    FontPlatformDataPrivate()
+        : refCount(1)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    FontPlatformDataPrivate(const float size, const bool bold, const bool oblique)
+        : refCount(1)
+        , size(size)
+        , bold(bold)
+        , oblique(oblique)
+    {}
+    FontPlatformDataPrivate(const QFont& font)
+        : refCount(1)
+        , font(font)
+        , size(font.pointSizeF())
+        , bold(font.bold())
+        , oblique(false)
+    {}
+    unsigned refCount;
+    QFont font;
+    float size;
+    bool bold : 1;
+    bool oblique : 1;
+};
+
+
 
-class FontPlatformData
-{
+class FontPlatformData : public FastAllocBase {
 public:
-#if ENABLE(SVG_FONTS)
     FontPlatformData(float size, bool bold, bool oblique);
-#endif
-    FontPlatformData();
-    FontPlatformData(const FontDescription&, int wordSpacing = 0, int letterSpacing = 0);
-    FontPlatformData(const QFont&, bool bold);
+    FontPlatformData(const FontPlatformData &);
+    FontPlatformData(const FontDescription&, const AtomicString& familyName, int wordSpacing = 0, int letterSpacing = 0);
+    FontPlatformData(const QFont& font)
+        : m_data(new FontPlatformDataPrivate(font))
+    {}
+    FontPlatformData(WTF::HashTableDeletedValueType)
+        : m_data(reinterpret_cast<FontPlatformDataPrivate*>(-1))
+    {}
+
+    ~FontPlatformData();
+
+    FontPlatformData& operator=(const FontPlatformData&);
+    bool operator==(const FontPlatformData&) const;
+
+    bool isHashTableDeletedValue() const
+    {
+        return m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1);
+    }
 
     static inline QFont::Weight toQFontWeight(FontWeight fontWeight)
     {
@@ -62,22 +104,62 @@ public:
         }
     }
 
-    QFont font() const { return m_font; }
-    float size() const { return m_size; }
-    QString family() const { return m_font.family(); }
-    bool bold() const { return m_bold; }
-    bool italic() const { return m_font.italic(); }
-    bool smallCaps() const { return m_font.capitalization() == QFont::SmallCaps; }
-    int pixelSize() const { return m_font.pixelSize(); }
+    QFont font() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font;
+        return QFont();
+    }
+    float size() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->size;
+        return 0.0f;
+    }
+    QString family() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.family();
+        return QString();
+    }
+    bool bold() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->bold;
+        return false;
+    }
+    bool italic() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.italic();
+        return false;
+    }
+    bool smallCaps() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.capitalization() == QFont::SmallCaps;
+        return false;
+    }
+    int pixelSize() const
+    {
+        Q_ASSERT(m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1));
+        if (m_data)
+            return m_data->font.pixelSize();
+        return 0;
+    }
+    unsigned hash() const;
 
 #ifndef NDEBUG
     String description() const;
 #endif
-
-    float m_size;
-    bool m_bold;
-    bool m_oblique;
-    QFont m_font;
+private:
+    FontPlatformDataPrivate* m_data;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 7709be6..2cc2fc6 100644
--- a/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -26,56 +26,104 @@
 
 namespace WebCore {
 
-FontPlatformData::FontPlatformData(const FontDescription& description, int wordSpacing, int letterSpacing)
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+static inline bool isEmtpyValue(const float size, const bool bold, const bool oblique)
 {
-    QString familyName;
+     // this is the empty value by definition of the trait FontDataCacheKeyTraits
+    return !bold && !oblique && size == 0.f;
+}
+
+FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
+{
+    if (isEmtpyValue(size, bold, oblique))
+        m_data = 0;
+    else
+        m_data = new FontPlatformDataPrivate(size, bold, oblique);
+}
+
+FontPlatformData::FontPlatformData(const FontPlatformData &other) : m_data(other.m_data)
+{
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+}
+
+FontPlatformData::FontPlatformData(const FontDescription& description, const AtomicString& familyName, int wordSpacing, int letterSpacing)
+    : m_data(new FontPlatformDataPrivate())
+{
+    QString familyNames(familyName);
+    if (!familyName.isEmpty())
+        familyNames += QLatin1Char(',');
+
     const FontFamily* family = &description.family();
     while (family) {
-        familyName += family->family();
+        familyNames += family->family();
         family = family->next();
         if (family)
-            familyName += QLatin1Char(',');
+            familyNames += QLatin1Char(',');
     }
+    QFont& font = m_data->font;
+    font.setFamily(familyName);
+    font.setPixelSize(qRound(description.computedSize()));
+    font.setItalic(description.italic());
+    font.setWeight(toQFontWeight(description.weight()));
+    font.setWordSpacing(wordSpacing);
+    font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
+    const bool smallCaps = description.smallCaps();
+    font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
+
+    m_data->bold = font.bold();
+    m_data->size = font.pointSizeF();
+}
 
-    m_font.setFamily(familyName);
-    m_font.setPixelSize(qRound(description.computedSize()));
-    m_font.setItalic(description.italic());
-
-    m_font.setWeight(toQFontWeight(description.weight()));
-    m_bold = m_font.bold();
-
-    bool smallCaps = description.smallCaps();
-    m_font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
-    m_font.setWordSpacing(wordSpacing);
-    m_font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
-    m_size = m_font.pointSize();
+FontPlatformData::~FontPlatformData()
+{
+    if (!m_data || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return;
+    --m_data->refCount;
+    if (!m_data->refCount)
+        delete m_data;
 }
 
-FontPlatformData::FontPlatformData(const QFont& font, bool bold)
-    : m_size(font.pointSize())
-    , m_bold(bold)
-    , m_oblique(false)
-    , m_font(font)
+FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
 {
+    if (m_data == other.m_data)
+        return *this;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1)) {
+        --m_data->refCount;
+        if (!m_data->refCount)
+            delete m_data;
+    }
+    m_data = other.m_data;
+    if (m_data && m_data != reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        ++m_data->refCount;
+    return *this;
 }
 
-#if ENABLE(SVG_FONTS)
-FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
-    : m_size(size)
-    , m_bold(bold)
-    , m_oblique(oblique)
+bool FontPlatformData::operator==(const FontPlatformData& other) const
 {
+    if (m_data == other.m_data)
+        return true;
+
+    if (!m_data || !other.m_data
+        || m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1) || other.m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return  false;
+
+    const bool equals = (m_data->size == other.m_data->size
+                         && m_data->bold == other.m_data->bold
+                         && m_data->oblique == other.m_data->oblique
+                         && m_data->font == other.m_data->font);
+    return equals;
 }
-#endif
 
-FontPlatformData::FontPlatformData()
-    : m_size(0.0f)
-    , m_bold(false)
-    , m_oblique(false)
+unsigned FontPlatformData::hash() const
 {
+    if (!m_data)
+        return 0;
+    if (m_data == reinterpret_cast<FontPlatformDataPrivate*>(-1))
+        return 1;
+    return qHash(m_data->font.toString())
+           ^ qHash(*reinterpret_cast<quint32*>(&m_data->size))
+           ^ qHash(m_data->bold)
+           ^ qHash(m_data->oblique);
 }
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index c5960ac..1e44626 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -42,7 +42,6 @@
 
 #include <limits.h>
 
-#if QT_VERSION >= 0x040400
 namespace WebCore {
 
 static const QString qstring(const TextRun& run)
@@ -229,5 +228,3 @@ QFont Font::font() const
 
 }
 
-#endif
-
diff --git a/WebCore/platform/graphics/qt/FontQt43.cpp b/WebCore/platform/graphics/qt/FontQt43.cpp
deleted file mode 100644
index 45bf05d..0000000
--- a/WebCore/platform/graphics/qt/FontQt43.cpp
+++ /dev/null
@@ -1,354 +0,0 @@
-/*
-    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
-    Copyright (C) 2008 Holger Hans Peter Freyther
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "Font.h"
-#include "FontDescription.h"
-#include "FontFallbackList.h"
-#include "FontSelector.h"
-
-#include "GraphicsContext.h"
-#include <QTextLayout>
-#include <QPainter>
-#include <QFontMetrics>
-#include <QFontInfo>
-#include <qalgorithms.h>
-#include <qdebug.h>
-
-#include <limits.h>
-
-#if QT_VERSION < 0x040400
-
-namespace WebCore {
-
-struct TextRunComponent {
-    TextRunComponent() : font(0) {}
-    TextRunComponent(const UChar *start, int length, bool rtl, const QFont *font, int offset, bool sc = false);
-    TextRunComponent(int spaces, bool rtl, const QFont *font, int offset);
-
-    inline bool isSpace() const { return spaces != 0; }
-
-    QString string;
-    const QFont *font;
-    int width;
-    int offset;
-    int spaces;
-};
-
-TextRunComponent::TextRunComponent(const UChar *start, int length, bool rtl, const QFont *f, int o, bool sc)
-    : string(reinterpret_cast<const QChar*>(start), length)
-    , font(f)
-    , offset(o)
-    , spaces(0)
-{
-    if (sc)
-        string = string.toUpper();
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = QFontMetrics(*font).width(string);
-}
-
-TextRunComponent::TextRunComponent(int s, bool rtl, const QFont *f, int o)
-    : string(s, QLatin1Char(' '))
-    , font(f)
-    , offset(o)
-    , spaces(s)
-{
-    string.prepend(rtl ? QChar(0x202e) : QChar(0x202d));
-    width = spaces * QFontMetrics(*font).width(QLatin1Char(' '));
-}
-
-
-static int generateComponents(Vector<TextRunComponent, 1024>* components, const Font &font, const TextRun &run)
-{
-//     qDebug() << "generateComponents" << QString((const QChar *)run.characters(), run.length());
-    int letterSpacing = font.letterSpacing();
-    int wordSpacing = font.wordSpacing();
-    bool smallCaps = font.fontDescription().smallCaps();
-    int padding = run.padding();
-    int numSpaces = 0;
-    if (padding) {
-        for (int i = 0; i < run.length(); i++)
-            if (Font::treatAsSpace(run[i]))
-                ++numSpaces;
-    }
-
-    int offset = 0;
-    const QFont *f = &font.font();
-    if (letterSpacing || smallCaps) {
-        // need to draw every letter on it's own
-        int start = 0;
-        if (Font::treatAsSpace(run[0])) {
-            int add = 0;
-            if (numSpaces) {
-                add = padding/numSpaces;
-                padding -= add;
-                --numSpaces;
-            }
-            components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-            offset += add + letterSpacing + components->last().width;
-            start = 1;
-//         qDebug() << "space at 0" << offset;
-        } else if (smallCaps)
-            f = (QChar::category(run[0]) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-
-        for (int i = 1; i < run.length(); ++i) {
-            uint ch = run[i];
-            if (QChar(ch).isHighSurrogate() && QChar(run[i-1]).isLowSurrogate())
-                ch = QChar::surrogateToUcs4(ch, run[i-1]);
-            if (QChar(ch).isLowSurrogate() || QChar::category(ch) == QChar::Mark_NonSpacing)
-                continue;
-            if (Font::treatAsSpace(run[i])) {
-                int add = 0;
-//                 qDebug() << "    treatAsSpace:" << i << start;
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset, f == &font.scFont()));
-                    offset += components->last().width + letterSpacing;
-//                     qDebug() << "   appending(1) " << components->last().string << components->last().width;
-                }
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += wordSpacing + add + components->last().width + letterSpacing;
-                start = i + 1;
-                continue;
-            } else if (!letterSpacing) {
-//                 qDebug() << i << char(run[i]) << (QChar::category(ch) == QChar::Letter_Lowercase) <<
-//                     QFontInfo(*f).pointSizeF();
-                if (QChar::category(ch) == QChar::Letter_Lowercase) {
-                    if (f == &font.scFont())
-                        continue;
-                } else {
-                    if (f == &font.font())
-                        continue;
-                }
-            }
-            if (i - start > 0) {
-                components->append(TextRunComponent(run.characters() + start, i - start,
-                                                    run.rtl(),
-                                                    f, offset, f == &font.scFont()));
-                offset += components->last().width + letterSpacing;
-//                 qDebug() << "   appending(2) " << components->last().string << components->last().width;
-            }
-            if (smallCaps)
-                f = (QChar::category(ch) == QChar::Letter_Lowercase ? &font.scFont() : &font.font());
-            start = i;
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset, f == &font.scFont()));
-            offset += components->last().width;
-//             qDebug() << "   appending(3) " << components->last().string << components->last().width;
-        }
-        offset += letterSpacing;
-    } else {
-        int start = 0;
-        for (int i = 0; i < run.length(); ++i) {
-            if (Font::treatAsSpace(run[i])) {
-                if (i - start > 0) {
-                    components->append(TextRunComponent(run.characters() + start, i - start,
-                                                        run.rtl(),
-                                                        f, offset));
-                    offset += components->last().width;
-                }
-                int add = 0;
-                if (numSpaces) {
-                    add = padding/numSpaces;
-                    padding -= add;
-                    --numSpaces;
-                }
-                components->append(TextRunComponent(1, run.rtl(), &font.font(), offset));
-                offset += add + components->last().width;
-                if (i)
-                    offset += wordSpacing;
-                start = i + 1;
-            }
-        }
-        if (run.length() - start > 0) {
-            components->append(TextRunComponent(run.characters() + start, run.length() - start,
-                                                run.rtl(),
-                                                f, offset));
-            offset += components->last().width;
-        }
-    }
-    return offset;
-}
-
-void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
-    if (to < 0)
-        to = run.length();
-
-    QPainter *p = ctx->platformContext();
-    Color color = ctx->fillColor();
-    p->setPen(QColor(color));
-
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from > 0 || to < run.length()) {
-        FloatRect clip = selectionRectForComplexText(run,
-                                              IntPoint(qRound(point.x()), qRound(point.y())),
-                                              QFontMetrics(font()).height(), from, to);
-        QRectF rect(clip.x(), clip.y() - ascent(), clip.width(), clip.height());
-        p->save();
-        p->setClipRect(rect.toRect());
-    }
-
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + w - components.at(i).offset - components.at(i).width, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            if (!components.at(i).isSpace()) {
-                p->setFont(*components.at(i).font);
-                QPointF pt(point.x() + components.at(i).offset, point.y());
-                p->drawText(pt, components.at(i).string);
-            }
-        }
-    }
-    if (from > 0 || to < run.length())
-        p->restore();
-}
-
-float Font::floatWidthForComplexText(const TextRun& run) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    return w;
-}
-
-int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool includePartialGlyphs) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    int offset = 0;
-    if (run.rtl()) {
-        for (int i = 0; i < components.size(); ++i) {
-            int xe = w - components.at(i).offset;
-            int xs = xe - components.at(i).width;
-            if (position >= xs) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    } else {
-        for (int i = 0; i < components.size(); ++i) {
-            int xs = components.at(i).offset;
-            int xe = xs + components.at(i).width;
-            if (position <= xe) {
-                QTextLayout layout(components.at(i).string, *components.at(i).font);
-                layout.beginLayout();
-                QTextLine l = layout.createLine();
-                if (!l.isValid())
-                    return offset;
-
-                l.setLineWidth(INT_MAX / 256);
-                layout.endLayout();
-
-                if (position - xs >= l.width())
-                    return offset + components.at(i).string.length() - 1;
-                int cursor = l.xToCursor(position - xs);
-                if (cursor > 1)
-                    --cursor;
-                return offset + cursor;
-            } else
-                offset += components.at(i).string.length() - 1;
-        }
-    }
-    return run.length();
-}
-
-static float cursorToX(const Vector<TextRunComponent, 1024>& components, int width, bool rtl, int cursor)
-{
-    int start = 0;
-    for (int i = 0; i < components.size(); ++i) {
-        if (start + components.at(i).string.length() - 1 < cursor) {
-            start += components.at(i).string.length() - 1;
-            continue;
-        }
-        int xs = components.at(i).offset;
-        if (rtl)
-            xs = width - xs - components.at(i).width;
-        QTextLayout layout(components.at(i).string, *components.at(i).font);
-        layout.beginLayout();
-        QTextLine l = layout.createLine();
-        if (!l.isValid())
-            return 0;
-
-        l.setLineWidth(INT_MAX / 256);
-        layout.endLayout();
-
-        return xs + l.cursorToX(cursor - start + 1);
-    }
-    return width;
-}
-
-FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint& pt,
-                                     int h, int from, int to) const
-{
-    Vector<TextRunComponent, 1024> components;
-    int w = generateComponents(&components, *this, run);
-
-    if (from == 0 && to == run.length())
-        return FloatRect(pt.x(), pt.y(), w, h);
-
-    float x1 = cursorToX(components, w, run.rtl(), from);
-    float x2 = cursorToX(components, w, run.rtl(), to);
-    if (x2 < x1)
-        qSwap(x1, x2);
-
-    return FloatRect(pt.x() + x1, pt.y(), x2 - x1, h);
-}
-
-int Font::lineGap() const
-{
-    return QFontMetrics(m_font).leading();
-}
-
-}
-
-#endif
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 57a481a..a095476 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -256,8 +256,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 }
 
@@ -639,24 +639,18 @@ void GraphicsContext::fillPath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
         drawFilledShadowPath(this, p, &path);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillPath(path, p->brush());
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.fillPattern) {
             TransformationMatrix affine;
             p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillPath(path, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
         }
     }
     m_data->currentPath = QPainterPath();
@@ -672,8 +666,7 @@ void GraphicsContext::strokePath()
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    if ((m_common->state.strokeColorSpace != SolidColorSpace)
-            || (strokeColor().alpha())) {
+    if (m_common->state.strokePattern || m_common->state.strokeGradient || strokeColor().alpha()) {
         IntSize shadowSize;
         int shadowBlur;
         Color shadowColor;
@@ -685,26 +678,20 @@ void GraphicsContext::strokePath()
             p->strokePath(path, shadowPen);
             p->setWorldTransform(t);
         }
-        switch (m_common->state.strokeColorSpace) {
-        case SolidColorSpace:
-            if (strokeColor().alpha())
-                p->strokePath(path, pen);
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.strokePattern) {
             TransformationMatrix affine;
             pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
-        case GradientColorSpace: {
+        } else if (m_common->state.strokeGradient) {
             QBrush brush(*m_common->state.strokeGradient->platformGradient());
             brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
             pen.setBrush(brush);
             p->setPen(pen);
             p->strokePath(path, pen);
-            break;
-        }
+        } else {
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
         }
     }
     m_data->currentPath = QPainterPath();
@@ -729,29 +716,23 @@ void GraphicsContext::fillRect(const FloatRect& rect)
 
     QPainter* p = m_data->p();
 
-    if ((m_common->state.fillColorSpace != SolidColorSpace)
-            || (fillColor().alpha())) {
+    if (m_common->state.fillPattern || m_common->state.fillGradient || fillColor().alpha()) {
         drawBorderlessRectShadow(this, p, rect);
-        switch (m_common->state.fillColorSpace) {
-        case SolidColorSpace:
-            if (fillColor().alpha())
-                p->fillRect(rect, p->brush());
-            break;
-        case PatternColorSpace: {
+        if (m_common->state.fillPattern) {
             TransformationMatrix affine;
             p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-            break;
-        }
-        case GradientColorSpace:
+        } else if (m_common->state.fillGradient) {
             QBrush brush(*m_common->state.fillGradient->platformGradient());
             brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
             p->fillRect(rect, brush);
-            break;
+        } else {
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
         }
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -762,7 +743,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
     p->fillRect(rect, m_data->solidColor);
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !color.alpha())
         return;
@@ -886,7 +867,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     return FloatRect(QRectF(result));
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&, ColorSpace)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
@@ -1225,7 +1206,7 @@ void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1255,7 +1236,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
     p->setPen(newPen);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
diff --git a/WebCore/platform/graphics/qt/IconQt.cpp b/WebCore/platform/graphics/qt/IconQt.cpp
index 98f4606..a9870fc 100644
--- a/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/WebCore/platform/graphics/qt/IconQt.cpp
@@ -40,15 +40,17 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    RefPtr<Icon> i = adoptRef(new Icon);
-    i->m_icon = QIcon(filename);
-    return i.release();
-}
+    if (filenames.isEmpty())
+        return 0;
+
+    if (filenames.size() == 1) {
+        RefPtr<Icon> i = adoptRef(new Icon);
+        i->m_icon = QIcon(filenames[0]);
+        return i.release();
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
     //FIXME: Implement this
     return 0;
 }
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index f8403b7..b6823dd 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -145,16 +145,8 @@ RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
     return &frame;
 }
 
-void ImageDecoderQt::clearFrameBufferCache(size_t index)
+void ImageDecoderQt::clearFrameBufferCache(size_t /*index*/)
 {
-    // Currently QImageReader will be asked to read everything. This
-    // might change when we read gif images on demand. For now we
-    // can have a rather simple implementation.
-    if (index > m_frameBufferCache.size())
-        return;
-
-    for (size_t i = 0; i < index; ++index)
-        m_frameBufferCache[index].clear();
 }
 
 void ImageDecoderQt::internalDecodeSize()
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index da6ddac..9a82911 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -44,9 +44,7 @@
 #include <QPainter>
 #include <QImage>
 #include <QImageReader>
-#if QT_VERSION >= 0x040300
 #include <QTransform>
-#endif
 
 #include <QDebug>
 
@@ -64,6 +62,8 @@ static QPixmap loadResourcePixmap(const char *name)
         pixmap = QWebSettings::webGraphic(QWebSettings::DefaultFrameIconGraphic);
     else if (qstrcmp(name, "textAreaResizeCorner") == 0)
         pixmap = QWebSettings::webGraphic(QWebSettings::TextAreaSizeGripCornerGraphic);
+    else if (qstrcmp(name, "deleteButton") == 0)
+        pixmap = QWebSettings::webGraphic(QWebSettings::DeleteButtonGraphic);
 
     return pixmap;
 }
@@ -94,7 +94,7 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
 }
 
 void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const TransformationMatrix& patternTransform,
-                        const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     QPixmap* framePixmap = nativeImageForCurrentFrame();
     if (!framePixmap) // If it's too early we won't have an image yet.
@@ -120,6 +120,38 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
         imageObserver()->didDraw(this);
 }
 
+BitmapImage::BitmapImage(QPixmap* pixmap, ImageObserver* observer)
+    : Image(observer)
+    , m_currentFrame(0)
+    , m_frames(0)
+    , m_frameTimer(0)
+    , m_repetitionCount(cAnimationNone)
+    , m_repetitionCountStatus(Unknown)
+    , m_repetitionsComplete(0)
+    , m_isSolidColor(false)
+    , m_checkedForSolidColor(false)
+    , m_animationFinished(true)
+    , m_allDataReceived(true)
+    , m_haveSize(true)
+    , m_sizeAvailable(true)
+    , m_decodedSize(0)
+    , m_haveFrameCount(true)
+    , m_frameCount(1)
+{
+    initPlatformData();
+
+    int width = pixmap->width();
+    int height = pixmap->height();
+    m_decodedSize = width * height * 4;
+    m_size = IntSize(width, height);
+
+    m_frames.grow(1);
+    m_frames[0].m_frame = pixmap;
+    m_frames[0].m_hasAlpha = pixmap->hasAlpha();
+    m_frames[0].m_haveMetadata = true;
+    checkForSolidColor();
+}
+
 void BitmapImage::initPlatformData()
 {
 }
@@ -130,7 +162,7 @@ void BitmapImage::invalidatePlatformData()
 
 // Drawing Routines
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                       const FloatRect& src, CompositeOperator op)
+                       const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     startAnimation();
 
@@ -139,7 +171,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -181,6 +213,13 @@ void BitmapImage::checkForSolidColor()
     m_solidColor = QColor::fromRgba(framePixmap->toImage().pixel(0, 0));
 }
 
+#if PLATFORM(WIN_OS)
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    return BitmapImage::create(new QPixmap(QPixmap::fromWinHBITMAP(hBitmap)));
+}
+#endif
+
 }
 
 
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 7078d16..f446755 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -101,15 +101,15 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     foreach (QWidget* widget, qFindChildren<QWidget*>(m_videoWidget))
         widget->installEventFilter(this);
 
-    connect(m_mediaObject, SIGNAL(stateChanged(Phonon::State, Phonon::State)),
-            this, SLOT(stateChanged(Phonon::State, Phonon::State)));
+    connect(m_mediaObject, SIGNAL(stateChanged(Phonon::State,Phonon::State)),
+            this, SLOT(stateChanged(Phonon::State,Phonon::State)));
     connect(m_mediaObject, SIGNAL(metaDataChanged()), this, SLOT(metaDataChanged()));
     connect(m_mediaObject, SIGNAL(seekableChanged(bool)), this, SLOT(seekableChanged(bool)));
     connect(m_mediaObject, SIGNAL(hasVideoChanged(bool)), this, SLOT(hasVideoChanged(bool)));
     connect(m_mediaObject, SIGNAL(bufferStatus(int)), this, SLOT(bufferStatus(int)));
     connect(m_mediaObject, SIGNAL(finished()), this, SLOT(finished()));
-    connect(m_mediaObject, SIGNAL(currentSourceChanged(const Phonon::MediaSource&)),
-            this, SLOT(currentSourceChanged(const Phonon::MediaSource&)));
+    connect(m_mediaObject, SIGNAL(currentSourceChanged(Phonon::MediaSource)),
+            this, SLOT(currentSourceChanged(Phonon::MediaSource)));
     connect(m_mediaObject, SIGNAL(aboutToFinish()), this, SLOT(aboutToFinish()));
     connect(m_mediaObject, SIGNAL(totalTimeChanged(qint64)), this, SLOT(totalTimeChanged(qint64)));
 }
diff --git a/WebCore/platform/graphics/qt/StillImageQt.cpp b/WebCore/platform/graphics/qt/StillImageQt.cpp
index 95b3bc8..1db04a7 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.cpp
+++ b/WebCore/platform/graphics/qt/StillImageQt.cpp
@@ -50,7 +50,7 @@ NativeImagePtr StillImage::nativeImageForCurrentFrame()
 }
 
 void StillImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
-                      const FloatRect& src, CompositeOperator op)
+                      const FloatRect& src, ColorSpace, CompositeOperator op)
 {
     if (m_pixmap.isNull())
         return;
diff --git a/WebCore/platform/graphics/qt/StillImageQt.h b/WebCore/platform/graphics/qt/StillImageQt.h
index 6c417b1..7be9136 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/WebCore/platform/graphics/qt/StillImageQt.h
@@ -46,7 +46,7 @@ namespace WebCore {
 
         virtual IntSize size() const;
         virtual NativeImagePtr nativeImageForCurrentFrame();
-        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
     private:
         StillImage(const QPixmap& pixmap);
diff --git a/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h b/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
index 5d85652..9fb6a8b 100644
--- a/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
+++ b/WebCore/platform/graphics/skia/BitmapImageSingleFrameSkia.h
@@ -72,7 +72,7 @@ public:
     }
 
 protected:
-    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace styleColorSpace, CompositeOperator);
 
 private:
     NativeImageSkia m_nativeImage;
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 889c41b..f1536a6 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -293,7 +293,10 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     path.addOval(r, SkPath::kCW_Direction);
     // only perform the inset if we won't invert r
     if (2 * thickness < rect.width() && 2 * thickness < rect.height()) {
-        r.inset(SkIntToScalar(thickness), SkIntToScalar(thickness));
+        // Adding one to the thickness doesn't make the border too thick as
+        // it's painted over afterwards. But without this adjustment the
+        // border appears a little anemic after anti-aliasing.
+        r.inset(SkIntToScalar(thickness + 1), SkIntToScalar(thickness + 1));
         path.addOval(r, SkPath::kCCW_Direction);
     }
     platformContext()->clipPathAntiAliased(path);
@@ -704,8 +707,6 @@ void GraphicsContext::fillPath()
       return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.fillColorSpace;
-
     path.setFillType(state.fillRule == RULE_EVENODD ?
         SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
 
@@ -727,14 +728,13 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     }
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.fillColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForFilling(&paint);
     platformContext()->canvas()->drawRect(r, paint);
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -765,7 +765,8 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect,
                                       const IntSize& topRight,
                                       const IntSize& bottomLeft,
                                       const IntSize& bottomRight,
-                                      const Color& color)
+                                      const Color& color,
+                                      ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -782,7 +783,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect,
         // Not all the radii fit, return a rect. This matches the behavior of
         // Path::createRoundedRectangle. Without this we attempt to draw a round
         // shadow for a square box.
-        fillRect(rect, color);
+        fillRect(rect, color, colorSpace);
         return;
     }
 
@@ -950,7 +951,7 @@ void GraphicsContext::setMiterLimit(float limit)
     platformContext()->setMiterLimit(limit);
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -977,7 +978,8 @@ void GraphicsContext::setPlatformFillPattern(Pattern* pattern)
 
 void GraphicsContext::setPlatformShadow(const IntSize& size,
                                         int blurInt,
-                                        const Color& color)
+                                        const Color& color,
+                                        ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1019,7 +1021,7 @@ void GraphicsContext::setPlatformShadow(const IntSize& size,
     dl->unref();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& strokecolor)
+void GraphicsContext::setPlatformStrokeColor(const Color& strokecolor, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -1118,7 +1120,6 @@ void GraphicsContext::strokePath()
         return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.strokeColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
@@ -1135,7 +1136,6 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float lineWidth)
         return;
 
     const GraphicsContextState& state = m_common->state;
-    ColorSpace colorSpace = state.strokeColorSpace;
 
     SkPaint paint;
     platformContext()->setupPaintForStroking(&paint, 0, 0);
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index a5c8926..c36f1ce 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -105,13 +105,16 @@ Image* ImageBuffer::image() const
 void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
 {
     const SkBitmap& bitmap = *context()->platformContext()->bitmap();
+    if (bitmap.isNull())
+        return;
+
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
     for (int y = 0; y < m_size.height(); ++y) {
         uint32_t* srcRow = bitmap.getAddr32(0, y);
         for (int x = 0; x < m_size.width(); ++x) {
             SkColor color = SkPMColorToColor(srcRow[x]);
-            srcRow[x] = SkPreMultiplyARGB(lookUpTable[SkColorGetA(color)],
+            srcRow[x] = SkPreMultiplyARGB(SkColorGetA(color),
                                           lookUpTable[SkColorGetR(color)],
                                           lookUpTable[SkColorGetG(color)],
                                           lookUpTable[SkColorGetB(color)]);
@@ -164,11 +167,12 @@ PassRefPtr<ImageData> getImageData(const IntRect& rect, const SkBitmap& bitmap,
         for (int x = 0; x < numColumns; ++x) {
             unsigned char* destPixel = &destRow[x * 4];
             if (multiplied == Unmultiplied) {
-                SkColor color = SkPMColorToColor(srcRow[x]);
-                destPixel[0] = SkColorGetR(color);
-                destPixel[1] = SkColorGetG(color);
-                destPixel[2] = SkColorGetB(color);
-                destPixel[3] = SkColorGetA(color);
+                SkColor color = srcRow[x];
+                unsigned a = SkColorGetA(color);
+                destPixel[0] = a ? SkColorGetR(color) * 255 / a : 0;
+                destPixel[1] = a ? SkColorGetG(color) * 255 / a : 0;
+                destPixel[2] = a ? SkColorGetB(color) * 255 / a : 0;
+                destPixel[3] = a;
             } else {
                 // Input and output are both pre-multiplied, we just need to re-arrange the
                 // bytes from the bitmap format to RGBA.
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index ecab364..6d8ed22 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -302,6 +302,7 @@ void Image::drawPattern(GraphicsContext* context,
                         const FloatRect& floatSrcRect,
                         const TransformationMatrix& patternTransform,
                         const FloatPoint& phase,
+                        ColorSpace styleColorSpace,
                         CompositeOperator compositeOp,
                         const FloatRect& destRect)
 {
@@ -405,7 +406,7 @@ void BitmapImage::checkForSolidColor()
 }
 
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
-                       const FloatRect& srcRect, CompositeOperator compositeOp)
+                       const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     if (!m_source.initialized())
         return;
@@ -437,6 +438,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
 void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
                                       const FloatRect& dstRect,
                                       const FloatRect& srcRect,
+                                      ColorSpace styleColorSpace,
                                       CompositeOperator compositeOp)
 {
     FloatRect normDstRect = normalizeRect(dstRect);
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index a079da0..dfffa0d 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -343,6 +343,15 @@ void PlatformContextSkia::setupPaintForFilling(SkPaint* paint) const
     paint->setShader(m_state->m_fillShader);
 }
 
+static SkScalar scalarBound(SkScalar v, SkScalar min, SkScalar max)
+{
+    if (v < min)
+        return min;
+    if (v > max)
+        return max;
+    return v;
+}
+
 float PlatformContextSkia::setupPaintForStroking(SkPaint* paint, SkRect* rect, int length) const
 {
     setupPaintCommon(paint);
@@ -351,10 +360,13 @@ float PlatformContextSkia::setupPaintForStroking(SkPaint* paint, SkRect* rect, i
     paint->setColor(m_state->applyAlpha(m_state->m_strokeColor));
     paint->setShader(m_state->m_strokeShader);
     paint->setStyle(SkPaint::kStroke_Style);
-    paint->setStrokeWidth(SkFloatToScalar(width));
+    // The limits here (512 and 256) were made up but are hopefully large
+    // enough to be reasonable. They are, empirically, small enough not to
+    // cause overflows in Skia.
+    paint->setStrokeWidth(scalarBound(SkFloatToScalar(width), 0, 512));
     paint->setStrokeCap(m_state->m_lineCap);
     paint->setStrokeJoin(m_state->m_lineJoin);
-    paint->setStrokeMiter(SkFloatToScalar(m_state->m_miterLimit));
+    paint->setStrokeMiter(scalarBound(SkFloatToScalar(m_state->m_miterLimit), 0, 256));
 
     if (m_state->m_dash)
         paint->setPathEffect(m_state->m_dash);
diff --git a/WebCore/platform/graphics/transforms/TransformOperations.h b/WebCore/platform/graphics/transforms/TransformOperations.h
index dd56408..08efd23 100644
--- a/WebCore/platform/graphics/transforms/TransformOperations.h
+++ b/WebCore/platform/graphics/transforms/TransformOperations.h
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-class TransformOperations {
+class TransformOperations : public FastAllocBase {
 public:
     TransformOperations(bool makeIdentity = false);
     
diff --git a/WebCore/platform/graphics/transforms/TransformationMatrix.h b/WebCore/platform/graphics/transforms/TransformationMatrix.h
index a7fbb3d..33f9afe 100644
--- a/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -29,6 +29,7 @@
 #include "FloatPoint.h"
 #include "IntPoint.h"
 #include <string.h> //for memcpy
+#include <wtf/FastAllocBase.h>
 
 #if PLATFORM(CG)
 #include <CoreGraphics/CGAffineTransform.h>
@@ -49,7 +50,7 @@ class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
 
-class TransformationMatrix {
+class TransformationMatrix : public FastAllocBase {
 public:
     typedef double Matrix4[4][4];
 
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index e2ed130..e901669 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -362,14 +362,14 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
         graphicsContext->clearShadow();
         Color fillColor = graphicsContext->fillColor();
         Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        graphicsContext->setFillColor(shadowFillColor);
+        graphicsContext->setFillColor(shadowFillColor, DeviceColorSpace);
         CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width(), point.y() + translation.height() + shadowSize.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         if (font->syntheticBoldOffset()) {
             CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowSize.width() + font->syntheticBoldOffset(), point.y() + translation.height() + shadowSize.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
-        graphicsContext->setFillColor(fillColor);
+        graphicsContext->setFillColor(fillColor, DeviceColorSpace);
     }
 
     CGContextSetTextPosition(cgContext, point.x() + translation.width(), point.y() + translation.height());
@@ -380,7 +380,7 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
     }
 
     if (hasSimpleShadow)
-        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor);
+        graphicsContext->setShadow(shadowSize, shadowBlur, shadowColor, DeviceColorSpace);
 
     wkRestoreFontSmoothingStyle(cgContext, oldFontSmoothingStyle);
 }
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index 1923ecc..137b914 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -70,8 +70,8 @@ GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
     setPaintingDisabled(!m_data->m_cgContext);
     if (m_data->m_cgContext) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 }
 
diff --git a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index 2489e02..61ae76c 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -74,8 +74,8 @@ GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
 
     if (m_data->cr) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), fillColorSpace());
+        setPlatformStrokeColor(strokeColor(), strokeColorSpace());
     }
 }
 
diff --git a/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
new file mode 100644
index 0000000..22faeb8
--- /dev/null
+++ b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
@@ -0,0 +1,721 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerCACF.h"
+
+#include "CString.h"
+#include "FloatConversion.h"
+#include "FloatRect.h"
+#include "Image.h"
+#include "PlatformString.h"
+#include "SystemTime.h"
+#include "WKCACFLayer.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/StringExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static inline void copyTransform(CATransform3D& toT3D, const TransformationMatrix& t)
+{
+    toT3D.m11 = narrowPrecisionToFloat(t.m11());
+    toT3D.m12 = narrowPrecisionToFloat(t.m12());
+    toT3D.m13 = narrowPrecisionToFloat(t.m13());
+    toT3D.m14 = narrowPrecisionToFloat(t.m14());
+    toT3D.m21 = narrowPrecisionToFloat(t.m21());
+    toT3D.m22 = narrowPrecisionToFloat(t.m22());
+    toT3D.m23 = narrowPrecisionToFloat(t.m23());
+    toT3D.m24 = narrowPrecisionToFloat(t.m24());
+    toT3D.m31 = narrowPrecisionToFloat(t.m31());
+    toT3D.m32 = narrowPrecisionToFloat(t.m32());
+    toT3D.m33 = narrowPrecisionToFloat(t.m33());
+    toT3D.m34 = narrowPrecisionToFloat(t.m34());
+    toT3D.m41 = narrowPrecisionToFloat(t.m41());
+    toT3D.m42 = narrowPrecisionToFloat(t.m42());
+    toT3D.m43 = narrowPrecisionToFloat(t.m43());
+    toT3D.m44 = narrowPrecisionToFloat(t.m44());
+}
+
+TransformationMatrix CAToTransform3D(const CATransform3D& fromT3D)
+{
+    return TransformationMatrix(
+        fromT3D.m11,
+        fromT3D.m12,
+        fromT3D.m13,
+        fromT3D.m14,
+        fromT3D.m21,
+        fromT3D.m22,
+        fromT3D.m23,
+        fromT3D.m24,
+        fromT3D.m31,
+        fromT3D.m32,
+        fromT3D.m33,
+        fromT3D.m34,
+        fromT3D.m41,
+        fromT3D.m42,
+        fromT3D.m43,
+        fromT3D.m44);
+}
+
+static void setLayerBorderColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef borderColor = createCGColor(color);
+    layer->setBorderColor(borderColor);
+    CGColorRelease(borderColor);
+}
+
+static void clearBorderColor(WKCACFLayer* layer)
+{
+    layer->setBorderColor(0);
+}
+
+static void setLayerBackgroundColor(WKCACFLayer* layer, const Color& color)
+{
+    CGColorRef bgColor = createCGColor(color);
+    layer->setBackgroundColor(bgColor);
+    CGColorRelease(bgColor);
+}
+
+static void clearLayerBackgroundColor(WKCACFLayer* layer)
+{
+    layer->setBackgroundColor(0);
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoordinatesOrientation()
+{
+    return CompositingCoordinatesBottomUp;
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return new GraphicsLayerCACF(client);
+}
+
+GraphicsLayerCACF::GraphicsLayerCACF(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+{
+    m_layer = WKCACFLayer::create(kCACFLayer, this);
+    
+    updateDebugIndicators();
+}
+
+GraphicsLayerCACF::~GraphicsLayerCACF()
+{
+    // clean up the WK layer
+    if (m_layer)
+        m_layer->removeFromSuperlayer();
+    
+    if (m_transformLayer)
+        m_transformLayer->removeFromSuperlayer();
+}
+
+void GraphicsLayerCACF::setName(const String& inName)
+{
+    String name = String::format("CALayer(%p) GraphicsLayer(%p) ", m_layer.get(), this) + inName;
+    GraphicsLayer::setName(name);
+    
+    m_layer->setName(inName);
+}
+
+NativeLayer GraphicsLayerCACF::nativeLayer() const
+{
+    return m_layer.get();
+}
+
+bool GraphicsLayerCACF::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    // FIXME: GraphicsLayer::setChildren calls addChild() for each sublayer, which
+    // will end up calling updateSublayerList() N times.
+    if (childrenChanged)
+        updateSublayerList();
+    
+    return childrenChanged;
+}
+
+void GraphicsLayerCACF::addChild(GraphicsLayer* childLayer)
+{
+    GraphicsLayer::addChild(childLayer);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    GraphicsLayer::addChildAtIndex(childLayer, index);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(childLayer, sibling);
+    updateSublayerList();
+}
+
+void GraphicsLayerCACF::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer *sibling)
+{
+    GraphicsLayer::addChildAbove(childLayer, sibling);
+    updateSublayerList();
+}
+
+bool GraphicsLayerCACF::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
+        updateSublayerList();
+        return true;
+    }
+    return false;
+}
+
+void GraphicsLayerCACF::removeFromParent()
+{
+    GraphicsLayer::removeFromParent();
+    layerForSuperlayer()->removeFromSuperlayer();            
+}
+
+void GraphicsLayerCACF::setPosition(const FloatPoint& point)
+{
+    GraphicsLayer::setPosition(point);
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::setAnchorPoint(const FloatPoint3D& point)
+{
+    if (point == m_anchorPoint)
+        return;
+
+    GraphicsLayer::setAnchorPoint(point);
+    updateAnchorPoint();
+}
+
+void GraphicsLayerCACF::setSize(const FloatSize& size)
+{
+    if (size == m_size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    updateLayerSize();
+}
+
+void GraphicsLayerCACF::setTransform(const TransformationMatrix& t)
+{
+    if (t == m_transform)
+        return;
+
+    GraphicsLayer::setTransform(t);
+    updateTransform();
+}
+
+void GraphicsLayerCACF::setChildrenTransform(const TransformationMatrix& t)
+{
+    if (t == m_childrenTransform)
+        return;
+
+    GraphicsLayer::setChildrenTransform(t);
+    updateChildrenTransform();
+}
+
+void GraphicsLayerCACF::setPreserves3D(bool preserves3D)
+{
+    if (preserves3D == m_preserves3D)
+        return;
+
+    GraphicsLayer::setPreserves3D(preserves3D);
+    updateLayerPreserves3D();
+}
+
+void GraphicsLayerCACF::setMasksToBounds(bool masksToBounds)
+{
+    if (masksToBounds == m_masksToBounds)
+        return;
+
+    GraphicsLayer::setMasksToBounds(masksToBounds);
+    updateMasksToBounds();
+}
+
+void GraphicsLayerCACF::setDrawsContent(bool drawsContent)
+{
+    if (drawsContent == m_drawsContent)
+        return;
+
+    GraphicsLayer::setDrawsContent(drawsContent);
+    updateLayerDrawsContent();
+}
+
+void GraphicsLayerCACF::setBackgroundColor(const Color& color)
+{
+    if (m_backgroundColorSet && m_backgroundColor == color)
+        return;
+
+    GraphicsLayer::setBackgroundColor(color);
+
+    m_contentsLayerHasBackgroundColor = true;
+    updateLayerBackgroundColor();
+}
+
+void GraphicsLayerCACF::clearBackgroundColor()
+{
+    if (!m_backgroundColorSet)
+        return;
+
+    GraphicsLayer::clearBackgroundColor();
+    clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::setContentsOpaque(bool opaque)
+{
+    if (m_contentsOpaque == opaque)
+        return;
+
+    GraphicsLayer::setContentsOpaque(opaque);
+    updateContentsOpaque();
+}
+
+void GraphicsLayerCACF::setBackfaceVisibility(bool visible)
+{
+    if (m_backfaceVisibility == visible)
+        return;
+    
+    GraphicsLayer::setBackfaceVisibility(visible);
+    updateBackfaceVisibility();
+}
+    
+void GraphicsLayerCACF::setOpacity(float opacity)
+{
+    float clampedOpacity = max(min(opacity, 1.0f), 0.0f);
+    
+    if (m_opacity == clampedOpacity)
+        return;
+    
+    GraphicsLayer::setOpacity(clampedOpacity);
+    primaryLayer()->setOpacity(opacity);
+}
+
+void GraphicsLayerCACF::setNeedsDisplay()
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay();
+}
+
+void GraphicsLayerCACF::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay(rect);
+}
+
+void GraphicsLayerCACF::setContentsRect(const IntRect& rect)
+{
+    if (rect == m_contentsRect)
+        return;
+
+    GraphicsLayer::setContentsRect(rect);
+    updateContentsRect();
+}
+
+void GraphicsLayerCACF::setContentsToImage(Image* image)
+{
+    bool childrenChanged = false;
+
+    if (image) {
+        m_pendingContentsImage = image->nativeImageForCurrentFrame();
+        m_contentsLayerPurpose = ContentsLayerForImage;
+        if (!m_contentsLayer)
+            childrenChanged = true;
+    } else {
+        m_pendingContentsImage = 0;
+        m_contentsLayerPurpose = NoContentsLayer;
+        if (m_contentsLayer)
+            childrenChanged = true;
+    }
+
+    updateContentsImage();
+
+    // This has to happen after updateContentsImage
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerCACF::setContentsToVideo(PlatformLayer* videoLayer)
+{
+    bool childrenChanged = false;
+
+    if (videoLayer != m_contentsLayer.get())
+        childrenChanged = true;
+
+    m_contentsLayer = videoLayer;
+    m_contentsLayerPurpose = videoLayer ? ContentsLayerForVideo : NoContentsLayer;
+
+    updateContentsVideo();
+
+    // This has to happen after updateContentsVideo
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerCACF::setGeometryOrientation(CompositingCoordinatesOrientation orientation)
+{
+    if (orientation == m_geometryOrientation)
+        return;
+
+    GraphicsLayer::setGeometryOrientation(orientation);
+    updateGeometryOrientation();
+}
+
+PlatformLayer* GraphicsLayerCACF::hostLayerForSublayers() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::layerForSuperlayer() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerCACF::platformLayer() const
+{
+    return primaryLayer();
+}
+
+void GraphicsLayerCACF::setDebugBackgroundColor(const Color& color)
+{
+    if (color.isValid())
+        setLayerBackgroundColor(m_layer.get(), color);
+    else
+        clearLayerBackgroundColor(m_layer.get());
+}
+
+void GraphicsLayerCACF::setDebugBorder(const Color& color, float borderWidth)
+{
+    if (color.isValid()) {
+        setLayerBorderColor(m_layer.get(), color);
+        m_layer->setBorderWidth(borderWidth);
+    } else {
+        clearBorderColor(m_layer.get());
+        m_layer->setBorderWidth(0);
+    }
+}
+
+GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayerCACF::defaultContentsOrientation() const
+{
+    return CompositingCoordinatesTopDown;
+}
+
+void GraphicsLayerCACF::updateSublayerList()
+{
+    Vector<RefPtr<WKCACFLayer> > newSublayers;
+
+    if (m_transformLayer) {
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
+        newSublayers.append(m_layer.get());
+    } else if (m_contentsLayer) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        newSublayers.append(m_contentsLayer.get());
+    }
+    
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerCACF* curChild = static_cast<GraphicsLayerCACF*>(childLayers[i]);
+     
+        WKCACFLayer* childLayer = curChild->layerForSuperlayer();
+        newSublayers.append(childLayer);
+    }
+
+    for (int i = 0; i < newSublayers.size(); ++i)
+        newSublayers[i]->removeFromSuperlayer();
+
+    if (m_transformLayer) {
+        m_transformLayer->setSublayers(newSublayers);
+
+        if (m_contentsLayer) {
+            // If we have a transform layer, then the contents layer is parented in the 
+            // primary layer (which is itself a child of the transform layer).
+            m_layer->removeAllSublayers();
+            m_layer->addSublayer(m_contentsLayer);
+        }
+    } else
+        m_layer->setSublayers(newSublayers);
+}
+
+void GraphicsLayerCACF::updateLayerPosition()
+{
+    // Position is offset on the layer by the layer anchor point.
+    CGPoint posPoint = CGPointMake(m_position.x() + m_anchorPoint.x() * m_size.width(),
+                                   m_position.y() + m_anchorPoint.y() * m_size.height());
+    
+    primaryLayer()->setPosition(posPoint);
+}
+
+void GraphicsLayerCACF::updateLayerSize()
+{
+    CGRect rect = CGRectMake(0, 0, m_size.width(), m_size.height());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(rect);
+        // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
+        CGPoint centerPoint = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(centerPoint);
+    }
+    
+    m_layer->setBounds(rect);
+    
+    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+
+    // if we've changed the bounds, we need to recalculate the position
+    // of the layer, taking anchor point into account.
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateAnchorPoint()
+{
+    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    updateLayerPosition();
+}
+
+void GraphicsLayerCACF::updateTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_transform);
+    primaryLayer()->setTransform(transform);
+}
+
+void GraphicsLayerCACF::updateChildrenTransform()
+{
+    CATransform3D transform;
+    copyTransform(transform, m_childrenTransform);
+    primaryLayer()->setSublayerTransform(transform);
+}
+
+void GraphicsLayerCACF::updateMasksToBounds()
+{
+    m_layer->setMasksToBounds(m_masksToBounds);
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateContentsOpaque()
+{
+    m_layer->setOpaque(m_contentsOpaque);
+}
+
+void GraphicsLayerCACF::updateBackfaceVisibility()
+{
+    m_layer->setDoubleSided(m_backfaceVisibility);
+}
+
+void GraphicsLayerCACF::updateLayerPreserves3D()
+{
+    if (m_preserves3D && !m_transformLayer) {
+        // Create the transform layer.
+        m_transformLayer = WKCACFLayer::create(kCACFTransformLayer, this);
+
+#ifndef NDEBUG
+        m_transformLayer->setName(String().format("Transform Layer CATransformLayer(%p) GraphicsLayer(%p)", m_transformLayer.get(), this));
+#endif
+        // Copy the position from this layer.
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        
+        CGPoint point = CGPointMake(m_size.width() / 2.0f, m_size.height() / 2.0f);
+        m_layer->setPosition(point);
+
+        m_layer->setAnchorPoint(CGPointMake(0.5f, 0.5f));
+        m_layer->setTransform(CATransform3DIdentity);
+        
+        // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
+        m_layer->setOpacity(1);
+
+        // Move this layer to be a child of the transform layer.
+        if (m_layer->superlayer())
+            m_layer->superlayer()->replaceSublayer(m_layer.get(), m_transformLayer.get());
+        m_transformLayer->addSublayer(m_layer.get());
+
+        updateSublayerList();
+    } else if (!m_preserves3D && m_transformLayer) {
+        // Relace the transformLayer in the parent with this layer.
+        m_layer->removeFromSuperlayer();
+        m_transformLayer->superlayer()->replaceSublayer(m_transformLayer.get(), m_layer.get());
+
+        // Release the transform layer.
+        m_transformLayer = 0;
+
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+
+        updateSublayerList();
+    }
+
+    updateOpacityOnLayer();
+}
+
+void GraphicsLayerCACF::updateLayerDrawsContent()
+{
+    if (m_drawsContent)
+        m_layer->setNeedsDisplay();
+    else
+        m_layer->setContents(nil);
+
+    updateDebugIndicators();
+}
+
+void GraphicsLayerCACF::updateLayerBackgroundColor()
+{
+    if (!m_contentsLayer)
+        return;
+
+    // We never create the contents layer just for background color yet.
+    if (m_backgroundColorSet)
+        setLayerBackgroundColor(m_contentsLayer.get(), m_backgroundColor);
+    else
+        clearLayerBackgroundColor(m_contentsLayer.get());
+}
+
+void GraphicsLayerCACF::updateContentsImage()
+{
+    if (m_pendingContentsImage) {
+        if (!m_contentsLayer.get()) {
+            RefPtr<WKCACFLayer> imageLayer = WKCACFLayer::create(kCACFLayer, this);
+#ifndef NDEBUG
+            imageLayer->setName("Image Layer");
+#endif
+            setupContentsLayer(imageLayer.get());
+            m_contentsLayer = imageLayer;
+            // m_contentsLayer will be parented by updateSublayerList
+        }
+
+        // FIXME: maybe only do trilinear if the image is being scaled down,
+        // but then what if the layer size changes?
+        m_contentsLayer->setMinificationFilter(kCACFFilterTrilinear);
+        m_contentsLayer->setContents(m_pendingContentsImage.get());
+        m_pendingContentsImage = 0;
+        
+        updateContentsRect();
+    } else {
+        // No image.
+        // m_contentsLayer will be removed via updateSublayerList.
+        m_contentsLayer = 0;
+    }
+}
+
+void GraphicsLayerCACF::updateContentsVideo()
+{
+    // Video layer was set as m_contentsLayer, and will get parented in updateSublayerList().
+    if (m_contentsLayer) {
+        setupContentsLayer(m_contentsLayer.get());
+        updateContentsRect();
+    }
+}
+
+void GraphicsLayerCACF::updateContentsRect()
+{
+    if (!m_contentsLayer)
+        return;
+        
+    CGPoint point = CGPointMake(m_contentsRect.x(),
+                                m_contentsRect.y());
+    CGRect rect = CGRectMake(0.0f,
+                             0.0f,
+                             m_contentsRect.width(),
+                             m_contentsRect.height());
+
+    m_contentsLayer->setPosition(point);
+    m_contentsLayer->setBounds(rect);
+}
+
+void GraphicsLayerCACF::updateGeometryOrientation()
+{
+    switch (geometryOrientation()) {
+        case CompositingCoordinatesTopDown:
+            m_layer->setGeometryFlipped(false);
+            break;
+        
+        case CompositingCoordinatesBottomUp:
+            m_layer->setGeometryFlipped(true);
+            break;
+    }
+    // Geometry orientation is mapped onto children transform in older QuartzCores,
+    // so is handled via setGeometryOrientation().
+}
+
+void GraphicsLayerCACF::setupContentsLayer(WKCACFLayer* contentsLayer)
+{
+    if (contentsLayer == m_contentsLayer)
+        return;
+
+    if (m_contentsLayer) {
+        m_contentsLayer->removeFromSuperlayer();
+        m_contentsLayer = 0;
+    }
+    
+    if (contentsLayer) {
+        m_contentsLayer = contentsLayer;
+
+        if (defaultContentsOrientation() == CompositingCoordinatesBottomUp) {
+            CATransform3D flipper = {
+                1.0f, 0.0f, 0.0f, 0.0f,
+                0.0f, -1.0f, 0.0f, 0.0f,
+                0.0f, 0.0f, 1.0f, 0.0f,
+                0.0f, 0.0f, 0.0f, 1.0f};
+            m_contentsLayer->setTransform(flipper);
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 1.0f));
+        } else
+            m_contentsLayer->setAnchorPoint(CGPointMake(0.0f, 0.0f));
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        m_layer->insertSublayer(m_contentsLayer.get(), 0);
+
+        updateContentsRect();
+
+        if (showDebugBorders()) {
+            setLayerBorderColor(m_contentsLayer.get(), Color(0, 0, 128, 180));
+            m_contentsLayer->setBorderWidth(1.0f);
+        }
+    }
+    updateDebugIndicators();
+}
+
+// This function simply mimics the operation of GraphicsLayerCA
+void GraphicsLayerCACF::updateOpacityOnLayer()
+{
+    primaryLayer()->setOpacity(m_opacity);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/GraphicsLayerCACF.h b/WebCore/platform/graphics/win/GraphicsLayerCACF.h
new file mode 100644
index 0000000..93ddf25
--- /dev/null
+++ b/WebCore/platform/graphics/win/GraphicsLayerCACF.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsLayerCACF_h_
+#define GraphicsLayerCACF_h_
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+#include "GraphicsContext.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class WKCACFLayer;
+
+class GraphicsLayerCACF : public GraphicsLayer {
+public:
+
+    GraphicsLayerCACF(GraphicsLayerClient*);
+    virtual ~GraphicsLayerCACF();
+
+    virtual void setName(const String& inName);
+
+    // for hosting this GraphicsLayer in a native layer hierarchy
+    virtual NativeLayer nativeLayer() const;
+
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer *layer);
+    virtual void addChildAtIndex(GraphicsLayer *layer, int index);
+    virtual void addChildAbove(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual void addChildBelow(GraphicsLayer *layer, GraphicsLayer *sibling);
+    virtual bool replaceChild(GraphicsLayer *oldChild, GraphicsLayer *newChild);
+
+    virtual void removeFromParent();
+
+    virtual void setPosition(const FloatPoint& inPoint);
+    virtual void setAnchorPoint(const FloatPoint3D& inPoint);
+    virtual void setSize(const FloatSize& inSize);
+
+    virtual void setTransform(const TransformationMatrix&);
+
+    virtual void setChildrenTransform(const TransformationMatrix&);
+
+    virtual void setPreserves3D(bool);
+    virtual void setMasksToBounds(bool);
+    virtual void setDrawsContent(bool);
+
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+
+    virtual void setContentsOpaque(bool);
+    virtual void setBackfaceVisibility(bool);
+
+    virtual void setOpacity(float opacity);
+
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+
+    virtual void setContentsRect(const IntRect&);
+
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToVideo(PlatformLayer*);
+    
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual void setDebugBackgroundColor(const Color&);
+    virtual void setDebugBorder(const Color&, float borderWidth);
+
+    virtual void setGeometryOrientation(CompositingCoordinatesOrientation);
+
+    void notifySyncRequired() { if (m_client) m_client->notifySyncRequired(this); }
+
+private:
+    void updateOpacityOnLayer();
+
+    WKCACFLayer* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
+    WKCACFLayer* hostLayerForSublayers() const;
+    WKCACFLayer* layerForSuperlayer() const;
+
+    CompositingCoordinatesOrientation defaultContentsOrientation() const;
+    void updateSublayerList();
+    void updateLayerPosition();
+    void updateLayerSize();
+    void updateAnchorPoint();
+    void updateTransform();
+    void updateChildrenTransform();
+    void updateMasksToBounds();
+    void updateContentsOpaque();
+    void updateBackfaceVisibility();
+    void updateLayerPreserves3D();
+    void updateLayerDrawsContent();
+    void updateLayerBackgroundColor();
+
+    void updateContentsImage();
+    void updateContentsVideo();
+    void updateContentsRect();
+    void updateGeometryOrientation();
+    
+    void setupContentsLayer(WKCACFLayer*);
+    WKCACFLayer* contentsLayer() const { return m_contentsLayer.get(); }
+    
+    RefPtr<WKCACFLayer> m_layer;
+    RefPtr<WKCACFLayer> m_transformLayer;
+    RefPtr<WKCACFLayer> m_contentsLayer;
+
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForVideo
+    };
+    
+    ContentsLayerPurpose m_contentsLayerPurpose;
+    bool m_contentsLayerHasBackgroundColor : 1;
+    RetainPtr<CGImageRef> m_pendingContentsImage;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // GraphicsLayerCACF_h_
diff --git a/WebCore/platform/graphics/win/IconWin.cpp b/WebCore/platform/graphics/win/IconWin.cpp
index 61f1fd3..d71ca00 100644
--- a/WebCore/platform/graphics/win/IconWin.cpp
+++ b/WebCore/platform/graphics/win/IconWin.cpp
@@ -47,20 +47,22 @@ Icon::~Icon()
     DestroyIcon(m_hIcon);
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
-    SHFILEINFO sfi;
-    memset(&sfi, 0, sizeof(sfi));
-
-    String tmpFilename = filename;
-    if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
+    if (filenames.isEmpty())
         return 0;
 
-    return adoptRef(new Icon(sfi.hIcon));
-}
+    if (filenames.size() == 1) {
+        SHFILEINFO sfi;
+        memset(&sfi, 0, sizeof(sfi));
+
+        String tmpFilename = filenames[0];
+        if (!SHGetFileInfo(tmpFilename.charactersWithNullTermination(), 0, &sfi, sizeof(sfi), SHGFI_ICON | SHGFI_SHELLICONSIZE | SHGFI_SMALLICON))
+            return 0;
+
+        return adoptRef(new Icon(sfi.hIcon));
+    }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
-{
 #if PLATFORM(WINCE)
     return 0;
 #else
diff --git a/WebCore/platform/graphics/win/ImageCGWin.cpp b/WebCore/platform/graphics/win/ImageCGWin.cpp
index 285fb71..2c6d41d 100644
--- a/WebCore/platform/graphics/win/ImageCGWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -77,9 +77,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
 
     // Do cleanup
     CGContextRelease(cgContext);
@@ -88,7 +88,7 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
     return true;
 }
 
-void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator compositeOp)
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     size_t frames = frameCount();
     for (size_t i = 0; i < frames; ++i) {
@@ -96,7 +96,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
         if (CGImageGetHeight(image) == static_cast<size_t>(srcSize.height()) && CGImageGetWidth(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
-            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), compositeOp);
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), styleColorSpace, compositeOp);
             m_currentFrame = currentFrame;
             return;
         }
@@ -104,7 +104,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 
     // No image of the correct size was found, fallback to drawing the current frame
     IntSize imageSize = BitmapImage::size();
-    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), compositeOp);
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), styleColorSpace, compositeOp);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 0b27438..e3c5ea0 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -82,9 +82,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
 
     // Do cleanup
     cairo_destroy(targetRef);
@@ -92,7 +92,7 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
     return true;
 }
 
-void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator compositeOp)
+void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const FloatRect& dstRect, const IntSize& srcSize, ColorSpace styleColorSpace, CompositeOperator compositeOp)
 {
     size_t frames = frameCount();
     for (size_t i = 0; i < frames; ++i) {
@@ -100,7 +100,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
         if (cairo_image_surface_get_height(image) == static_cast<size_t>(srcSize.height()) && cairo_image_surface_get_width(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
-            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), compositeOp);
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), DeviceColorSpace, compositeOp);
             m_currentFrame = currentFrame;
             return;
         }
@@ -108,7 +108,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 
     // No image of the correct size was found, fallback to drawing the current frame
     IntSize imageSize = BitmapImage::size();
-    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), compositeOp);
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, compositeOp);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/IntPointWin.cpp b/WebCore/platform/graphics/win/IntPointWin.cpp
index a6ce0bb..73db199 100644
--- a/WebCore/platform/graphics/win/IntPointWin.cpp
+++ b/WebCore/platform/graphics/win/IntPointWin.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntPoint.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/IntRectWin.cpp b/WebCore/platform/graphics/win/IntRectWin.cpp
index 6228be8..fe25a7f 100644
--- a/WebCore/platform/graphics/win/IntRectWin.cpp
+++ b/WebCore/platform/graphics/win/IntRectWin.cpp
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
@@ -23,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntRect.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/IntSizeWin.cpp b/WebCore/platform/graphics/win/IntSizeWin.cpp
index 8a27cdb..26e68da 100644
--- a/WebCore/platform/graphics/win/IntSizeWin.cpp
+++ b/WebCore/platform/graphics/win/IntSizeWin.cpp
@@ -23,6 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "IntSize.h"
 
 #include <windows.h>
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index 15e1001..a5beea1 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -318,6 +318,20 @@ void MediaPlayerPrivate::setPreservesPitch(bool preservesPitch)
     m_qtMovie->setPreservesPitch(preservesPitch);
 }
 
+bool MediaPlayerPrivate::hasClosedCaptions() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasClosedCaptions();
+}
+
+void MediaPlayerPrivate::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_qtMovie)
+        return;
+    m_qtMovie->setClosedCaptionsVisible(visible);
+}
+
 int MediaPlayerPrivate::dataRate() const
 {
     // This is not used at the moment
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
index 4a3a28e..2bccbbf 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -49,7 +49,10 @@ public:
     static void registerMediaEngine(MediaEngineRegistrar);
 
     ~MediaPlayerPrivate();
-    
+
+private:
+    MediaPlayerPrivate(MediaPlayer*);
+
     IntSize naturalSize() const;
     bool hasVideo() const;
     bool hasAudio() const;
@@ -93,8 +96,8 @@ public:
     
     bool hasSingleSecurityOrigin() const;
 
-private:
-    MediaPlayerPrivate(MediaPlayer*);
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
 
     void updateStates();
     void doSeek();
diff --git a/WebCore/platform/graphics/win/QTMovieWin.cpp b/WebCore/platform/graphics/win/QTMovieWin.cpp
index 56f3d0b..2d4c2ea 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.cpp
+++ b/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -45,6 +45,12 @@ using namespace std;
 
 static const long minimumQuickTimeVersion = 0x07300000; // 7.3
 
+static const long closedCaptionTrackType = 'clcp';
+static const long subTitleTrackType = 'sbtl';
+static const long mpeg4ObjectDescriptionTrackType = 'odsm';
+static const long mpeg4SceneDescriptionTrackType = 'sdsm';
+static const long closedCaptionDisplayPropertyID = 'disp';
+
 // Resizing GWorlds is slow, give them a minimum size so size of small 
 // videos can be animated smoothly
 static const int cGWorldMinWidth = 640;
@@ -757,10 +763,10 @@ void QTMovieWin::disableUnsupportedTracks(unsigned& enabledTrackCount, unsigned&
         allowedTrackTypes->add(SoundMediaType);
         allowedTrackTypes->add(TextMediaType);
         allowedTrackTypes->add(BaseMediaType);
-        allowedTrackTypes->add('clcp'); // Closed caption
-        allowedTrackTypes->add('sbtl'); // Subtitle
-        allowedTrackTypes->add('odsm'); // MPEG-4 object descriptor stream
-        allowedTrackTypes->add('sdsm'); // MPEG-4 scene description stream
+        allowedTrackTypes->add(closedCaptionTrackType);
+        allowedTrackTypes->add(subTitleTrackType);
+        allowedTrackTypes->add(mpeg4ObjectDescriptionTrackType);
+        allowedTrackTypes->add(mpeg4SceneDescriptionTrackType);
         allowedTrackTypes->add(TimeCodeMediaType);
         allowedTrackTypes->add(TimeCode64MediaType);
     }
@@ -877,6 +883,27 @@ bool QTMovieWin::hasAudio() const
     return (GetMovieIndTrackType(m_private->m_movie, 1, AudioMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
 }
 
+
+bool QTMovieWin::hasClosedCaptions() const 
+{
+    if (!m_private->m_movie)
+        return false;
+    return GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+}
+
+void QTMovieWin::setClosedCaptionsVisible(bool visible)
+{
+    if (!m_private->m_movie)
+        return;
+
+    Track ccTrack = GetMovieIndTrackType(m_private->m_movie, 1, closedCaptionTrackType, movieTrackMediaType);
+    if (!ccTrack)
+        return;
+
+    Boolean doDisplay = visible;
+    QTSetTrackProperty(ccTrack, closedCaptionTrackType, closedCaptionDisplayPropertyID, sizeof(doDisplay), &doDisplay);
+}
+
 pascal OSErr movieDrawingCompleteProc(Movie movie, long data)
 {
     UppParam param;
diff --git a/WebCore/platform/graphics/win/QTMovieWin.h b/WebCore/platform/graphics/win/QTMovieWin.h
index d178eb8..778f9aa 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.h
+++ b/WebCore/platform/graphics/win/QTMovieWin.h
@@ -98,6 +98,9 @@ public:
     bool hasVideo() const;
     bool hasAudio() const;
 
+    bool hasClosedCaptions() const;
+    void setClosedCaptionsVisible(bool);
+
     static unsigned countSupportedTypes();
     static void getSupportedType(unsigned index, const UChar*& str, unsigned& len);
 
diff --git a/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
new file mode 100644
index 0000000..e97b530
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFContextFlusher.h"
+
+#include <wtf/StdLibExtras.h>
+#include <QuartzCore/CACFContext.h>
+
+namespace WebCore {
+
+WKCACFContextFlusher& WKCACFContextFlusher::shared()
+{
+    DEFINE_STATIC_LOCAL(WKCACFContextFlusher, flusher, ());
+    return flusher;
+}
+
+WKCACFContextFlusher::WKCACFContextFlusher()
+{
+}
+
+WKCACFContextFlusher::~WKCACFContextFlusher()
+{
+}
+
+void WKCACFContextFlusher::addContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    m_contexts.add(context);
+    CFRetain(context);
+}
+
+void WKCACFContextFlusher::removeContext(CACFContextRef context)
+{
+    ASSERT(context);
+
+    ContextSet::iterator found = m_contexts.find(context);
+    if (found == m_contexts.end())
+        return;
+
+    CFRelease(*found);
+    m_contexts.remove(found);
+}
+
+void WKCACFContextFlusher::flushAllContexts()
+{
+    // addContext might get called beneath CACFContextFlush, and we don't want m_contexts to change while
+    // we're iterating over it, so we move the contexts into a local ContextSet and iterate over that instead.
+    ContextSet contextsToFlush;
+    contextsToFlush.swap(m_contexts);
+
+    ContextSet::const_iterator end = contextsToFlush.end();
+    for (ContextSet::const_iterator it = contextsToFlush.begin(); it != end; ++it) {
+        CACFContextRef context = *it;
+        CACFContextFlush(context);
+        CFRelease(context);
+    }
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
index 21af0a6..9ce76aa 100644
--- a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
@@ -23,28 +23,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
+#ifndef WKCACFContextFlusher_h
+#define WKCACFContextFlusher_h
 
-#if ENABLE(3D_CANVAS)
+#if USE(ACCELERATED_COMPOSITING)
 
-#include "JSCanvasShortArray.h"
+#include <wtf/Noncopyable.h>
 
-#include "CanvasShortArray.h"
+#include <wtf/HashSet.h>
 
-using namespace JSC;
+typedef struct _CACFContext* CACFContextRef;
 
 namespace WebCore {
 
-void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
-{
-    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
-}
+class WKCACFContextFlusher : public Noncopyable {
+public:
+    static WKCACFContextFlusher& shared();
+
+    void addContext(CACFContextRef);
+    void removeContext(CACFContextRef);
+
+    void flushAllContexts();
+
+private:
+    WKCACFContextFlusher();
+    ~WKCACFContextFlusher();
+
+    typedef HashSet<CACFContextRef> ContextSet;
+    ContextSet m_contexts;
+};
 
-JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
-{
-    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
 }
 
-} // namespace WebCore
+#endif // USE(ACCELERATED_COMPOSITING)
 
-#endif // ENABLE(3D_CANVAS)
+#endif // WKCACFContextFlusher_h
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.cpp b/WebCore/platform/graphics/win/WKCACFLayer.cpp
new file mode 100644
index 0000000..21e010d
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayer.cpp
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayer.h"
+
+#include "WKCACFContextFlusher.h"
+
+#include <stdio.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARender.h>
+
+#pragma comment(lib, "QuartzCore")

+
+namespace WebCore {
+
+using namespace std;
+
+static void displayInContext(CACFLayerRef layer, CGContextRef context)
+{
+    ASSERT_ARG(layer, WKCACFLayer::layer(layer));
+    WKCACFLayer::layer(layer)->display(context);
+}
+
+// FIXME: It might be good to have a way of ensuring that all WKCACFLayers eventually
+// get destroyed in debug builds. A static counter could accomplish this pretty easily.
+
+WKCACFLayer::WKCACFLayer(CFStringRef className, GraphicsLayerCACF* owner)
+    : m_layer(AdoptCF, CACFLayerCreate(className))
+    , m_needsDisplayOnBoundsChange(false)
+    , m_owner(owner)
+{
+    CACFLayerSetUserData(layer(), this);
+    CACFLayerSetDisplayCallback(layer(), displayInContext);
+}
+
+WKCACFLayer::~WKCACFLayer()
+{
+    // Our superlayer should be holding a reference to us, so there should be no way for us to be destroyed while we still have a superlayer.
+    ASSERT(!superlayer());
+
+    CACFLayerSetUserData(layer(), 0);
+    CACFLayerSetDisplayCallback(layer(), 0);
+}
+
+void WKCACFLayer::display(PlatformGraphicsContext* context)
+{
+    if (!m_owner)
+        return;
+
+    CGContextSaveGState(context);
+
+    CGRect layerBounds = bounds();
+    if (m_owner->contentsOrientation() == WebCore::GraphicsLayer::CompositingCoordinatesTopDown) {
+        CGContextScaleCTM(context, 1, -1);
+        CGContextTranslateCTM(context, 0, -layerBounds.size.height);
+    }
+
+    if (m_owner->client()) {
+        GraphicsContext graphicsContext(context);
+
+        // It's important to get the clip from the context, because it may be significantly
+        // smaller than the layer bounds (e.g. tiled layers)
+        CGRect clipBounds = CGContextGetClipBoundingBox(context);
+        IntRect clip(enclosingIntRect(clipBounds));
+        m_owner->paintGraphicsLayerContents(graphicsContext, clip);
+    }
+#ifndef NDEBUG
+    else {
+        ASSERT_NOT_REACHED();
+
+        // FIXME: ideally we'd avoid calling -setNeedsDisplay on a layer that is a plain color,
+        // so CA never makes backing store for it (which is what -setNeedsDisplay will do above).
+        CGContextSetRGBFillColor(context, 0.0f, 1.0f, 0.0f, 1.0f);
+        CGContextFillRect(context, layerBounds);
+    }
+#endif
+
+    if (m_owner->showRepaintCounter()) {
+        char text[16]; // that's a lot of repaints
+        _snprintf(text, sizeof(text), "%d", m_owner->incrementRepaintCount());
+
+        CGContextSaveGState(context);
+        CGContextSetRGBFillColor(context, 1.0f, 0.0f, 0.0f, 0.8f);
+        
+        CGRect aBounds = layerBounds;
+
+        aBounds.size.width = 10 + 12 * strlen(text);
+        aBounds.size.height = 25;
+        CGContextFillRect(context, aBounds);
+        
+        CGContextSetRGBFillColor(context, 0.0f, 0.0f, 0.0f, 1.0f);
+
+        CGContextSetTextMatrix(context, CGAffineTransformMakeScale(1.0f, -1.0f));
+        CGContextSelectFont(context, "Helvetica", 25, kCGEncodingMacRoman);
+        CGContextShowTextAtPoint(context, aBounds.origin.x + 3.0f, aBounds.origin.y + 20.0f, text, strlen(text));
+        
+        CGContextRestoreGState(context);        
+    }
+
+    CGContextRestoreGState(context);
+}
+
+void WKCACFLayer::becomeRootLayerForContext(CACFContextRef context)
+{
+    CACFContextSetLayer(context, layer());
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsCommit()
+{
+    CACFContextRef context = CACFLayerGetContext(rootLayer()->layer());
+
+    // The context might now be set yet. This happens if a property gets set
+    // before placing the layer in the tree. In this case we don't need to 
+    // worry about remembering the context because we will when the layer is
+    // added to the tree.
+    if (context)
+        WKCACFContextFlusher::shared().addContext(context);
+
+    // Call notifySyncRequired(), which in this implementation plumbs through to
+    // call setRootLayerNeedsDisplay() on the WebView, which causes the CACFRenderer
+    // to render a frame.
+    if (m_owner)
+        m_owner->notifySyncRequired();
+}
+
+void WKCACFLayer::addSublayer(PassRefPtr<WKCACFLayer> sublayer)
+{
+    insertSublayer(sublayer, numSublayers());
+}
+
+void WKCACFLayer::insertSublayer(PassRefPtr<WKCACFLayer> sublayer, size_t index)
+{
+    index = min(index, numSublayers());
+    CACFLayerInsertSublayer(layer(), sublayer->layer(), index);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::insertSublayerAboveLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex + 1);
+}
+
+void WKCACFLayer::insertSublayerBelowLayer(PassRefPtr<WKCACFLayer> sublayer, const WKCACFLayer* reference)
+{
+    if (!reference) {
+        insertSublayer(sublayer, 0);
+        return;
+    }
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        addSublayer(sublayer);
+        return;
+    }
+
+    insertSublayer(sublayer, referenceIndex);
+}
+
+void WKCACFLayer::replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer> newLayer)
+{
+    ASSERT_ARG(reference, reference);
+    ASSERT_ARG(reference, reference->superlayer() == this);
+
+    if (reference == newLayer)
+        return;
+
+    if (!newLayer) {
+        removeSublayer(reference);
+        return;
+    }
+
+    newLayer->removeFromSuperlayer();
+
+    int referenceIndex = indexOfSublayer(reference);
+    ASSERT(referenceIndex != -1);
+    if (referenceIndex == -1)
+        return;
+
+    // FIXME: Can we make this more efficient? The current CACF API doesn't seem to give us a way to do so.
+    reference->removeFromSuperlayer();
+    insertSublayer(newLayer, referenceIndex);
+}
+
+void WKCACFLayer::removeFromSuperlayer()
+{
+    WKCACFLayer* superlayer = this->superlayer();
+    if (!superlayer)
+        return;
+
+    superlayer->removeSublayer(this);
+    CACFLayerRemoveFromSuperlayer(layer());
+    superlayer->setNeedsCommit();
+}
+
+void WKCACFLayer::removeSublayer(const WKCACFLayer* sublayer)
+{
+    int foundIndex = indexOfSublayer(sublayer);
+    if (foundIndex == -1)
+        return;
+
+    CACFLayerRemoveFromSuperlayer(sublayer->layer());
+    setNeedsCommit();
+}
+
+int WKCACFLayer::indexOfSublayer(const WKCACFLayer* reference)
+{
+    CACFLayerRef ref = reference->layer();
+    if (!ref)
+        return -1;
+
+    CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+    size_t n = CFArrayGetCount(sublayers);
+
+    for (size_t i = 0; i < n; ++i)
+        if (CFArrayGetValueAtIndex(sublayers, i) == ref)
+            return i;
+
+    return -1;
+}
+
+WKCACFLayer* WKCACFLayer::ancestorOrSelfWithSuperlayer(WKCACFLayer* superlayer) const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* ancestor = this->superlayer(); ancestor; layer = ancestor, ancestor = ancestor->superlayer()) {
+        if (ancestor == superlayer)
+            return layer;
+    }
+    return 0;
+}
+
+void WKCACFLayer::setBounds(const CGRect& rect)
+{
+    if (CGRectEqualToRect(rect, bounds()))
+        return;
+
+    CACFLayerSetBounds(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+void WKCACFLayer::setFrame(const CGRect& rect)
+{
+    CGRect oldFrame = frame();
+    if (CGRectEqualToRect(rect, oldFrame))
+        return;
+
+    CACFLayerSetFrame(layer(), rect);
+    setNeedsCommit();
+
+    if (m_needsDisplayOnBoundsChange)
+        setNeedsDisplay();
+}
+
+WKCACFLayer* WKCACFLayer::rootLayer() const
+{
+    WKCACFLayer* layer = const_cast<WKCACFLayer*>(this);
+    for (WKCACFLayer* superlayer = layer->superlayer(); superlayer; layer = superlayer, superlayer = superlayer->superlayer()) { }
+    return layer;
+}
+
+void WKCACFLayer::removeAllSublayers()
+{
+    CACFLayerSetSublayers(layer(), 0);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setSublayers(const Vector<RefPtr<WKCACFLayer> >& sublayers)
+{
+    if (sublayers.isEmpty())
+        CACFLayerSetSublayers(layer(), 0);
+    else {
+        // Create a vector of CACFLayers.
+        Vector<const void*> layers;
+        for (size_t i = 0; i < sublayers.size(); i++)
+            layers.append(sublayers[i]->layer());
+    
+        RetainPtr<CFArrayRef> layersArray(AdoptCF, CFArrayCreate(0, layers.data(), layers.size(), 0));
+        CACFLayerSetSublayers(layer(), layersArray.get());
+    }
+    
+    setNeedsCommit();
+}
+
+void WKCACFLayer::moveSublayers(WKCACFLayer* fromLayer, WKCACFLayer* toLayer)
+{
+    if (!fromLayer || !toLayer)
+        return;
+
+    CACFLayerSetSublayers(toLayer->layer(), CACFLayerGetSublayers(fromLayer->layer()));
+    fromLayer->setNeedsCommit();
+    toLayer->setNeedsCommit();
+}
+
+WKCACFLayer* WKCACFLayer::superlayer() const
+{
+    CACFLayerRef super = CACFLayerGetSuperlayer(layer());
+    if (!super)
+        return 0;
+    return WKCACFLayer::layer(super);
+}
+
+void WKCACFLayer::setNeedsDisplay(const CGRect& dirtyRect)
+{
+    if (m_owner)
+        CACFLayerSetNeedsDisplay(layer(), &dirtyRect);
+    setNeedsCommit();
+}
+
+void WKCACFLayer::setNeedsDisplay()
+{
+    if (m_owner)
+        CACFLayerSetNeedsDisplay(layer(), 0);
+    setNeedsCommit();
+}
+
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.h b/WebCore/platform/graphics/win/WKCACFLayer.h
new file mode 100644
index 0000000..6655f7a
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayer.h
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayer_h
+#define WKCACFLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "StringHash.h"
+
+#include <wtf/RefCounted.h>
+
+#include <QuartzCore/CACFLayer.h>
+#include <QuartzCore/CACFVector.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+#include "GraphicsContext.h"
+#include "GraphicsLayerCACF.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class WKCACFAnimation;
+class WKCACFTimingFunction;
+
+class WKCACFLayer : public RefCounted<WKCACFLayer> {
+public:
+    static PassRefPtr<WKCACFLayer> create(CFStringRef className, GraphicsLayerCACF* owner = 0) { return adoptRef(new WKCACFLayer(className, owner)); }
+    static WKCACFLayer* layer(CACFLayerRef layer) { return static_cast<WKCACFLayer*>(CACFLayerGetUserData(layer)); }
+
+    ~WKCACFLayer();
+
+    // Makes this layer the root when the passed context is rendered
+    void becomeRootLayerForContext(CACFContextRef);
+
+    static RetainPtr<CFTypeRef> cfValue(float value) { return RetainPtr<CFTypeRef>(AdoptCF, CFNumberCreate(0, kCFNumberFloat32Type, &value)); }
+    static RetainPtr<CFTypeRef> cfValue(const TransformationMatrix& value)
+    {
+        CATransform3D t;
+        t.m11 = value.m11();
+        t.m12 = value.m12();
+        t.m13 = value.m13();
+        t.m14 = value.m14(); 
+        t.m21 = value.m21();
+        t.m22 = value.m22();
+        t.m23 = value.m23();
+        t.m24 = value.m24(); 
+        t.m31 = value.m31();
+        t.m32 = value.m32();
+        t.m33 = value.m33();
+        t.m34 = value.m34(); 
+        t.m41 = value.m41();
+        t.m42 = value.m42();
+        t.m43 = value.m43();
+        t.m44 = value.m44(); 
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreateTransform(t));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatPoint& value)
+    {
+        CGPoint p;
+        p.x = value.x(); p.y = value.y();
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreatePoint(p));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const FloatRect& rect)
+    {
+        CGRect r;
+        r.origin.x = rect.x();
+        r.origin.y = rect.y();
+        r.size.width = rect.width();
+        r.size.height = rect.height();
+        CGFloat v[4] = { CGRectGetMinX(r), CGRectGetMinY(r), CGRectGetMaxX(r), CGRectGetMaxY(r) };
+        return RetainPtr<CFTypeRef>(AdoptCF, CACFVectorCreate(4, v));
+    }
+    static RetainPtr<CFTypeRef> cfValue(const Color& color)
+    {
+        return RetainPtr<CFTypeRef>(AdoptCF, CGColorCreateGenericRGB(color.red(), color.green(), color.blue(), color.alpha()));
+    }
+
+    void display(PlatformGraphicsContext*);
+
+    bool isTransformLayer() const { return CACFLayerGetClass(layer()) == kCACFTransformLayer; }
+
+    void addSublayer(PassRefPtr<WKCACFLayer> sublayer);
+    void insertSublayer(PassRefPtr<WKCACFLayer>, size_t index);
+    void insertSublayerAboveLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void insertSublayerBelowLayer(PassRefPtr<WKCACFLayer>, const WKCACFLayer* reference);
+    void replaceSublayer(WKCACFLayer* reference, PassRefPtr<WKCACFLayer>);
+    void removeFromSuperlayer();
+    static void moveSublayers(WKCACFLayer* fromLayer, WKCACFLayer* toLayer);
+
+    WKCACFLayer* ancestorOrSelfWithSuperlayer(WKCACFLayer*) const;
+    
+    void setAnchorPoint(const CGPoint& p) { CACFLayerSetAnchorPoint(layer(), p); setNeedsCommit(); }
+    CGPoint anchorPoint() const { return CACFLayerGetAnchorPoint(layer()); }
+
+    void setAnchorPointZ(CGFloat z) { CACFLayerSetAnchorPointZ(layer(), z); setNeedsCommit(); }
+    CGFloat anchorPointZ() const { return CACFLayerGetAnchorPointZ(layer()); }
+
+    void setBackgroundColor(CGColorRef color) { CACFLayerSetBackgroundColor(layer(), color); setNeedsCommit(); }
+    CGColorRef backgroundColor() const { return CACFLayerGetBackgroundColor(layer()); }
+
+    void setBorderColor(CGColorRef color) { CACFLayerSetBorderColor(layer(), color); setNeedsCommit(); }
+    CGColorRef borderColor() const { return CACFLayerGetBorderColor(layer()); }
+
+    void setBorderWidth(CGFloat width) { CACFLayerSetBorderWidth(layer(), width); setNeedsCommit(); }
+    CGFloat borderWidth() const { return CACFLayerGetBorderWidth(layer()); }
+
+    void setBounds(const CGRect&);
+    CGRect bounds() const { return CACFLayerGetBounds(layer()); }
+
+    void setClearsContext(bool clears) { CACFLayerSetClearsContext(layer(), clears); setNeedsCommit(); }
+    bool clearsContext() const { return CACFLayerGetClearsContext(layer()); }
+
+    void setContents(CGImageRef contents) { CACFLayerSetContents(layer(), contents); setNeedsCommit(); }
+    CGImageRef contents() const { return static_cast<CGImageRef>(const_cast<void*>(CACFLayerGetContents(layer()))); }
+
+    void setContentsRect(const CGRect& contentsRect) { CACFLayerSetContentsRect(layer(), contentsRect); setNeedsCommit(); }
+    CGRect contentsRect() const { return CACFLayerGetContentsRect(layer()); }
+
+    void setContentsGravity(CFStringRef str) { CACFLayerSetContentsGravity(layer(), str); setNeedsCommit(); }
+    CFStringRef contentsGravity() const { return CACFLayerGetContentsGravity(layer()); }
+        
+    void setDoubleSided(bool b) { CACFLayerSetDoubleSided(layer(), b); setNeedsCommit(); }
+    bool doubleSided() const { return CACFLayerIsDoubleSided(layer()); }
+
+    void setEdgeAntialiasingMask(uint32_t mask) { CACFLayerSetEdgeAntialiasingMask(layer(), mask); setNeedsCommit(); }
+    uint32_t edgeAntialiasingMask() const { return CACFLayerGetEdgeAntialiasingMask(layer()); }
+
+    void setFilters(CFArrayRef filters) { CACFLayerSetFilters(layer(), filters); setNeedsCommit(); }
+    CFArrayRef filters() const { return CACFLayerGetFilters(layer()); }
+
+    void setFrame(const CGRect&);
+    CGRect frame() const { return CACFLayerGetFrame(layer()); }
+
+    void setHidden(bool hidden) { CACFLayerSetHidden(layer(), hidden); setNeedsCommit(); }
+    bool isHidden() const { return CACFLayerIsHidden(layer()); }
+
+    void setMasksToBounds(bool b) { CACFLayerSetMasksToBounds(layer(), b); }
+    bool masksToBounds() const { return CACFLayerGetMasksToBounds(layer()); }
+
+    void setMagnificationFilter(const String& string) { CACFLayerSetMagnificationFilter(layer(), RetainPtr<CFStringRef>(AdoptCF, string.createCFString()).get()); }
+    String magnificationFilter() const { return CACFLayerGetMagnificationFilter(layer()); }
+
+    void setMinificationFilter(const String& string) { CACFLayerSetMinificationFilter(layer(), RetainPtr<CFStringRef>(AdoptCF, string.createCFString()).get()); }
+    String minificationFilter() const { return CACFLayerGetMinificationFilter(layer()); }
+
+    void setMinificationFilterBias(float bias) { CACFLayerSetMinificationFilterBias(layer(), bias); }
+    float minificationFilterBias() const { return CACFLayerGetMinificationFilterBias(layer()); }
+
+    void setName(const String& name) { CACFLayerSetName(layer(), RetainPtr<CFStringRef>(AdoptCF, name.createCFString()).get()); }
+    String name() const { return CACFLayerGetName(layer()); }
+
+    void setNeedsDisplay(const CGRect& dirtyRect);
+    void setNeedsDisplay();
+    
+    void setNeedsDisplayOnBoundsChange(bool needsDisplay) { m_needsDisplayOnBoundsChange = needsDisplay; }
+
+    void setOpacity(float opacity) { CACFLayerSetOpacity(layer(), opacity); setNeedsCommit(); }
+    float opacity() const { return CACFLayerGetOpacity(layer()); }
+
+    void setOpaque(bool b) { CACFLayerSetOpaque(layer(), b); setNeedsCommit(); }
+    bool opaque() const { return CACFLayerIsOpaque(layer()); }
+
+    void setPosition(const CGPoint& position) { CACFLayerSetPosition(layer(), position); setNeedsCommit(); }
+    CGPoint position() const { return CACFLayerGetPosition(layer()); }
+
+    void setZPosition(CGFloat position) { CACFLayerSetZPosition(layer(), position); setNeedsCommit(); }
+    CGFloat zPosition() const { return CACFLayerGetZPosition(layer()); }
+
+    void setSpeed(float speed) { CACFLayerSetSpeed(layer(), speed); }
+    CFTimeInterval speed() const { CACFLayerGetSpeed(layer()); }
+
+    void setTimeOffset(CFTimeInterval t) { CACFLayerSetTimeOffset(layer(), t); }
+    CFTimeInterval timeOffset() const { CACFLayerGetTimeOffset(layer()); }
+
+    WKCACFLayer* rootLayer() const;
+
+    void setSortsSublayers(bool sorts) { CACFLayerSetSortsSublayers(layer(), sorts); setNeedsCommit(); }
+    bool sortsSublayers() const { return CACFLayerGetSortsSublayers(layer()); }
+
+    void removeAllSublayers();
+    
+    void setSublayers(const Vector<RefPtr<WKCACFLayer> >&);
+
+    void setSublayerTransform(const CATransform3D& transform) { CACFLayerSetSublayerTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D sublayerTransform() const { return CACFLayerGetSublayerTransform(layer()); }
+
+    WKCACFLayer* superlayer() const;
+
+    void setTransform(const CATransform3D& transform) { CACFLayerSetTransform(layer(), transform); setNeedsCommit(); }
+    CATransform3D transform() const { return CACFLayerGetTransform(layer()); }
+
+    void setGeometryFlipped(bool flipped) { CACFLayerSetGeometryFlipped(layer(), flipped); setNeedsCommit(); }
+    bool geometryFlipped() const { return CACFLayerIsGeometryFlipped(layer()); }
+
+    WKCACFLayer(CFStringRef className, GraphicsLayerCACF* owner);
+
+private:
+    void setNeedsCommit();
+    CACFLayerRef layer() const { return m_layer.get(); }
+    size_t numSublayers() const
+    {
+        CFArrayRef sublayers = CACFLayerGetSublayers(layer());
+        return sublayers ? CFArrayGetCount(sublayers) : 0;
+    }
+    
+    // Returns the index of the passed layer in this layer's sublayers list
+    // or -1 if not found
+    int indexOfSublayer(const WKCACFLayer*);
+
+    // This should only be called from removeFromSuperlayer.
+    void removeSublayer(const WKCACFLayer*);
+
+    RetainPtr<CACFLayerRef> m_layer;
+    bool m_needsDisplayOnBoundsChange;
+    GraphicsLayerCACF* m_owner;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayer_h
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
new file mode 100644
index 0000000..9fbd0fc
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
@@ -0,0 +1,449 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "WKCACFLayerRenderer.h"
+
+#include "WKCACFContextFlusher.h"
+#include "WKCACFLayer.h"
+#include <CoreGraphics/CGSRegion.h>
+#include <QuartzCore/CACFContext.h>
+#include <QuartzCore/CARenderOGL.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnArrayPtr.h>
+#include <d3d9.h>
+#include <d3dx9.h>
+#include <dxerr9.h>
+
+#pragma comment(lib, "d3d9")

+#pragma comment(lib, "d3dx9")

+#pragma comment(lib, "QuartzCore")

+
+static IDirect3D9* s_d3d = 0;
+static IDirect3D9* d3d()
+{
+    if (s_d3d)
+        return s_d3d;
+
+    if (!LoadLibrary(TEXT("d3d9.dll")))
+        return 0;
+
+    s_d3d = Direct3DCreate9(D3D_SDK_VERSION);
+
+    return s_d3d;
+}
+
+inline static CGRect winRectToCGRect(RECT rc)
+{
+    return CGRectMake(rc.left, rc.top, (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+inline static CGRect winRectToCGRect(RECT rc, RECT relativeToRect)
+{
+    return CGRectMake(rc.left, (relativeToRect.bottom-rc.bottom), (rc.right - rc.left), (rc.bottom - rc.top));
+}
+
+namespace WebCore {
+
+typedef HashMap<CACFContextRef, WKCACFLayerRenderer*> ContextToWindowMap;
+
+static ContextToWindowMap& windowsForContexts()
+{
+    DEFINE_STATIC_LOCAL(ContextToWindowMap, map, ());
+    return map;
+}
+
+static D3DPRESENT_PARAMETERS initialPresentationParameters()
+{
+    D3DPRESENT_PARAMETERS parameters = {0};
+    parameters.Windowed = TRUE;
+    parameters.SwapEffect = D3DSWAPEFFECT_COPY;
+    parameters.BackBufferCount = 1;
+    parameters.BackBufferFormat = D3DFMT_A8R8G8B8;
+    parameters.MultiSampleType = D3DMULTISAMPLE_NONE;
+
+    return parameters;
+}
+
+bool WKCACFLayerRenderer::acceleratedCompositingAvailable()

+{

+    static bool available;

+    static bool tested;

+

+    if (tested)

+        return available;

+

+    tested = true;

+    HMODULE library = LoadLibrary(TEXT("d3d9.dll"));

+    if (!library)

+        return false;

+

+    FreeLibrary(library);

+    library = LoadLibrary(TEXT("QuartzCore.dll"));

+    if (!library)

+        return false;

+

+    FreeLibrary(library);

+    available = true;

+    return available;

+}

+

+void WKCACFLayerRenderer::didFlushContext(CACFContextRef context)
+{
+    WKCACFLayerRenderer* window = windowsForContexts().get(context);
+    if (!window)
+        return;
+
+    window->renderSoon();
+}
+
+PassOwnPtr<WKCACFLayerRenderer> WKCACFLayerRenderer::create()
+{
+    if (!acceleratedCompositingAvailable())
+        return 0;
+    return new WKCACFLayerRenderer;
+}
+
+WKCACFLayerRenderer::WKCACFLayerRenderer()
+    : m_triedToCreateD3DRenderer(false)
+    , m_renderContext(0)
+    , m_renderer(0)
+    , m_hostWindow(0)
+    , m_renderTimer(this, &WKCACFLayerRenderer::renderTimerFired)
+    , m_scrollFrameWidth(1) // Default to 1 to avoid 0 size frames
+    , m_scrollFrameHeight(1) // Default to 1 to avoid 0 size frames
+{
+}
+
+WKCACFLayerRenderer::~WKCACFLayerRenderer()
+{
+    destroyRenderer();
+}
+
+void WKCACFLayerRenderer::setScrollFrame(int width, int height, int scrollX, int scrollY)
+{
+    m_scrollFrameWidth = width;
+    m_scrollFrameHeight = height;
+
+    CGRect contentsRect = CGRectMake(scrollX, scrollY, width, height);
+    m_scrollLayer->setFrame(contentsRect);
+
+    if (m_rootChildLayer) {
+        contentsRect.origin.x = 0;
+        contentsRect.origin.y = 0;
+        m_rootChildLayer->setFrame(contentsRect);
+    }
+}
+
+void WKCACFLayerRenderer::setRootContents(CGImageRef image)
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setContents(image);
+    renderSoon();
+}
+
+void WKCACFLayerRenderer::setRootChildLayer(WebCore::PlatformLayer* layer)
+{
+    if (!m_scrollLayer)
+        return;
+
+    m_scrollLayer->removeAllSublayers();
+    if (layer) {
+        m_scrollLayer->addSublayer(layer);
+
+        // Set the frame
+        layer->setFrame(CGRectMake(0, 0, m_scrollFrameWidth, m_scrollFrameHeight));
+    }
+
+    m_rootChildLayer = layer;
+
+}
+   
+void WKCACFLayerRenderer::setNeedsDisplay()
+{
+    ASSERT(m_rootLayer);
+    m_rootLayer->setNeedsDisplay();
+    renderSoon();
+}
+
+void WKCACFLayerRenderer::createRenderer()
+{
+    if (m_triedToCreateD3DRenderer)
+        return;
+
+    m_triedToCreateD3DRenderer = true;
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+
+    if (!d3d() || !::IsWindow(m_hostWindow))
+        return;
+
+    // D3D doesn't like to make back buffers for 0 size windows. We skirt this problem if we make the
+    // passed backbuffer width and height non-zero. The window will necessarily get set to a non-zero
+    // size eventually, and then the backbuffer size will get reset.
+    RECT rect;
+    GetClientRect(m_hostWindow, &rect);
+
+    if (rect.left-rect.right == 0 || rect.bottom-rect.top == 0) {
+        parameters.BackBufferWidth = 1;
+        parameters.BackBufferHeight = 1;
+    }
+
+    if (FAILED(d3d()->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, m_hostWindow, D3DCREATE_HARDWARE_VERTEXPROCESSING | D3DCREATE_FPU_PRESERVE, &parameters, &m_d3dDevice)))
+        return;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, rect.left, rect.right, rect.top, rect.bottom, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+
+    m_context.adoptCF(CACFContextCreate(0));
+    windowsForContexts().set(m_context.get(), this);
+
+    m_renderContext = static_cast<CARenderContext*>(CACFContextGetRenderContext(m_context.get()));
+    m_renderer = CARenderOGLNew(&kCARenderDX9Callbacks, m_d3dDevice.get(), 0);
+
+    // Create the root hierarchy
+    m_rootLayer = WKCACFLayer::create(kCACFLayer);
+    m_scrollLayer = WKCACFLayer::create(kCACFLayer);
+
+    m_rootLayer->addSublayer(m_scrollLayer);
+    m_scrollLayer->setMasksToBounds(true);
+
+#ifndef NDEBUG
+    CGColorRef debugColor = createCGColor(Color(255, 0, 0, 204));
+    m_rootLayer->setBackgroundColor(debugColor);
+    CGColorRelease(debugColor);
+#endif
+
+    if (IsWindow(m_hostWindow)) {
+        m_rootLayer->setFrame(bounds());
+
+        // For now this will include the scroll bars. Later in the setScrollFrame
+        // we will fix it
+        m_scrollLayer->setFrame(bounds());
+    }
+
+    if (m_context)
+        m_rootLayer->becomeRootLayerForContext(m_context.get());
+}
+
+void WKCACFLayerRenderer::destroyRenderer()
+{
+    if (m_context) {
+        windowsForContexts().remove(m_context.get());
+        WKCACFContextFlusher::shared().removeContext(m_context.get());
+    }
+
+    if (m_renderer)
+        CARenderOGLDestroy(m_renderer);
+    m_renderer = 0;
+    m_d3dDevice = 0;
+    if (s_d3d)
+        s_d3d->Release();
+
+    s_d3d = 0;
+    m_rootLayer = 0;
+    m_scrollLayer = 0;
+    m_rootChildLayer = 0;
+
+    m_triedToCreateD3DRenderer = false;
+}
+
+void WKCACFLayerRenderer::resize()
+{
+    if (!m_d3dDevice)
+        return;
+
+    resetDevice();
+
+    if (m_rootLayer) {
+        m_rootLayer->setFrame(bounds());
+        WKCACFContextFlusher::shared().flushAllContexts();
+    }
+}
+
+static void getDirtyRects(HWND window, Vector<CGRect>& outRects)
+{
+    ASSERT_ARG(outRects, outRects.isEmpty());
+
+    RECT clientRect;
+    if (!GetClientRect(window, &clientRect))
+        return;
+
+    HRGN region = CreateRectRgn(0, 0, 0, 0);
+    int regionType = GetUpdateRgn(window, region, false);
+    if (regionType != COMPLEXREGION) {
+        RECT dirtyRect;
+        if (GetUpdateRect(window, &dirtyRect, false))
+            outRects.append(winRectToCGRect(dirtyRect, clientRect));
+        return;
+    }
+
+    DWORD dataSize = GetRegionData(region, 0, 0);
+    OwnArrayPtr<unsigned char> regionDataBuffer(new unsigned char[dataSize]);
+    RGNDATA* regionData = reinterpret_cast<RGNDATA*>(regionDataBuffer.get());
+    if (!GetRegionData(region, dataSize, regionData))
+        return;
+
+    outRects.resize(regionData->rdh.nCount);
+
+    RECT* rect = reinterpret_cast<RECT*>(regionData->Buffer);
+    for (size_t i = 0; i < outRects.size(); ++i, ++rect)
+        outRects[i] = winRectToCGRect(*rect, clientRect);
+
+    DeleteObject(region);
+}
+
+void WKCACFLayerRenderer::renderTimerFired(Timer<WKCACFLayerRenderer>*)
+{
+    paint();
+}
+
+void WKCACFLayerRenderer::paint()
+{
+    if (!m_d3dDevice)
+        return;
+
+    Vector<CGRect> dirtyRects;
+    getDirtyRects(m_hostWindow, dirtyRects);
+    render(dirtyRects);
+}
+
+void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
+{
+    ASSERT(m_d3dDevice);
+
+    // Flush the root layer to the render tree.
+    WKCACFContextFlusher::shared().flushAllContexts();
+
+    CGRect bounds = this->bounds();
+
+    CFTimeInterval t = CACurrentMediaTime();
+
+    // Give the renderer some space to use. This needs to be valid until the
+    // CARenderUpdateFinish() call below.
+    char space[4096];
+    CARenderUpdate* u = CARenderUpdateBegin(space, sizeof(space), t, 0, 0, &bounds);
+    if (!u)
+        return;
+
+    CARenderContextLock(m_renderContext);
+    CARenderUpdateAddContext(u, m_renderContext);
+    CARenderContextUnlock(m_renderContext);
+
+    for (size_t i = 0; i < dirtyRects.size(); ++i)
+        CARenderUpdateAddRect(u, &dirtyRects[i]);
+
+    HRESULT err = S_OK;
+    do {
+        CGSRegionObj rgn = CARenderUpdateCopyRegion(u);
+
+        if (!rgn)
+            break;
+
+        // FIXME: don't need to clear dirty region if layer tree is opaque.
+
+        Vector<D3DRECT, 64> rects;
+        CGSRegionEnumeratorObj e = CGSRegionEnumerator(rgn);
+        for (const CGRect* r = CGSNextRect(e); r; r = CGSNextRect(e)) {
+            D3DRECT rect;
+            rect.x1 = r->origin.x;
+            rect.x2 = rect.x1 + r->size.width;
+            rect.y1 = bounds.origin.y + bounds.size.height - (r->origin.y + r->size.height);
+            rect.y2 = rect.y1 + r->size.height;
+
+            rects.append(rect);
+        }
+        CGSReleaseRegionEnumerator(e);
+        CGSReleaseRegion(rgn);
+
+        if (rects.isEmpty())
+            break;
+
+        m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
+
+        m_d3dDevice->BeginScene();
+        CARenderOGLRender(m_renderer, u);
+        m_d3dDevice->EndScene();
+
+        err = m_d3dDevice->Present(0, 0, 0, 0);
+
+        if (err == D3DERR_DEVICELOST) {
+            // Lost device situation.
+            CARenderOGLPurge(m_renderer);
+            resetDevice();
+            CARenderUpdateAddRect(u, &bounds);
+        }
+    } while (err == D3DERR_DEVICELOST);
+
+    CARenderUpdateFinish(u);
+}
+
+void WKCACFLayerRenderer::renderSoon()
+{
+    if (!m_renderTimer.isActive())
+        m_renderTimer.startOneShot(0);
+}
+
+CGRect WKCACFLayerRenderer::bounds() const
+{
+    RECT clientRect;
+    GetClientRect(m_hostWindow, &clientRect);
+
+    return winRectToCGRect(clientRect);
+}
+
+void WKCACFLayerRenderer::initD3DGeometry()
+{
+    ASSERT(m_d3dDevice);
+
+    CGRect bounds = this->bounds();
+
+    float x0 = bounds.origin.x;
+    float y0 = bounds.origin.y;
+    float x1 = x0 + bounds.size.width;
+    float y1 = y0 + bounds.size.height;
+
+    D3DXMATRIXA16 projection;
+    D3DXMatrixOrthoOffCenterRH(&projection, x0, x1, y0, y1, -1.0f, 1.0f);
+
+    m_d3dDevice->SetTransform(D3DTS_PROJECTION, &projection);
+}
+
+void WKCACFLayerRenderer::resetDevice()
+{
+    ASSERT(m_d3dDevice);
+
+    D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
+    m_d3dDevice->Reset(&parameters);
+    initD3DGeometry();
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.h b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
new file mode 100644
index 0000000..12cde48
--- /dev/null
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WKCACFLayerRenderer_h
+#define WKCACFLayerRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "COMPtr.h"
+#include "Timer.h"
+#include "WKCACFLayer.h"
+
+#include <wtf/Noncopyable.h>
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+
+#include <CoreGraphics/CGGeometry.h>
+
+interface IDirect3DDevice9;
+typedef struct _CACFContext* CACFContextRef;
+typedef struct _CARenderContext CARenderContext;
+typedef struct _CARenderOGLContext CARenderOGLContext;
+
+namespace WebCore {
+
+// FIXME: Currently there is a WKCACFLayerRenderer for each WebView and each
+// has its own CARenderOGLContext and Direct3DDevice9, which is inefficient.
+// (https://bugs.webkit.org/show_bug.cgi?id=31855)
+class WKCACFLayerRenderer : public Noncopyable {
+public:
+    static PassOwnPtr<WKCACFLayerRenderer> create();
+    ~WKCACFLayerRenderer();
+
+    static bool acceleratedCompositingAvailable();
+    static void didFlushContext(CACFContextRef);
+
+    void setScrollFrame(int width, int height, int scrollX, int scrollY);
+    void setRootContents(CGImageRef);
+    void setRootChildLayer(WebCore::PlatformLayer* layer);
+    void setNeedsDisplay();
+    void setHostWindow(HWND window) { m_hostWindow = window; createRenderer(); }
+
+    void createRenderer();
+    void destroyRenderer();
+    void resize();
+    void renderSoon();
+
+protected:
+    WKCACFLayer* rootLayer() const { return m_rootLayer.get(); }
+
+private:
+    WKCACFLayerRenderer();
+
+    void renderTimerFired(Timer<WKCACFLayerRenderer>*);
+
+    CGRect bounds() const;
+
+    void initD3DGeometry();
+    void resetDevice();
+
+    void render(const Vector<CGRect>& dirtyRects = Vector<CGRect>());
+    void paint();
+
+    bool m_triedToCreateD3DRenderer;
+    COMPtr<IDirect3DDevice9> m_d3dDevice;
+    RefPtr<WKCACFLayer> m_rootLayer;
+    RefPtr<WKCACFLayer> m_viewLayer;
+    RefPtr<WKCACFLayer> m_scrollLayer;
+    RefPtr<WKCACFLayer> m_rootChildLayer;
+    RetainPtr<CACFContextRef> m_context;
+    CARenderContext* m_renderContext;
+    CARenderOGLContext* m_renderer;
+    HWND m_hostWindow;
+    Timer<WKCACFLayerRenderer> m_renderTimer;
+    int m_scrollFrameWidth, m_scrollFrameHeight;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // WKCACFLayerRenderer_h
diff --git a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
index f308840..f22e6c9 100644
--- a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
+++ b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
@@ -947,7 +947,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !m_data->m_opacity)
         return;
@@ -1051,12 +1051,12 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int wi
     notImplemented();
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& col)
+void GraphicsContext::setPlatformFillColor(const Color& col, ColorSpace colorSpace)
 {
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& col)
+void GraphicsContext::setPlatformStrokeColor(const Color& col, ColorSpace colorSpace)
 {
     notImplemented();
 }
@@ -1088,7 +1088,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
         return;
     } 
 
-    fillRect(rect, Color(Color::white));
+    fillRect(rect, Color(Color::white), DeviceColorSpace);
 }
 
 void GraphicsContext::strokeRect(const FloatRect& rect, float width)
@@ -1238,7 +1238,7 @@ static inline IntPoint rectCenterPoint(const RECT& rect)
 {
     return IntPoint(rect.left + (rect.right - rect.left) / 2, rect.top + (rect.bottom - rect.top) / 2);
 }
-void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& c)
+void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& c, ColorSpace colorSpace)
 {
     ScopeDCProvider dcProvider(m_data);
     if (!m_data->m_dc)
@@ -1355,7 +1355,7 @@ Color gradientAverageColor(const Gradient* gradient)
 
 void GraphicsContext::fillPath()
 {
-    Color c = m_common->state.fillColorSpace == GradientColorSpace && m_common->state.fillGradient
+    Color c = m_common->state.fillGradient
         ? gradientAverageColor(m_common->state.fillGradient.get())
         : fillColor();
 
@@ -1449,7 +1449,7 @@ void GraphicsContext::fillRect(const FloatRect& r, const Gradient* gradient)
     if (numStops == 1) {
         const Gradient::ColorStop& stop = stops.first();
         Color color(stop.red, stop.green, stop.blue, stop.alpha);
-        fillRect(r, color);
+        fillRect(r, color, DeviceColorSpace);
         return;
     } 
     
@@ -1539,13 +1539,13 @@ void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
 
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
-    if (m_common->state.fillColorSpace == GradientColorSpace && m_common->state.fillGradient)
+    if (m_common->state.fillGradient)
         fillRect(rect, m_common->state.fillGradient.get());
     else
-        fillRect(rect, fillColor());
+        fillRect(rect, fillColor(), DeviceColorSpace);
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize&, int, const Color&)
+void GraphicsContext::setPlatformShadow(const IntSize&, int, const Color&, ColorSpace)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index de92fcd..fd3322f 100644
--- a/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -111,7 +111,7 @@ unsigned FontPlatformData::computeHash() const {
         // a font whose properties are equal should generate the same hash
         uintptr_t hashCodes[6] = { thisFont->GetPointSize(), thisFont->GetFamily(), thisFont->GetStyle(), 
                                     thisFont->GetWeight(), thisFont->GetUnderlined(), 
-                                    StringImpl::computeHash(thisFont->GetFaceName().mb_str(wxConvUTF8)) };
+                                    StringImpl::computeHash(thisFont->GetFaceName().utf8_str()) };
         
         return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));
 }
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 39f14f4..9c05ce5 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -119,8 +119,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor());
-        setPlatformStrokeColor(strokeColor());
+        setPlatformFillColor(fillColor(), DeviceColorSpace);
+        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
     }
 #if USE(WXGC)
     m_data->context = (wxGCDC*)context;
@@ -252,7 +252,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     delete [] polygon;
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -262,7 +262,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
     m_data->context->DrawRectangle(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
-void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -438,7 +438,7 @@ void GraphicsContext::addPath(const Path& path)
     notImplemented();
 }
 
-void GraphicsContext::setPlatformStrokeColor(const Color& color)
+void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -457,7 +457,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 
 }
 
-void GraphicsContext::setPlatformFillColor(const Color& color)
+void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
@@ -511,7 +511,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
-void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&) 
+void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&, ColorSpace) 
 { 
     notImplemented(); 
 }
@@ -566,4 +566,72 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     notImplemented();
 }
 
+#if PLATFORM(WIN_OS)
+HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (dstRect.isEmpty())
+        return 0;
+
+    // Create a bitmap DC in which to draw.
+    BITMAPINFO bitmapInfo;
+    bitmapInfo.bmiHeader.biSize          = sizeof(BITMAPINFOHEADER);
+    bitmapInfo.bmiHeader.biWidth         = dstRect.width();
+    bitmapInfo.bmiHeader.biHeight        = dstRect.height();
+    bitmapInfo.bmiHeader.biPlanes        = 1;
+    bitmapInfo.bmiHeader.biBitCount      = 32;
+    bitmapInfo.bmiHeader.biCompression   = BI_RGB;
+    bitmapInfo.bmiHeader.biSizeImage     = 0;
+    bitmapInfo.bmiHeader.biXPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biYPelsPerMeter = 0;
+    bitmapInfo.bmiHeader.biClrUsed       = 0;
+    bitmapInfo.bmiHeader.biClrImportant  = 0;
+
+    void* pixels = 0;
+    HBITMAP bitmap = ::CreateDIBSection(0, &bitmapInfo, DIB_RGB_COLORS, &pixels, 0, 0);
+    if (!bitmap)
+        return 0;
+
+    HDC displayDC = ::GetDC(0);
+    HDC bitmapDC = ::CreateCompatibleDC(displayDC);
+    ::ReleaseDC(0, displayDC);
+
+    ::SelectObject(bitmapDC, bitmap);
+
+    // Fill our buffer with clear if we're going to alpha blend.
+    if (supportAlphaBlend) {
+        BITMAP bmpInfo;
+        GetObject(bitmap, sizeof(bmpInfo), &bmpInfo);
+        int bufferSize = bmpInfo.bmWidthBytes * bmpInfo.bmHeight;
+        memset(bmpInfo.bmBits, 0, bufferSize);
+    }
+    return bitmapDC;
+}
+
+void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
+{
+    if (hdc) {
+
+        if (!dstRect.isEmpty()) {
+
+            HBITMAP bitmap = static_cast<HBITMAP>(GetCurrentObject(hdc, OBJ_BITMAP));
+            BITMAP info;
+            GetObject(bitmap, sizeof(info), &info);
+            ASSERT(info.bmBitsPixel == 32);
+
+            wxBitmap bmp;
+            bmp.SetHBITMAP(bitmap);
+#if !wxCHECK_VERSION(2,9,0)
+            if (supportAlphaBlend)
+                bmp.UseAlpha();
+#endif
+            m_data->context->DrawBitmap(bmp, dstRect.x(), dstRect.y(), supportAlphaBlend);
+
+            ::DeleteObject(bitmap);
+        }
+
+        ::DeleteDC(hdc);
+    }
+}
+#endif
+
 }
diff --git a/WebCore/platform/graphics/wx/IconWx.cpp b/WebCore/platform/graphics/wx/IconWx.cpp
index e82091e..d3cc961 100644
--- a/WebCore/platform/graphics/wx/IconWx.cpp
+++ b/WebCore/platform/graphics/wx/IconWx.cpp
@@ -32,12 +32,6 @@ Icon::~Icon()
 {
 }
 
-PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
-{
-    notImplemented();
-    return 0;
-}
-
 PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/wx/ImageWx.cpp b/WebCore/platform/graphics/wx/ImageWx.cpp
index bd129cf..ff60d6f 100644
--- a/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -86,13 +86,13 @@ void BitmapImage::initPlatformData()
 
 // Drawing Routines
 
-void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
     if (!m_source.initialized())
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -176,7 +176,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatR
         observer->didDraw(this);
 }
 
-void BitmapImage::drawPattern(GraphicsContext* ctxt, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& dstRect)
+void BitmapImage::drawPattern(GraphicsContext* ctxt, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, ColorSpace, CompositeOperator, const FloatRect& dstRect)
 {
     if (!m_source.initialized())
         return;
@@ -261,7 +261,7 @@ void BitmapImage::invalidatePlatformData()
 
 }
 
-void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& destRect)
+void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, ColorSpace, CompositeOperator, const FloatRect& destRect)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.cpp b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
index cf35346..edb8d10 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.cpp
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
@@ -86,7 +86,7 @@ bool GeolocationServiceGtk::startUpdating(PositionOptions* options)
     g_object_unref(master);
 
     if (!client) {
-        setError(PositionError::UNKNOWN_ERROR, "Could not connect to location provider.");
+        setError(PositionError::POSITION_UNAVAILABLE, "Could not connect to location provider.");
         return false;
     }
 
@@ -101,14 +101,14 @@ bool GeolocationServiceGtk::startUpdating(PositionOptions* options)
                                                              true, GEOCLUE_RESOURCE_ALL, &error.outPtr());
 
     if (!result) {
-        setError(PositionError::UNKNOWN_ERROR, error->message);
+        setError(PositionError::POSITION_UNAVAILABLE, error->message);
         g_object_unref(client);
         return false;
     }
 
     m_geocluePosition = geoclue_master_client_create_position(client, &error.outPtr());
     if (!m_geocluePosition) {
-        setError(PositionError::UNKNOWN_ERROR, error->message);
+        setError(PositionError::POSITION_UNAVAILABLE, error->message);
         g_object_unref(client);
         return false;
     }
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index 3931eff..11ea956 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -507,6 +507,8 @@ static String singleCharacterString(guint val)
             return String("\r");
         case GDK_BackSpace:
             return String("\x8");
+        case GDK_Tab:
+            return String("\t");
         default:
             gunichar c = gdk_keyval_to_unicode(val);
             glong nwc;
diff --git a/WebCore/platform/gtk/Language.cpp b/WebCore/platform/gtk/Language.cpp
index fea2df6..577d7d8 100644
--- a/WebCore/platform/gtk/Language.cpp
+++ b/WebCore/platform/gtk/Language.cpp
@@ -43,12 +43,12 @@ String defaultLanguage()
     GOwnPtr<gchar> normalizedDefault(g_ascii_strdown(localeDefault, -1));
     char* ptr = strchr(normalizedDefault.get(), '_');
 
-    if(ptr)
+    if (ptr)
         *ptr = '-';
 
     ptr = strchr(normalizedDefault.get(), '.');
 
-    if(ptr)
+    if (ptr)
         *ptr = '\0';
 
     return String(normalizedDefault.get());
diff --git a/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 85e071b..5809e47 100644
--- a/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -392,6 +392,10 @@ String localizedMediaControlElementString(const String& name)
         return String::fromUTF8(_("fast forward"));
     if (name == "SeekBackButton")
         return String::fromUTF8(_("fast reverse"));
+    if (name == "ShowClosedCaptionsButton")
+        return String::fromUTF8(_("show closed captions"));
+    if (name == "HideClosedCaptionsButton")
+        return String::fromUTF8(_("hide closed captions"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -431,6 +435,10 @@ String localizedMediaControlElementHelpText(const String& name)
         return String::fromUTF8(_("seek quickly forward"));
     if (name == "FullscreenButton")
         return String::fromUTF8(_("Play movie in fullscreen mode"));
+    if (name == "ShowClosedCaptionsButton")
+        return String::fromUTF8(_("start displaying closed captions"));
+    if (name == "HideClosedCaptionsButton")
+        return String::fromUTF8(_("stop displaying closed captions"));
 
     ASSERT_NOT_REACHED();
     return String();
@@ -467,4 +475,40 @@ String localizedMediaTimeDescription(float time)
 }
 #endif  // ENABLE(VIDEO)
 
+String validationMessageValueMissingText()
+{
+    return String::fromUTF8(_("value missing"));
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String::fromUTF8(_("type mismatch"));
+}
+
+String validationMessagePatternMismatchText()
+{
+    return String::fromUTF8(_("pattern mismatch"));
+}
+
+String validationMessageTooLongText()
+{
+    return String::fromUTF8(_("too long"));
+}
+
+String validationMessageRangeUnderflowText()
+{
+    return String::fromUTF8(_("range underflow"));
+}
+
+String validationMessageRangeOverflowText()
+{
+    return String::fromUTF8(_("range overflow"));
+}
+
+String validationMessageStepMismatchText()
+{
+    return String::fromUTF8(_("step mismatch"));
+}
+
 }
diff --git a/WebCore/platform/gtk/PasteboardGtk.cpp b/WebCore/platform/gtk/PasteboardGtk.cpp
index 0ff26f7..ee95a38 100644
--- a/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -102,7 +102,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     PasteboardSelectionData* data = new PasteboardSelectionData(text, markup);
 
     gint n_targets;
-    GtkTargetEntry* targets = gtk_target_table_new_from_list(m_helper->getCopyTargetList(frame), &n_targets);
+    GtkTargetEntry* targets = gtk_target_table_new_from_list(m_helper->targetList(), &n_targets);
     gtk_clipboard_set_with_data(clipboard, targets, n_targets,
                                 clipboard_get_contents_cb, clipboard_clear_contents_cb, data);
     gtk_target_table_free(targets, n_targets);
diff --git a/WebCore/platform/gtk/PasteboardHelper.h b/WebCore/platform/gtk/PasteboardHelper.h
index 8e67127..e589f24 100644
--- a/WebCore/platform/gtk/PasteboardHelper.h
+++ b/WebCore/platform/gtk/PasteboardHelper.h
@@ -41,8 +41,7 @@ public:
     virtual GtkClipboard* getCurrentTarget(Frame*) const = 0;
     virtual GtkClipboard* getClipboard(Frame*) const = 0;
     virtual GtkClipboard* getPrimary(Frame*) const = 0;
-    virtual GtkTargetList* getCopyTargetList(Frame*) const = 0;
-    virtual GtkTargetList* getPasteTargetList(Frame*) const = 0;
+    virtual GtkTargetList* targetList() const = 0;
     virtual gint getWebViewTargetInfoHtml() const = 0;
 };
 
diff --git a/WebCore/platform/gtk/RenderThemeGtk.cpp b/WebCore/platform/gtk/RenderThemeGtk.cpp
index fdef9c2..4842d68 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -188,7 +188,6 @@ static bool paintMozWidget(RenderTheme* theme, GtkThemeWidgetType type, RenderOb
     GdkRectangle gdkRect = IntRect(pos.x(), pos.y(), rect.width(), rect.height());
     GtkTextDirection direction = gtkTextDirection(o->style()->direction());
 
-#if CAIRO_VERSION >= CAIRO_VERSION_ENCODE(1,4,0)
     // Find the clip rectangle
     cairo_t *cr = i.context->platformContext();
     double clipX1, clipX2, clipY1, clipY2;
@@ -202,9 +201,6 @@ static bool paintMozWidget(RenderTheme* theme, GtkThemeWidgetType type, RenderOb
     gdkClipRect.y = clipPos.y();
 
     gdk_rectangle_intersect(&gdkRect, &gdkClipRect, &gdkClipRect);
-#else
-    GdkRectangle gdkClipRect = gdkRect;
-#endif
 
     return moz_gtk_widget_paint(type, i.context->gdkDrawable(), &gdkRect, &gdkClipRect, &mozState, flags, direction) != MOZ_GTK_SUCCESS;
 }
diff --git a/WebCore/platform/haiku/FileChooserHaiku.cpp b/WebCore/platform/haiku/FileChooserHaiku.cpp
index b0e42b6..f56e02b 100644
--- a/WebCore/platform/haiku/FileChooserHaiku.cpp
+++ b/WebCore/platform/haiku/FileChooserHaiku.cpp
@@ -28,14 +28,6 @@
 
 namespace WebCore {
 
-FileChooser::FileChooser(FileChooserClient* client, const String& filename)
-    : m_client(client)
-    , m_filenames()
-    , m_icon(chooseIcon(filename))
-{
-    m_filenames.append(filename);
-}
-
 String FileChooser::basenameForWidth(const Font&, int width) const
 {
     notImplemented();
diff --git a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
index a37ffcc..9bb4c3e 100644
--- a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
+++ b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -342,5 +342,47 @@ String AXDefinitionListDefinitionText()
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ImageDecoder.h b/WebCore/platform/image-decoders/ImageDecoder.h
index 8c9b7f1..08f4aa2 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/ImageDecoder.h
@@ -197,7 +197,7 @@ namespace WebCore {
     // The ImageDecoder class represents a base class for specific image format decoders
     // (e.g., GIF, JPG, PNG, ICO) to derive from.  All decoders decode into RGBA32 format
     // and the base class manages the RGBA32 frame cache.
-    class ImageDecoder {
+    class ImageDecoder : public Noncopyable {
     public:
         // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
         // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
diff --git a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
index da6ab38..5e9b527 100644
--- a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
+++ b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -34,9 +34,9 @@
 namespace WebCore {
 
 RGBA32Buffer::RGBA32Buffer()
-    : m_status(FrameEmpty)
-    , m_hasAlpha(false)
+    : m_hasAlpha(false) 
     , m_size()
+    , m_status(FrameEmpty)
     , m_duration(0)
     , m_disposalMethod(DisposeNotSpecified)
 {
diff --git a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
index 3cadf1c..e6e45b7 100644
--- a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
@@ -40,35 +40,41 @@ namespace WebCore {
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
     wxBitmap* bmp = new wxBitmap(width(), height(), 32);
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-    WxPixelData data(*bmp);
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    int rowCounter = 0;
-    long pixelCounter = 0;
-    WxPixelData::Iterator p(data);
-    WxPixelData::Iterator rowStart = p; 
-    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
-        p.Red() = bytes[i+2];
-        p.Green() = bytes[i+1];
-        p.Blue() = bytes[i+0];
-        p.Alpha() = bytes[i+3];
+
+    {
+        typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
+        WxPixelData data(*bmp);
         
-        p++;
+        // NB: It appears that the data is in BGRA format instead of RGBA format.
+        // This code works properly on both ppc and intel, meaning the issue is
+        // likely not an issue of byte order getting mixed up on different archs. 
+        const unsigned char* bytes = (const unsigned char*)m_bytes.data();
+        int rowCounter = 0;
+        long pixelCounter = 0;
+        WxPixelData::Iterator p(data);
+        WxPixelData::Iterator rowStart = p; 
+        for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
+                p.Red() = bytes[i + 2];
+                p.Green() = bytes[i + 1];
+                p.Blue() = bytes[i + 0];
+                p.Alpha() = bytes[i + 3];
+            
+            p++;
 
-        pixelCounter++;
-        if ((pixelCounter % width()) == 0) {
-            rowCounter++;
-            p = rowStart;
-            p.MoveTo(data, 0, rowCounter);
+            pixelCounter++;
+            if ((pixelCounter % width()) == 0) {
+                rowCounter++;
+                p = rowStart;
+                p.MoveTo(data, 0, rowCounter);
+            }
         }
-    }
 #if !wxCHECK_VERSION(2,9,0)
-    bmp->UseAlpha();
+        bmp->UseAlpha();
 #endif
+    } // ensure that WxPixelData is destroyed as it unlocks the bitmap data in
+      // its dtor and we can't access it (notably in CreateBitmap() below)
+      // before this is done
+
     ASSERT(bmp->IsOk());
 
 #if USE(WXGC)
diff --git a/WebCore/platform/mac/LocalizedStringsMac.mm b/WebCore/platform/mac/LocalizedStringsMac.mm
index 261347f..c438d6b 100644
--- a/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -747,5 +747,60 @@ String localizedMediaTimeDescription(float time)
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageValueMissingText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTypeMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessagePatternMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageTooLongText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeUnderflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageRangeOverflowText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] validationMessageStepMismatchText];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
 
 }
diff --git a/WebCore/platform/mac/ScrollViewMac.mm b/WebCore/platform/mac/ScrollViewMac.mm
index 202d49e..f31b301 100644
--- a/WebCore/platform/mac/ScrollViewMac.mm
+++ b/WebCore/platform/mac/ScrollViewMac.mm
@@ -57,6 +57,8 @@ NSView *ScrollView::documentView() const
     return nil;
 }
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 void ScrollView::platformAddChild(Widget* child)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -203,4 +205,6 @@ bool ScrollView::platformIsOffscreen() const
     return ![platformWidget() window] || ![[platformWidget() window] isVisible];
 }
 
-}
+#endif // !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+} // namespace WebCore
diff --git a/WebCore/platform/mac/ScrollbarThemeMac.mm b/WebCore/platform/mac/ScrollbarThemeMac.mm
index 0a20e2f..b4b8f62 100644
--- a/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -396,7 +396,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
-        context->drawImage(imageBuffer->image(), scrollbar->frameRect().location());
+        context->drawImage(imageBuffer->image(), DeviceColorSpace, scrollbar->frameRect().location());
     }
 
     return true;
diff --git a/WebCore/platform/mac/ThemeMac.mm b/WebCore/platform/mac/ThemeMac.mm
index fd2f944..a95fee4 100644
--- a/WebCore/platform/mac/ThemeMac.mm
+++ b/WebCore/platform/mac/ThemeMac.mm
@@ -173,9 +173,9 @@ static LengthSize checkboxSize(const Font& font, const LengthSize& zoomedSize, f
     return sizeFromFont(font, zoomedSize, zoomFactor, checkboxSizes());
 }
 
-static NSButtonCell* checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* checkboxCell;
+    static NSButtonCell *checkboxCell;
     if (!checkboxCell) {
         checkboxCell = [[NSButtonCell alloc] init];
         [checkboxCell setButtonType:NSSwitchButton];
@@ -199,7 +199,7 @@ static void paintCheckbox(ControlStates states, GraphicsContext* context, const
     BEGIN_BLOCK_OBJC_EXCEPTIONS
 
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+    NSButtonCell *checkboxCell = checkbox(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -254,9 +254,9 @@ static LengthSize radioSize(const Font& font, const LengthSize& zoomedSize, floa
     return sizeFromFont(font, zoomedSize, zoomFactor, radioSizes());
 }
 
-static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static NSButtonCell *radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell* radioCell;
+    static NSButtonCell *radioCell;
     if (!radioCell) {
         radioCell = [[NSButtonCell alloc] init];
         [radioCell setButtonType:NSRadioButton];
@@ -276,7 +276,7 @@ static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, floa
 static void paintRadio(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
 {
     // Determine the width and height needed for the control and prepare the cell for painting.
-    NSButtonCell* radioCell = radio(states, zoomedRect, zoomFactor);
+    NSButtonCell *radioCell = radio(states, zoomedRect, zoomFactor);
 
     context->save();
 
@@ -330,14 +330,14 @@ static const int* buttonMargins(NSControlSize controlSize)
     return margins[controlSize];
 }
 
-static NSButtonCell* button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+static void setupButtonCell(NSButtonCell *&buttonCell, ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
 {
-    static NSButtonCell *buttonCell;
-    static bool defaultButton;
     if (!buttonCell) {
         buttonCell = [[NSButtonCell alloc] init];
         [buttonCell setTitle:nil];
         [buttonCell setButtonType:NSMomentaryPushInButton];
+        if (states & DefaultState)
+            [buttonCell setKeyEquivalent:@"\r"];
     }
 
     // Set the control size based off the rectangle we're painting into.
@@ -357,15 +357,16 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
 
     setControlSize(buttonCell, buttonSizes(), zoomedRect.size(), zoomFactor);
 
-    if (defaultButton != (states & DefaultState)) {
-        defaultButton = !defaultButton;
-        [buttonCell setKeyEquivalent:(defaultButton ? @"\r" : @"")];
-    }
-
     // Update the various states we respond to.
     updateStates(buttonCell, states);
+}
     
-    return buttonCell;
+static NSButtonCell *button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    bool isDefault = states & DefaultState;
+    static NSButtonCell *cells[2];
+    setupButtonCell(cells[isDefault], part, states, zoomedRect, zoomFactor);    
+    return cells[isDefault];
 }
 
 static void paintButton(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
@@ -408,7 +409,7 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     NSWindow *window = [view window];
     NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
 
-    if ((states & DefaultState) && [window isKeyWindow]) {
+    if (states & DefaultState) {
         [window setDefaultButtonCell:buttonCell];
         wkAdvanceDefaultButtonPulseAnimation(buttonCell);
     } else if ([previousDefaultButtonCell isEqual:buttonCell])
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.h b/WebCore/platform/mac/WebCoreSystemInterface.h
index 768899e..917ab0b 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -117,6 +117,7 @@ extern BOOL (*wkGetNSURLResponseMustRevalidate)(NSURLResponse *response);
 extern void (*wkGetWheelEventDeltas)(NSEvent*, float* deltaX, float* deltaY, BOOL* continuous);
 extern BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 extern void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+extern BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 extern void (*wkPopupMenu)(NSMenu*, NSPoint location, float width, NSView*, int selectedItem, NSFont*);
 extern unsigned (*wkQTIncludeOnlyModernMediaFileTypes)(void);
 extern int (*wkQTMovieDataRate)(QTMovie*);
@@ -124,6 +125,8 @@ extern float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 extern NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 extern float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 extern int (*wkQTMovieGetType)(QTMovie* movie);
+extern BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+extern void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 extern void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 extern void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 extern void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -136,6 +139,9 @@ extern void (*wkSignalCFReadStreamEnd)(CFReadStreamRef stream);
 extern void (*wkSignalCFReadStreamError)(CFReadStreamRef stream, CFStreamError *error);
 extern void (*wkSignalCFReadStreamHasBytes)(CFReadStreamRef stream);
 extern unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+extern void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+extern void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+extern CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 extern BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.mm b/WebCore/platform/mac/WebCoreSystemInterface.mm
index d0e276f..3a9c011 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -44,6 +44,7 @@ void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect
 BOOL (*wkHitTestMediaUIPart)(int part, int themeStyle, CGRect bounds, CGPoint point);
 void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
 void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
+BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -58,6 +59,8 @@ float (*wkQTMovieMaxTimeLoaded)(QTMovie*);
 NSString *(*wkQTMovieMaxTimeLoadedChangeNotification)(void);
 float (*wkQTMovieMaxTimeSeekable)(QTMovie*);
 int (*wkQTMovieGetType)(QTMovie* movie);
+BOOL (*wkQTMovieHasClosedCaptions)(QTMovie* movie);
+void (*wkQTMovieSetShowClosedCaptions)(QTMovie* movie, BOOL showClosedCaptions);
 void (*wkQTMovieViewSetDrawSynchronously)(QTMovieView*, BOOL);
 void (*wkSetCGFontRenderingMode)(CGContextRef, NSFont*);
 void (*wkSetDragImage)(NSImage*, NSPoint offset);
@@ -80,6 +83,9 @@ void (*wkSetNSURLConnectionDefersCallbacks)(NSURLConnection *, BOOL);
 void (*wkSetNSURLRequestShouldContentSniff)(NSMutableURLRequest *, BOOL);
 id (*wkCreateNSURLConnectionDelegateProxy)(void);
 unsigned (*wkInitializeMaximumHTTPConnectionCountPerHost)(unsigned preferredConnectionCount);
+void (*wkSetCONNECTProxyForStream)(CFReadStreamRef, CFStringRef proxyHost, CFNumberRef proxyPort);
+void (*wkSetCONNECTProxyAuthorizationForStream)(CFReadStreamRef, CFStringRef proxyAuthorizationString);
+CFHTTPMessageRef (*wkCopyCONNECTProxyResponse)(CFReadStreamRef, CFURLRef responseURL);
 BOOL (*wkIsLatchingWheelEvent)(NSEvent *);
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/mac/WidgetMac.mm b/WebCore/platform/mac/WidgetMac.mm
index 8653a03..ebb47dc 100644
--- a/WebCore/platform/mac/WidgetMac.mm
+++ b/WebCore/platform/mac/WidgetMac.mm
@@ -44,6 +44,8 @@
 #import "WebCoreView.h"
 #import <wtf/RetainPtr.h>
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 @interface NSWindow (WebWindowDetails)
 - (BOOL)_needsToResetDragMargins;
 - (void)_setNeedsToResetDragMargins:(BOOL)needs;
@@ -54,8 +56,12 @@
 - (void)webPlugInSetIsSelected:(BOOL)isSelected;
 @end
 
+#endif
+
 namespace WebCore {
 
+#if !ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
 class WidgetPrivate {
 public:
     bool mustStayInWindow;
@@ -78,7 +84,7 @@ static void safeRemoveFromSuperview(NSView *view)
     [window _setNeedsToResetDragMargins:resetDragMargins];
 }
 
-Widget::Widget(NSView* view)
+Widget::Widget(NSView *view)
     : m_data(new WidgetPrivate)
 {
     init(view);
@@ -341,5 +347,54 @@ void Widget::retainPlatformWidget()
     HardRetain(m_widget);
 }
 
+#else // ENABLE(EXPERIMENTAL_SINGLE_VIEW_MODE)
+
+Widget::Widget(PlatformWidget widget)
+{
+    init(widget);
+}
+
+Widget::~Widget() 
+{
+    ASSERT(!parent());
+}
+
+void Widget::show()
+{
+}
+
+void Widget::hide()
+{
 }
 
+void Widget::setCursor(const Cursor&)
+{
+    notImplemented();
+}
+
+void Widget::paint(GraphicsContext*, const IntRect&)
+{
+}
+
+void Widget::setFocus()
+{
+}
+
+void Widget::setIsSelected(bool)
+{
+}
+
+IntRect Widget::frameRect() const
+{
+    return m_frame;
+}
+
+void Widget::setFrameRect(const IntRect& rect)
+{
+    m_frame = rect;
+}
+
+#endif
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/network/AuthenticationClient.h b/WebCore/platform/network/AuthenticationClient.h
new file mode 100644
index 0000000..1e17910
--- /dev/null
+++ b/WebCore/platform/network/AuthenticationClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AuthenticationClient_h
+#define AuthenticationClient_h
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class Credential;
+
+class AuthenticationClient {
+public:
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&) = 0;
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&) = 0;
+    virtual void receivedCancellation(const AuthenticationChallenge&) = 0;
+
+    void ref() { refAuthenticationClient(); }
+    void deref() { derefAuthenticationClient(); }
+
+protected:
+    virtual ~AuthenticationClient() { }
+
+private:
+    virtual void refAuthenticationClient() = 0;
+    virtual void derefAuthenticationClient() = 0;
+};
+
+}
+
+#endif
diff --git a/WebCore/platform/network/Credential.cpp b/WebCore/platform/network/Credential.cpp
index f905743..87cd7ff 100644
--- a/WebCore/platform/network/Credential.cpp
+++ b/WebCore/platform/network/Credential.cpp
@@ -33,6 +33,9 @@ Credential::Credential()
     : m_user("")
     , m_password("")
     , m_persistence(CredentialPersistenceNone)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif    
 {
 }
    
@@ -42,11 +45,31 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     : m_user(user.length() ? user : "")
     , m_password(password.length() ? password : "")
     , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_type(CredentialTypePassword)
+#endif
+{
+}
+    
+Credential::Credential(const Credential& original, CredentialPersistence persistence)
+    : m_user(original.user())
+    , m_password(original.password())
+    , m_persistence(persistence)
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    , m_identity(original.identity())
+    , m_certificates(original.certificates())
+    , m_type(original.type())
+#endif
 {
 }
 
 bool Credential::isEmpty() const
 {
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    if (m_type == CredentialTypeClientCertificate && (m_identity || m_certificates))
+        return false;
+#endif
+    
     return m_user.isEmpty() && m_password.isEmpty();
 }
     
@@ -69,15 +92,68 @@ CredentialPersistence Credential::persistence() const
 { 
     return m_persistence; 
 }
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+Credential::Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence persistence)
+    : m_user("")
+    , m_password("")
+    , m_persistence(persistence)
+    , m_identity(identity)
+    , m_certificates(certificates)
+    , m_type(CredentialTypeClientCertificate)
+{
+}
+    
+SecIdentityRef Credential::identity() const
+{
+    return m_identity.get();
+}
+    
+CFArrayRef Credential::certificates() const
+{
+    return m_certificates.get();
+}
+    
+const CredentialType Credential::type() const
+{
+    return m_type;
+}
+#endif
 
 bool operator==(const Credential& a, const Credential& b)
 {
+    // Check persistence first since all credential types
+    // have the persistence property.
+    if (a.persistence() != b.persistence())
+        return false;
+    
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    CredentialType aType = a.type();
+    if (aType != b.type())
+        return false;
+    
+    // Comparing identity and certificate chain pointers is valid only
+    // for client certificate type credentials.
+    //
+    // FIXME: Is pointer comparison of the identity and certificates properties sufficient?
+    if (aType == CredentialTypeClientCertificate) {
+        if (a.identity() != b.identity())
+            return false;
+        if (a.certificates() != b.certificates())
+            return false;
+        
+        // We only need to check identity and certificates to compare
+        // client certificate based credentials.
+        return true;
+    }
+    
+    ASSERT(a.type() == CredentialTypePassword && b.type() == CredentialTypePassword);
+#endif    
+    
     if (a.user() != b.user())
         return false;
     if (a.password() != b.password())
         return false;
-    if (a.persistence() != b.persistence())
-        return false;
         
     return true;
 }
diff --git a/WebCore/platform/network/Credential.h b/WebCore/platform/network/Credential.h
index 0471fbc..199817c 100644
--- a/WebCore/platform/network/Credential.h
+++ b/WebCore/platform/network/Credential.h
@@ -27,6 +27,13 @@
 
 #include "PlatformString.h"
 
+#define CERTIFICATE_CREDENTIALS_SUPPORTED ((PLATFORM(MAC) || PLATFORM(IPHONE)) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+#include <Security/SecBase.h>
+#include <wtf/RetainPtr.h>
+#endif
+
 namespace WebCore {
 
 enum CredentialPersistence {
@@ -34,12 +41,23 @@ enum CredentialPersistence {
     CredentialPersistenceForSession,
     CredentialPersistencePermanent
 };
-    
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+enum CredentialType {
+    CredentialTypePassword,
+    CredentialTypeClientCertificate
+};
+#endif
+
 class Credential {
 
 public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
+    Credential(const Credential& original, CredentialPersistence);
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    Credential(SecIdentityRef identity, CFArrayRef certificates, CredentialPersistence);
+#endif
     
     bool isEmpty() const;
     
@@ -48,10 +66,21 @@ public:
     bool hasPassword() const;
     CredentialPersistence persistence() const;
     
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    SecIdentityRef identity() const;
+    CFArrayRef certificates() const;
+    const CredentialType type() const;
+#endif    
+    
 private:
     String m_user;
     String m_password;
     CredentialPersistence m_persistence;
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    RetainPtr<SecIdentityRef> m_identity;
+    RetainPtr<CFArrayRef> m_certificates;
+    CredentialType m_type;
+#endif
 };
 
 bool operator==(const Credential& a, const Credential& b);
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
index ec78372..a401751 100644
--- a/WebCore/platform/network/CredentialStorage.cpp
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -85,16 +85,18 @@ static String protectionSpaceMapKeyFromURL(const KURL& url)
 
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
-    ASSERT(url.isValid());
+    ASSERT(protectionSpace.isProxy() || url.protocolInHTTPFamily());
+    ASSERT(protectionSpace.isProxy() || url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    originsWithCredentials().add(originStringFromURL(url));
-
-    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
-        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
-        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+    if (!protectionSpace.isProxy()) {
+        originsWithCredentials().add(originStringFromURL(url));
+
+        ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+        if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+            // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+            pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
+        }
     }
 }
 
diff --git a/WebCore/platform/network/CredentialStorage.h b/WebCore/platform/network/CredentialStorage.h
index 5086f69..21fcbad 100644
--- a/WebCore/platform/network/CredentialStorage.h
+++ b/WebCore/platform/network/CredentialStorage.h
@@ -34,9 +34,13 @@ class ProtectionSpace;
 
 class CredentialStorage {
 public:
+    // WebCore session credential storage.
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
 
+    // OS persistent storage.
+    static Credential getFromPersistentStorage(const ProtectionSpace&);
+
     // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
     // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
     static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
diff --git a/WebCore/platform/network/FormDataBuilder.cpp b/WebCore/platform/network/FormDataBuilder.cpp
index 04c7527..52f62f3 100644
--- a/WebCore/platform/network/FormDataBuilder.cpp
+++ b/WebCore/platform/network/FormDataBuilder.cpp
@@ -127,9 +127,6 @@ static void appendQuotedString(Vector<char>& buffer, const CString& string)
         case '"':
             append(buffer, "%22");
             break;
-        case '%':
-            append(buffer, "%25");
-            break;
         default:
             append(buffer, c);
         }
@@ -143,7 +140,10 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
     // The RFC 2046 spec says the alphanumeric characters plus the
     // following characters are legal for boundaries:  '()+_,-./:=?
     // However the following characters, though legal, cause some sites
-    // to fail: (),./:= (http://bugs.webkit.org/show_bug.cgi?id=13352)
+    // to fail: (),./:=+
+    // Note that our algorithm makes it twice as much likely for 'A' or 'B'
+    // to appear in the boundary string, because 0x41 and 0x42 are present in
+    // the below array twice.
     static const char alphaNumericEncodingMap[64] = {
         0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
         0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50,
@@ -152,18 +152,7 @@ Vector<char> FormDataBuilder::generateUniqueBoundaryString()
         0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E,
         0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76,
         0x77, 0x78, 0x79, 0x7A, 0x30, 0x31, 0x32, 0x33,
-        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x2B, 0x41
-        // FIXME <rdar://problem/5252577> gmail does not accept legal characters in the form boundary
-        // As stated above, some legal characters cause, sites to fail. Specifically
-        // the / character which was the last character in the above array. I have
-        // replaced the last character with another character already in the array
-        // (notice the first and last values are both 0x41, A). Instead of picking
-        // another unique legal character for boundary strings that, because it has
-        // never been tested, may or may not break other sites, I simply
-        // replaced / with A.  This means A is twice as likely to occur in our boundary
-        // strings than any other character but I think this is fine for the time being.
-        // The FIXME here is about restoring the / character once the aforementioned
-        // radar has been resolved.
+        0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42
     };
 
     // Start with an informative prefix.
diff --git a/WebCore/platform/network/HTTPHeaderMap.cpp b/WebCore/platform/network/HTTPHeaderMap.cpp
index 07c66e8..413fb7b 100644
--- a/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -59,5 +59,41 @@ void HTTPHeaderMap::adopt(auto_ptr<CrossThreadHTTPHeaderMapData> data)
         set(header.first, header.second);
     }
 }
+    
+// Adapter that allows the HashMap to take C strings as keys.
+struct CaseFoldingCStringTranslator {
+    static unsigned hash(const char* cString)
+    {
+        return CaseFoldingHash::hash(cString, strlen(cString));
+    }
+    
+    static bool equal(const AtomicString& key, const char* cString)
+    {
+        return equalIgnoringCase(key, cString);
+    }
+    
+    static void translate(AtomicString& location, const char* cString, unsigned /*hash*/)
+    {
+        location = AtomicString(cString);
+    }
+};
+
+String HTTPHeaderMap::get(const char* name) const
+{
+    const_iterator i = find<const char*, CaseFoldingCStringTranslator>(name);
+    if (i == end())
+        return String();
+    return i->second;
+}
+    
+bool HTTPHeaderMap::contains(const char* name) const
+{
+    return find<const char*, CaseFoldingCStringTranslator>(name) != end();
+}
+
+pair<HTTPHeaderMap::iterator, bool> HTTPHeaderMap::add(const char* name, const String& value)
+{
+    return HashMap<AtomicString, String, CaseFoldingHash>::add<const char*, CaseFoldingCStringTranslator>(name, value);
+}
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/HTTPHeaderMap.h b/WebCore/platform/network/HTTPHeaderMap.h
index 6da1b90..dfde974 100644
--- a/WebCore/platform/network/HTTPHeaderMap.h
+++ b/WebCore/platform/network/HTTPHeaderMap.h
@@ -45,6 +45,22 @@ namespace WebCore {
         std::auto_ptr<CrossThreadHTTPHeaderMapData> copyData() const;
 
         void adopt(std::auto_ptr<CrossThreadHTTPHeaderMapData>);
+        
+        String get(const AtomicString& name) const
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::get(name);
+        }
+
+        pair<iterator, bool> add(const AtomicString& name, const String& value)
+        {
+            return HashMap<AtomicString, String, CaseFoldingHash>::add(name, value);
+        }
+
+        // Alternate accessors that are faster than converting the char* to AtomicString first.
+        bool contains(const char*) const;
+        String get(const char*) const;
+        pair<iterator, bool> add(const char* name, const String& value);
+        
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/NetworkStateNotifier.h b/WebCore/platform/network/NetworkStateNotifier.h
index f918be6..a630ccd 100644
--- a/WebCore/platform/network/NetworkStateNotifier.h
+++ b/WebCore/platform/network/NetworkStateNotifier.h
@@ -26,6 +26,8 @@
 #ifndef NetworkStateNotifier_h
 #define NetworkStateNotifier_h
 
+#include <wtf/Noncopyable.h>
+
 #if PLATFORM(MAC)
 
 #include <wtf/RetainPtr.h>
@@ -46,7 +48,7 @@ typedef const struct __SCDynamicStore * SCDynamicStoreRef;
 
 namespace WebCore {
 
-class NetworkStateNotifier {
+class NetworkStateNotifier : public Noncopyable {
 public:
     NetworkStateNotifier();
     void setNetworkStateChangedFunction(void (*)());
diff --git a/WebCore/platform/network/ProtectionSpace.cpp b/WebCore/platform/network/ProtectionSpace.cpp
index d04bcbe..26c258f 100644
--- a/WebCore/platform/network/ProtectionSpace.cpp
+++ b/WebCore/platform/network/ProtectionSpace.cpp
@@ -111,7 +111,8 @@ bool operator==(const ProtectionSpace& a, const ProtectionSpace& b)
         return false;
     if (a.serverType() != b.serverType())
         return false;
-    if (a.realm() != b.realm())
+    // Ignore realm for proxies
+    if (!a.isProxy() && a.realm() != b.realm())
         return false;
     if (a.authenticationScheme() != b.authenticationScheme())
         return false;
diff --git a/WebCore/platform/network/ProtectionSpaceHash.h b/WebCore/platform/network/ProtectionSpaceHash.h
index 6f68b5b..f8c84e8 100644
--- a/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/WebCore/platform/network/ProtectionSpaceHash.h
@@ -37,11 +37,15 @@ struct ProtectionSpaceHash {
             protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
             protectionSpace.port(), 
             protectionSpace.serverType(),
-            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
-            protectionSpace.authenticationScheme()
+            protectionSpace.authenticationScheme(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0
         };
 
-        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+        unsigned codeCount = sizeof(hashCodes) / sizeof(UChar);
+        // Ignore realm for proxies.
+        if (protectionSpace.isProxy())
+            codeCount -= sizeof(hashCodes[0]) / sizeof(UChar);
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/WebCore/platform/network/ResourceHandle.cpp b/WebCore/platform/network/ResourceHandle.cpp
index 5a40b21..7c20561 100644
--- a/WebCore/platform/network/ResourceHandle.cpp
+++ b/WebCore/platform/network/ResourceHandle.cpp
@@ -36,8 +36,6 @@ namespace WebCore {
 
 static bool shouldForceContentSniffing;
 
-static bool portAllowed(const ResourceRequest&);
-
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading,
          bool shouldContentSniff, bool mightDownloadFromHandle)
     : d(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff, mightDownloadFromHandle))
@@ -57,7 +55,7 @@ PassRefPtr<ResourceHandle> ResourceHandle::create(const ResourceRequest& request
         return newHandle.release();
     }
 
-    if (!portAllowed(request)) {
+    if (!portAllowed(request.url())) {
         newHandle->scheduleFailure(BlockedFailure);
         return newHandle.release();
     }
@@ -110,100 +108,9 @@ void ResourceHandle::clearAuthentication()
 {
 #if PLATFORM(MAC)
     d->m_currentMacChallenge = nil;
-#elif USE(CFNETWORK)
-    d->m_currentCFChallenge = 0;
 #endif
     d->m_currentWebChallenge.nullify();
 }
-
-static bool portAllowed(const ResourceRequest& request)
-{
-    unsigned short port = request.url().port();
-
-    // Since most URLs don't have a port, return early for the "no port" case.
-    if (!port)
-        return true;
-
-    // This blocked port list matches the port blocking that Mozilla implements.
-    // See http://www.mozilla.org/projects/netlib/PortBanning.html for more information.
-    static const unsigned short blockedPortList[] = {
-        1,    // tcpmux
-        7,    // echo
-        9,    // discard
-        11,   // systat
-        13,   // daytime
-        15,   // netstat
-        17,   // qotd
-        19,   // chargen
-        20,   // FTP-data
-        21,   // FTP-control
-        22,   // SSH
-        23,   // telnet
-        25,   // SMTP
-        37,   // time
-        42,   // name
-        43,   // nicname
-        53,   // domain
-        77,   // priv-rjs
-        79,   // finger
-        87,   // ttylink
-        95,   // supdup
-        101,  // hostriame
-        102,  // iso-tsap
-        103,  // gppitnp
-        104,  // acr-nema
-        109,  // POP2
-        110,  // POP3
-        111,  // sunrpc
-        113,  // auth
-        115,  // SFTP
-        117,  // uucp-path
-        119,  // nntp
-        123,  // NTP
-        135,  // loc-srv / epmap
-        139,  // netbios
-        143,  // IMAP2
-        179,  // BGP
-        389,  // LDAP
-        465,  // SMTP+SSL
-        512,  // print / exec
-        513,  // login
-        514,  // shell
-        515,  // printer
-        526,  // tempo
-        530,  // courier
-        531,  // Chat
-        532,  // netnews
-        540,  // UUCP
-        556,  // remotefs
-        563,  // NNTP+SSL
-        587,  // ESMTP
-        601,  // syslog-conn
-        636,  // LDAP+SSL
-        993,  // IMAP+SSL
-        995,  // POP3+SSL
-        2049, // NFS
-        3659, // apple-sasl / PasswordServer [Apple addition]
-        4045, // lockd
-        6000, // X11
-    };
-    const unsigned short* const blockedPortListEnd = blockedPortList
-        + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
-
-    // If the port is not in the blocked port list, allow it.
-    if (!std::binary_search(blockedPortList, blockedPortListEnd, port))
-        return true;
-
-    // Allow ports 21 and 22 for FTP URLs, as Mozilla does.
-    if ((port == 21 || port == 22) && request.url().protocolIs("ftp"))
-        return true;
-
-    // Allow any port number in a file URL, since the port number is ignored.
-    if (request.url().protocolIs("file"))
-        return true;
-
-    return false;
-}
   
 bool ResourceHandle::shouldContentSniff() const
 {
diff --git a/WebCore/platform/network/ResourceHandle.h b/WebCore/platform/network/ResourceHandle.h
index e82e13b..e7f6092 100644
--- a/WebCore/platform/network/ResourceHandle.h
+++ b/WebCore/platform/network/ResourceHandle.h
@@ -27,6 +27,7 @@
 #define ResourceHandle_h
 
 #include "AuthenticationChallenge.h"
+#include "AuthenticationClient.h"
 #include "HTTPHeaderMap.h"
 #include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
@@ -84,14 +85,18 @@ class KURL;
 class ResourceError;
 class ResourceHandleClient;
 class ResourceHandleInternal;
-struct ResourceRequest;
+class ResourceRequest;
 class ResourceResponse;
 class SchedulePair;
 class SharedBuffer;
 
 template <typename T> class Timer;
 
-class ResourceHandle : public RefCounted<ResourceHandle> {
+class ResourceHandle : public RefCounted<ResourceHandle>
+#if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
+    , public AuthenticationClient
+#endif
+    {
 private:
     ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff, bool mightDownloadFromHandle);
 
@@ -110,7 +115,7 @@ public:
     static bool didSendBodyDataDelegateExists();
 #endif
 
-    ~ResourceHandle();
+    virtual ~ResourceHandle();
 
 #if PLATFORM(MAC) || USE(CFNETWORK)
     void willSendRequest(ResourceRequest&, const ResourceResponse& redirectResponse);
@@ -118,9 +123,9 @@ public:
 #endif
 #if PLATFORM(MAC) || USE(CFNETWORK) || USE(CURL)
     void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
-    void receivedCredential(const AuthenticationChallenge&, const Credential&);
-    void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
-    void receivedCancellation(const AuthenticationChallenge&);
+    virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
+    virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+    virtual void receivedCancellation(const AuthenticationChallenge&);
 #endif
 
 #if PLATFORM(MAC)
@@ -133,7 +138,6 @@ public:
     void schedule(SchedulePair*);
     void unschedule(SchedulePair*);
 #elif USE(CFNETWORK)
-    static CFRunLoopRef loaderRunLoop();
     CFURLConnectionRef connection() const;
     CFURLConnectionRef releaseConnectionForDownload();
     static void setHostAllowsAnyHTTPSCertificate(const String&);
@@ -190,11 +194,17 @@ public:
 
     void fireFailure(Timer<ResourceHandle>*);
 
+    using RefCounted<ResourceHandle>::ref;
+    using RefCounted<ResourceHandle>::deref;
+
 private:
     void scheduleFailure(FailureType);
 
     bool start(Frame*);
 
+    virtual void refAuthenticationClient() { ref(); }
+    virtual void derefAuthenticationClient() { deref(); }
+
     friend class ResourceHandleInternal;
     OwnPtr<ResourceHandleInternal> d;
 };
diff --git a/WebCore/platform/network/ResourceHandleClient.h b/WebCore/platform/network/ResourceHandleClient.h
index c99be54..b5efaed 100644
--- a/WebCore/platform/network/ResourceHandleClient.h
+++ b/WebCore/platform/network/ResourceHandleClient.h
@@ -50,7 +50,7 @@ namespace WebCore {
     class KURL;
     class ResourceHandle;
     class ResourceError;
-    struct ResourceRequest;
+    class ResourceRequest;
     class ResourceResponse;
 
     enum CacheStoragePolicy {
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index fa939db..8313560 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -132,8 +132,6 @@ namespace WebCore {
             , m_startWhenScheduled(false)
             , m_needsSiteSpecificQuirks(false)
             , m_currentMacChallenge(nil)
-#elif USE(CFNETWORK)
-            , m_currentCFChallenge(0)
 #endif
 #if PLATFORM(ANDROID)
             , m_loader(0)
@@ -211,24 +209,24 @@ namespace WebCore {
         Frame* m_frame;
 #endif
 #if PLATFORM(QT)
-#if QT_VERSION < 0x040400
-        QWebNetworkJob* m_job;
-#else
         QNetworkReplyHandler* m_job;
-#endif
         QWebFrame* m_frame;
 #endif
 
-        // FIXME: The platform challenge is almost identical to the one stored in m_currentWebChallenge, but it has a different sender. We only need to store a sender reference here.
 #if PLATFORM(MAC)
+        // We need to keep a reference to the original challenge to be able to cancel it.
+        // It is almost identical to m_currentWebChallenge.nsURLAuthenticationChallenge(), but has a different sender.
         NSURLAuthenticationChallenge *m_currentMacChallenge;
 #endif
+<<<<<<< HEAD:WebCore/platform/network/ResourceHandleInternal.h
 #if USE(CFNETWORK)
         CFURLAuthChallengeRef m_currentCFChallenge;
 #endif
 #if PLATFORM(ANDROID)
         RefPtr<ResourceLoaderAndroid> m_loader;
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/platform/network/ResourceHandleInternal.h
         AuthenticationChallenge m_currentWebChallenge;
 
         ResourceHandle::FailureType m_failureType;
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index 936f26b..41afb92 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -208,6 +208,13 @@ String ResourceRequestBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name);
 }
 
+String ResourceRequestBase::httpHeaderField(const char* name) const
+{
+    updateResourceRequest(); 
+    
+    return m_httpHeaderFields.get(name);
+}
+
 void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     updateResourceRequest(); 
@@ -218,6 +225,11 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
         m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::setHTTPHeaderField(const char* name, const String& value)
+{
+    setHTTPHeaderField(AtomicString(name), value);
+}
+
 void ResourceRequestBase::clearHTTPReferrer()
 {
     updateResourceRequest(); 
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 84a7bd0..931a9de 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -46,12 +46,25 @@ namespace WebCore {
 
     const int unspecifiedTimeoutInterval = INT_MAX;
 
-    struct ResourceRequest;
+    class ResourceRequest;
     struct CrossThreadResourceRequestData;
 
     // Do not use this type directly.  Use ResourceRequest instead.
     class ResourceRequestBase {
     public:
+        // The type of this ResourceRequest, based on how the resource will be used.
+        enum TargetType {
+            TargetIsMainFrame,
+            TargetIsSubframe,
+            TargetIsSubresource,  // Resource is a generic subresource.  (Generally a specific type should be specified)
+            TargetIsStyleSheet,
+            TargetIsScript,
+            TargetIsFontResource,
+            TargetIsImage,
+            TargetIsObject,
+            TargetIsMedia
+        };
+
         static std::auto_ptr<ResourceRequest> adopt(std::auto_ptr<CrossThreadResourceRequestData>);
 
         // Gets a copy of the data suitable for passing to another thread.
@@ -79,7 +92,9 @@ namespace WebCore {
         
         const HTTPHeaderMap& httpHeaderFields() const;
         String httpHeaderField(const AtomicString& name) const;
+        String httpHeaderField(const char* name) const;
         void setHTTPHeaderField(const AtomicString& name, const String& value);
+        void setHTTPHeaderField(const char* name, const String& value);
         void addHTTPHeaderField(const AtomicString& name, const String& value);
         void addHTTPHeaderFields(const HTTPHeaderMap& headerFields);
         
@@ -115,12 +130,17 @@ namespace WebCore {
         bool reportUploadProgress() const { return m_reportUploadProgress; }
         void setReportUploadProgress(bool reportUploadProgress) { m_reportUploadProgress = reportUploadProgress; }
 
+        // What this request is for.
+        TargetType targetType() const { return m_targetType; }
+        void setTargetType(TargetType type) { m_targetType = type; }
+
     protected:
         // Used when ResourceRequest is initialized from a platform representation of the request
         ResourceRequestBase()
             : m_resourceRequestUpdated(false)
             , m_platformRequestUpdated(true)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -133,6 +153,7 @@ namespace WebCore {
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
+            , m_targetType(TargetIsSubresource)
         {
         }
 
@@ -152,6 +173,7 @@ namespace WebCore {
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
+        TargetType m_targetType;
 
     private:
         const ResourceRequest& asResourceRequest() const;
@@ -162,7 +184,7 @@ namespace WebCore {
     bool operator==(const ResourceRequestBase&, const ResourceRequestBase&);
     inline bool operator!=(ResourceRequestBase& a, const ResourceRequestBase& b) { return !(a == b); }
 
-    struct CrossThreadResourceRequestData {
+    struct CrossThreadResourceRequestData : Noncopyable {
         KURL m_url;
 
         ResourceRequestCachePolicy m_cachePolicy;
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index fd44225..f9cd271 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -239,6 +239,13 @@ String ResourceResponseBase::httpHeaderField(const AtomicString& name) const
     return m_httpHeaderFields.get(name); 
 }
 
+String ResourceResponseBase::httpHeaderField(const char* name) const
+{
+    lazyInit();
+
+    return m_httpHeaderFields.get(name); 
+}
+
 void ResourceResponseBase::setHTTPHeaderField(const AtomicString& name, const String& value)
 {
     lazyInit();
diff --git a/WebCore/platform/network/ResourceResponseBase.h b/WebCore/platform/network/ResourceResponseBase.h
index 7594c09..e06c6f8 100644
--- a/WebCore/platform/network/ResourceResponseBase.h
+++ b/WebCore/platform/network/ResourceResponseBase.h
@@ -71,6 +71,7 @@ public:
     void setHTTPStatusText(const String&);
     
     String httpHeaderField(const AtomicString& name) const;
+    String httpHeaderField(const char* name) const;
     void setHTTPHeaderField(const AtomicString& name, const String& value);
     const HTTPHeaderMap& httpHeaderFields() const;
 
diff --git a/WebCore/platform/network/SocketStreamHandleBase.cpp b/WebCore/platform/network/SocketStreamHandleBase.cpp
index 875c248..8472713 100644
--- a/WebCore/platform/network/SocketStreamHandleBase.cpp
+++ b/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "SocketStreamHandleBase.h"
 
+#include "SocketStreamHandle.h"
 #include "SocketStreamHandleClient.h"
 
 namespace WebCore {
@@ -64,7 +65,7 @@ bool SocketStreamHandleBase::send(const char* data, int length)
     int bytesWritten = 0;
     if (m_state == Open)
         bytesWritten = platformSend(data, length);
-    if (bytesWritten <= 0)
+    if (bytesWritten < 0)
         return false;
     if (m_buffer.size() + length - bytesWritten > bufferSize) {
         // FIXME: report error to indicate that buffer has no more space.
@@ -77,6 +78,8 @@ bool SocketStreamHandleBase::send(const char* data, int length)
 
 void SocketStreamHandleBase::close()
 {
+    RefPtr<SocketStreamHandle> protect(static_cast<SocketStreamHandle*>(this)); // platformClose calls the client, which may make the handle get deallocated immediately.
+
     platformClose();
     m_state = Closed;
 }
diff --git a/WebCore/platform/network/SocketStreamHandleClient.h b/WebCore/platform/network/SocketStreamHandleClient.h
index 04c744e..5d97ec0 100644
--- a/WebCore/platform/network/SocketStreamHandleClient.h
+++ b/WebCore/platform/network/SocketStreamHandleClient.h
@@ -43,18 +43,15 @@ namespace WebCore {
     public:
         virtual ~SocketStreamHandleClient() { }
 
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
-        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
-
         virtual void didOpen(SocketStreamHandle*) { }
         virtual void didClose(SocketStreamHandle*) { }
         virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
 
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
 
+        // No authentication for streams per se, but proxy may ask for credentials.
         virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
         virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
-        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
     };
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/cf/AuthenticationCF.cpp b/WebCore/platform/network/cf/AuthenticationCF.cpp
index bb05a39..93b62a8 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -27,9 +27,9 @@
 #include "AuthenticationCF.h"
 
 #include "AuthenticationChallenge.h"
+#include "AuthenticationClient.h"
 #include "Credential.h"
 #include "ProtectionSpace.h"
-#include "ResourceHandle.h"
 
 #include <CFNetwork/CFURLAuthChallengePriv.h>
 #include <CFNetwork/CFURLCredentialPriv.h>
@@ -51,20 +51,20 @@ AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protecti
 }
 
 AuthenticationChallenge::AuthenticationChallenge(CFURLAuthChallengeRef cfChallenge,
-                                                 ResourceHandle* sourceHandle)
+                                                 AuthenticationClient* authenticationClient)
     : AuthenticationChallengeBase(core(CFURLAuthChallengeGetProtectionSpace(cfChallenge)),
                                   core(CFURLAuthChallengeGetProposedCredential(cfChallenge)),
                                   CFURLAuthChallengeGetPreviousFailureCount(cfChallenge),
                                   (CFURLResponseRef)CFURLAuthChallengeGetFailureResponse(cfChallenge),
                                   CFURLAuthChallengeGetError(cfChallenge))
-    , m_sourceHandle(sourceHandle)
+    , m_authenticationClient(authenticationClient)
     , m_cfChallenge(cfChallenge)
 {
 }
 
 bool AuthenticationChallenge::platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b)
 {
-    if (a.sourceHandle() != b.sourceHandle())
+    if (a.authenticationClient() != b.authenticationClient())
         return false;
 
     if (a.cfURLAuthChallengeRef() != b.cfURLAuthChallengeRef())
diff --git a/WebCore/platform/network/cf/AuthenticationChallenge.h b/WebCore/platform/network/cf/AuthenticationChallenge.h
index 9697d7e..58fb836 100644
--- a/WebCore/platform/network/cf/AuthenticationChallenge.h
+++ b/WebCore/platform/network/cf/AuthenticationChallenge.h
@@ -26,29 +26,29 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 typedef struct _CFURLAuthChallenge* CFURLAuthChallengeRef;
 
 namespace WebCore {
 
-class ResourceHandle;
-
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
     AuthenticationChallenge() {}
     AuthenticationChallenge(const ProtectionSpace& protectionSpace, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse& response, const ResourceError& error);
-    AuthenticationChallenge(CFURLAuthChallengeRef, ResourceHandle* sourceHandle);
+    AuthenticationChallenge(CFURLAuthChallengeRef, AuthenticationClient*);
+
+    AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
+    void setAuthenticationClient(AuthenticationClient* client) { m_authenticationClient = client; }
 
-    ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
     CFURLAuthChallengeRef cfURLAuthChallengeRef() const { return m_cfChallenge.get(); }
 
 private:
     friend class AuthenticationChallengeBase;
     static bool platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b);
 
-    RefPtr<ResourceHandle> m_sourceHandle;
+    RefPtr<AuthenticationClient> m_authenticationClient;
     RetainPtr<CFURLAuthChallengeRef> m_cfChallenge;
 };
 
diff --git a/WebCore/platform/network/cf/CredentialStorageCFNet.cpp b/WebCore/platform/network/cf/CredentialStorageCFNet.cpp
new file mode 100644
index 0000000..0a9e36f
--- /dev/null
+++ b/WebCore/platform/network/cf/CredentialStorageCFNet.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "AuthenticationCF.h"
+#include "Credential.h"
+#include "ProtectionSpace.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+Credential CredentialStorage::getFromPersistentStorage(const ProtectionSpace& protectionSpace)
+{
+    RetainPtr<CFURLProtectionSpaceRef> protectionSpaceCF(AdoptCF, createCF(protectionSpace));
+    RetainPtr<CFURLCredentialRef> credentialCF(AdoptCF, wkCopyCredentialFromCFPersistentStorage(protectionSpaceCF.get()));
+    return core(credentialCF.get());
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/cf/DNSCFNet.cpp b/WebCore/platform/network/cf/DNSCFNet.cpp
index 381dff2..6311baf 100644
--- a/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -33,7 +33,7 @@
 #include <wtf/StdLibExtras.h>
 
 #if PLATFORM(WIN)
-#include "ResourceHandle.h" // for loaderRunLoop()
+#include "LoaderRunLoopCF.h"
 #endif
 
 #ifdef BUILDING_ON_TIGER
@@ -137,7 +137,7 @@ void DNSResolveQueue::resolve(const String& hostname)
     CFHostScheduleWithRunLoop(host.get(), CFRunLoopGetMain(), kCFRunLoopCommonModes);
 #else
     // On Windows, we run a separate thread with CFRunLoop, which is where clientCallback will be called.
-    CFHostScheduleWithRunLoop(host.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFHostScheduleWithRunLoop(host.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
 #endif
     CFHostStartInfoResolution(host.get(), kCFHostAddresses, 0);
     host.releaseRef(); // The host will be released from clientCallback().
diff --git a/WebCore/platform/network/cf/LoaderRunLoopCF.cpp b/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
new file mode 100644
index 0000000..aa68916
--- /dev/null
+++ b/WebCore/platform/network/cf/LoaderRunLoopCF.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LoaderRunLoopCF.h"
+
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+static CFRunLoopRef loaderRunLoopObject = 0;
+
+static void emptyPerform(void*) 
+{
+}
+
+static void* runLoaderThread(void*)
+{
+    loaderRunLoopObject = CFRunLoopGetCurrent();
+
+    // Must add a source to the run loop to prevent CFRunLoopRun() from exiting.
+    CFRunLoopSourceContext ctxt = {0, (void*)1 /*must be non-NULL*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
+    CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
+    CFRunLoopAddSource(loaderRunLoopObject, bogusSource, kCFRunLoopDefaultMode);
+
+    CFRunLoopRun();
+
+    return 0;
+}
+
+CFRunLoopRef loaderRunLoop()
+{
+    ASSERT(isMainThread());
+    if (!loaderRunLoopObject) {
+        createThread(runLoaderThread, 0, "WebCore: CFNetwork Loader");
+        while (!loaderRunLoopObject) {
+            // FIXME: Sleep 10? that can't be right...
+            Sleep(10);
+        }
+    }
+    return loaderRunLoopObject;
+}
+
+}
diff --git a/WebCore/platform/network/cf/LoaderRunLoopCF.h b/WebCore/platform/network/cf/LoaderRunLoopCF.h
new file mode 100644
index 0000000..20e4c29
--- /dev/null
+++ b/WebCore/platform/network/cf/LoaderRunLoopCF.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LoaderRunLoopCF_h
+#define LoaderRunLoopCF_h
+
+#if !PLATFORM(WIN)
+#error This code is not needed on platforms other than Windows, because main thread's CFRunLoop can be used.
+#endif
+
+namespace WebCore {
+
+CFRunLoopRef loaderRunLoop();
+
+}
+
+#endif // LoaderRunLoop_h
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index 38a9705..8cc5022 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -39,6 +39,7 @@
 #include "FormDataStreamCFNet.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "LoaderRunLoopCF.h"
 #include "Logging.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceError.h"
@@ -322,37 +323,6 @@ CFArrayRef arrayFromFormData(const FormData& d)
     return a;
 }
 
-void emptyPerform(void* unused) 
-{
-}
-
-static CFRunLoopRef loaderRL = 0;
-void* runLoaderThread(void *unused)
-{
-    loaderRL = CFRunLoopGetCurrent();
-
-    // Must add a source to the run loop to prevent CFRunLoopRun() from exiting
-    CFRunLoopSourceContext ctxt = {0, (void *)1 /*must be non-NULL*/, 0, 0, 0, 0, 0, 0, 0, emptyPerform};
-    CFRunLoopSourceRef bogusSource = CFRunLoopSourceCreate(0, 0, &ctxt);
-    CFRunLoopAddSource(loaderRL, bogusSource,kCFRunLoopDefaultMode);
-
-    CFRunLoopRun();
-
-    return 0;
-}
-
-CFRunLoopRef ResourceHandle::loaderRunLoop()
-{
-    if (!loaderRL) {
-        createThread(runLoaderThread, 0, "WebCore: CFNetwork Loader");
-        while (loaderRL == 0) {
-            // FIXME: sleep 10? that can't be right...
-            Sleep(10);
-        }
-    }
-    return loaderRL;
-}
-
 static CFURLRequestRef makeFinalRequest(const ResourceRequest& request, bool shouldContentSniff)
 {
     CFMutableURLRequestRef newRequest = CFURLRequestCreateMutableCopy(kCFAllocatorDefault, request.cfURLRequest());
@@ -479,11 +449,11 @@ bool ResourceHandle::shouldUseCredentialStorage()
 void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge& challenge)
 {
     LOG(Network, "CFNet - didReceiveAuthenticationChallenge()");
-    ASSERT(!d->m_currentCFChallenge);
     ASSERT(d->m_currentWebChallenge.isNull());
     // Since CFURLConnection networking relies on keeping a reference to the original CFURLAuthChallengeRef,
     // we make sure that is actually present
     ASSERT(challenge.cfURLAuthChallengeRef());
+    ASSERT(challenge.authenticationClient() == this); // Should be already set.
 
     if (!d->m_user.isNull() && !d->m_pass.isNull()) {
         RetainPtr<CFStringRef> user(AdoptCF, d->m_user.createCFString());
@@ -513,8 +483,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
         }
     }
 
-    d->m_currentCFChallenge = challenge.cfURLAuthChallengeRef();
-    d->m_currentWebChallenge = AuthenticationChallenge(d->m_currentCFChallenge, this);
+    d->m_currentWebChallenge = challenge;
     
     if (client())
         client()->didReceiveAuthenticationChallenge(this, d->m_currentWebChallenge);
diff --git a/WebCore/platform/network/cf/ResourceRequest.h b/WebCore/platform/network/cf/ResourceRequest.h
index 8ead412..e361af5 100644
--- a/WebCore/platform/network/cf/ResourceRequest.h
+++ b/WebCore/platform/network/cf/ResourceRequest.h
@@ -34,8 +34,8 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -64,7 +64,7 @@ namespace WebCore {
         CFURLRequestRef cfURLRequest() const;       
 
     private:
-        friend struct ResourceRequestBase;
+        friend class ResourceRequestBase;
 
         void doUpdatePlatformRequest();
         void doUpdateResourceRequest();
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.h b/WebCore/platform/network/cf/ResourceRequestCFNet.h
index d26072d..e9ebe76 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -30,7 +30,7 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest;
+    class ResourceRequest;
 
     void getResourceRequest(ResourceRequest&, CFURLRequestRef);
     CFURLRequestRef cfURLRequest(const ResourceRequest&);
diff --git a/WebCore/platform/network/cf/SocketStreamHandle.h b/WebCore/platform/network/cf/SocketStreamHandle.h
index 64139e5..63bf9a7 100644
--- a/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -32,10 +32,9 @@
 #ifndef SocketStreamHandle_h
 #define SocketStreamHandle_h
 
+#include "AuthenticationClient.h"
 #include "SocketStreamHandleBase.h"
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
 
 namespace WebCore {
 
@@ -43,24 +42,69 @@ namespace WebCore {
     class Credential;
     class SocketStreamHandleClient;
 
-    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
     public:
         static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
 
         virtual ~SocketStreamHandle();
 
-    protected:
+        using RefCounted<SocketStreamHandle>::ref;
+        using RefCounted<SocketStreamHandle>::deref;
+
+    private:
         virtual int platformSend(const char* data, int length);
         virtual void platformClose();
 
-    private:
         SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+        void createStreams();
+        void scheduleStreams();
+        void chooseProxy();
+#ifndef BUILDING_ON_TIGER
+        void chooseProxyFromArray(CFArrayRef);
+        void executePACFileURL(CFURLRef);
+        void removePACRunLoopSource();
+        RetainPtr<CFRunLoopSourceRef> m_pacRunLoopSource;
+        static void pacExecutionCallback(void* client, CFArrayRef proxyList, CFErrorRef error);
+        static void pacExecutionCallbackMainThread(void*);
+        static CFStringRef copyPACExecutionDescription(void*);
+#endif
+
+        bool shouldUseSSL() const { return m_url.protocolIs("wss"); }
+
+        void addCONNECTCredentials(CFHTTPMessageRef response);
+
+        static CFStringRef copyCFStreamDescription(void* );
+        static void readStreamCallback(CFReadStreamRef, CFStreamEventType, void*);
+        static void writeStreamCallback(CFWriteStreamRef, CFStreamEventType, void*);
+#if PLATFORM(WIN)
+        static void readStreamCallbackMainThread(void*);
+        static void writeStreamCallbackMainThread(void*);
+#endif
+        void readStreamCallback(CFStreamEventType);
+        void writeStreamCallback(CFStreamEventType);
 
         // No authentication for streams per se, but proxy may ask for credentials.
-        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
-        void receivedCredential(const AuthenticationChallenge&, const Credential&);
-        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
-        void receivedCancellation(const AuthenticationChallenge&);
+        virtual void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        virtual void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        virtual void receivedCancellation(const AuthenticationChallenge&);
+
+        virtual void refAuthenticationClient() { ref(); }
+        virtual void derefAuthenticationClient() { deref(); }
+
+        enum ConnectingSubstate { New, ExecutingPACFile, WaitingForCredentials, WaitingForConnect, Connected };
+        ConnectingSubstate m_connectingSubstate;
+
+        enum ConnectionType { Unknown, Direct, SOCKSProxy, CONNECTProxy };
+        ConnectionType m_connectionType;
+        RetainPtr<CFStringRef> m_proxyHost;
+        RetainPtr<CFNumberRef> m_proxyPort;
+
+        RetainPtr<CFHTTPMessageRef> m_proxyResponseMessage;
+        bool m_sentStoredCredentials;
+        RetainPtr<CFReadStreamRef> m_readStream;
+        RetainPtr<CFWriteStreamRef> m_writeStream;
+
+        RetainPtr<CFURLRef> m_httpsURL; // ws(s): replaced with https:
     };
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index 6aa33fc..e7e64da 100644
--- a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
  * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,58 +32,608 @@
 #include "config.h"
 #include "SocketStreamHandle.h"
 
-#include "KURL.h"
+#include "Credential.h"
+#include "CredentialStorage.h"
 #include "Logging.h"
-#include "NotImplemented.h"
+#include "ProtectionSpace.h"
+#include "SocketStreamError.h"
 #include "SocketStreamHandleClient.h"
+#include <wtf/MainThread.h>
+
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+#include <SystemConfiguration/SystemConfiguration.h>
+#endif
+
+#if PLATFORM(WIN)
+#include "LoaderRunLoopCF.h"
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#else
+#include "WebCoreSystemInterface.h"
+#endif
+
+#ifdef BUILDING_ON_TIGER
+#define CFN_EXPORT extern
+#endif
 
 namespace WebCore {
 
 SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
     : SocketStreamHandleBase(url, client)
+    , m_connectingSubstate(New)
+    , m_connectionType(Unknown)
+    , m_sentStoredCredentials(false)
 {
     LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
-    notImplemented();
+
+    ASSERT(url.protocolIs("ws") || url.protocolIs("wss"));
+
+    if (!m_url.port())
+        m_url.setPort(shouldUseSSL() ? 443 : 80);
+
+    KURL httpsURL(KURL(), "https://" + m_url.host());
+    m_httpsURL.adoptCF(httpsURL.createCFURL());
+
+    createStreams();
+    ASSERT(!m_readStream == !m_writeStream);
+    if (!m_readStream) // Doing asynchronous PAC file processing, streams will be created later.
+        return;
+
+    scheduleStreams();
+}
+
+void SocketStreamHandle::scheduleStreams()
+{
+    ASSERT(m_readStream);
+    ASSERT(m_writeStream);
+
+    CFStreamClientContext clientContext = { 0, this, 0, 0, copyCFStreamDescription };
+    // FIXME: Pass specific events we're interested in instead of -1.
+    CFReadStreamSetClient(m_readStream.get(), static_cast<CFOptionFlags>(-1), readStreamCallback, &clientContext);
+    CFWriteStreamSetClient(m_writeStream.get(), static_cast<CFOptionFlags>(-1), writeStreamCallback, &clientContext);
+
+#if PLATFORM(WIN)
+    CFReadStreamScheduleWithRunLoop(m_readStream.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
+    CFWriteStreamScheduleWithRunLoop(m_writeStream.get(), loaderRunLoop(), kCFRunLoopDefaultMode);
+#else
+    CFReadStreamScheduleWithRunLoop(m_readStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+    CFWriteStreamScheduleWithRunLoop(m_writeStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+#endif
+
+    CFReadStreamOpen(m_readStream.get());
+    CFWriteStreamOpen(m_writeStream.get());
+
+#ifndef BUILDING_ON_TIGER
+    if (m_pacRunLoopSource)
+        removePACRunLoopSource();
+#endif
+
+    m_connectingSubstate = WaitingForConnect;
+}
+
+#ifndef BUILDING_ON_TIGER
+CFStringRef SocketStreamHandle::copyPACExecutionDescription(void*)
+{
+    return CFSTR("WebSocket proxy PAC file execution");
+}
+
+struct MainThreadPACCallbackInfo {
+    MainThreadPACCallbackInfo(SocketStreamHandle* handle, CFArrayRef proxyList) : handle(handle), proxyList(proxyList) { }
+    SocketStreamHandle* handle;
+    CFArrayRef proxyList;
+};
+
+void SocketStreamHandle::pacExecutionCallback(void* client, CFArrayRef proxyList, CFErrorRef)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(client);
+    MainThreadPACCallbackInfo info(handle, proxyList);
+    // If we're already on main thread (e.g. on Mac), callOnMainThreadAndWait() will be just a function call.
+    callOnMainThreadAndWait(pacExecutionCallbackMainThread, &info);
+}
+
+void SocketStreamHandle::pacExecutionCallbackMainThread(void* invocation)
+{
+    MainThreadPACCallbackInfo* info = static_cast<MainThreadPACCallbackInfo*>(invocation);
+    ASSERT(info->handle->m_connectingSubstate == ExecutingPACFile);
+    // This time, the array won't have PAC as a first entry.
+    info->handle->chooseProxyFromArray(info->proxyList);
+    info->handle->createStreams();
+    info->handle->scheduleStreams();
+}
+
+void SocketStreamHandle::executePACFileURL(CFURLRef pacFileURL)
+{
+    // CFNetwork returns an empty proxy array for WebScoket schemes, so use m_httpsURL.
+    CFStreamClientContext clientContext = { 0, this, 0, 0, copyPACExecutionDescription };
+    m_pacRunLoopSource.adoptCF(CFNetworkExecuteProxyAutoConfigurationURL(pacFileURL, m_httpsURL.get(), pacExecutionCallback, &clientContext));
+#if PLATFORM(WIN)
+    CFRunLoopAddSource(loaderRunLoop(), m_pacRunLoopSource.get(), kCFRunLoopDefaultMode);
+#else
+    CFRunLoopAddSource(CFRunLoopGetCurrent(), m_pacRunLoopSource.get(), kCFRunLoopCommonModes);
+#endif
+    m_connectingSubstate = ExecutingPACFile;
+}
+
+void SocketStreamHandle::removePACRunLoopSource()
+{
+    ASSERT(m_pacRunLoopSource);
+
+    CFRunLoopSourceInvalidate(m_pacRunLoopSource.get());
+#if PLATFORM(WIN)
+    CFRunLoopRemoveSource(loaderRunLoop(), m_pacRunLoopSource.get(), kCFRunLoopDefaultMode);
+#else
+    CFRunLoopRemoveSource(CFRunLoopGetCurrent(), m_pacRunLoopSource.get(), kCFRunLoopCommonModes);
+#endif
+    m_pacRunLoopSource = 0;
+}
+
+void SocketStreamHandle::chooseProxy()
+{
+#ifndef BUILDING_ON_LEOPARD
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, CFNetworkCopySystemProxySettings());
+#else
+    // We don't need proxy information often, so there is no need to set up a permanent dynamic store session.
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, SCDynamicStoreCopyProxies(0));
+#endif
+
+    // SOCKS or HTTPS (AKA CONNECT) proxies are supported.
+    // WebSocket protocol relies on handshake being transferred unchanged, so we need a proxy that will not modify headers.
+    // Since HTTP proxies must add Via headers, they are highly unlikely to work.
+    // Many CONNECT proxies limit connectivity to port 443, so we prefer SOCKS, if configured.
+
+    if (!proxyDictionary) {
+        m_connectionType = Direct;
+        return;
+    }
+
+    // CFNetworkCopyProxiesForURL doesn't know about WebSocket schemes, so pretend to use http.
+    // Always use "https" to get HTTPS proxies in result - we'll try to use those for ws:// even though many are configured to reject connections to ports other than 443.
+    RetainPtr<CFArrayRef> proxyArray(AdoptCF, CFNetworkCopyProxiesForURL(m_httpsURL.get(), proxyDictionary.get()));
+
+    chooseProxyFromArray(proxyArray.get());
+}
+
+void SocketStreamHandle::chooseProxyFromArray(CFArrayRef proxyArray)
+{
+    if (!proxyArray)
+        m_connectionType = Direct;
+
+    CFIndex proxyArrayCount = CFArrayGetCount(proxyArray);
+
+    // PAC is always the first entry, if present.
+    if (proxyArrayCount) {
+        CFDictionaryRef proxyInfo = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxyArray, 0));
+        CFTypeRef proxyType = CFDictionaryGetValue(proxyInfo, kCFProxyTypeKey);
+        if (proxyType && CFGetTypeID(proxyType) == CFStringGetTypeID()) {
+            if (CFEqual(proxyType, kCFProxyTypeAutoConfigurationURL)) {
+                CFTypeRef pacFileURL = CFDictionaryGetValue(proxyInfo, kCFProxyAutoConfigurationURLKey);
+                if (pacFileURL && CFGetTypeID(pacFileURL) == CFURLGetTypeID()) {
+                    executePACFileURL(static_cast<CFURLRef>(pacFileURL));
+                    return;
+                }
+            }
+        }
+    }
+
+    CFDictionaryRef chosenProxy = 0;
+    for (CFIndex i = 0; i < proxyArrayCount; ++i) {
+        CFDictionaryRef proxyInfo = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxyArray, i));
+        CFTypeRef proxyType = CFDictionaryGetValue(proxyInfo, kCFProxyTypeKey);
+        if (proxyType && CFGetTypeID(proxyType) == CFStringGetTypeID()) {
+            if (CFEqual(proxyType, kCFProxyTypeSOCKS)) {
+                m_connectionType = SOCKSProxy;
+                chosenProxy = proxyInfo;
+                break;
+            }
+            if (CFEqual(proxyType, kCFProxyTypeHTTPS)) {
+                m_connectionType = CONNECTProxy;
+                chosenProxy = proxyInfo;
+                // Keep looking for proxies, as a SOCKS one is preferable.
+            }
+        }
+    }
+
+    if (chosenProxy) {
+        ASSERT(m_connectionType != Unknown);
+        ASSERT(m_connectionType != Direct);
+
+        CFTypeRef proxyHost = CFDictionaryGetValue(chosenProxy, kCFProxyHostNameKey);
+        CFTypeRef proxyPort = CFDictionaryGetValue(chosenProxy, kCFProxyPortNumberKey);
+
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            return;
+        }
+    }
+
+    m_connectionType = Direct;
+}
+
+#else // BUILDING_ON_TIGER
+
+void SocketStreamHandle::chooseProxy()
+{
+    // We don't need proxy information often, so there is no need to set up a permanent dynamic store session.
+    RetainPtr<CFDictionaryRef> proxyDictionary(AdoptCF, SCDynamicStoreCopyProxies(0));
+
+    // SOCKS or HTTPS (AKA CONNECT) proxies are supported.
+    // WebSocket protocol relies on handshake being transferred unchanged, so we need a proxy that will not modify headers.
+    // Since HTTP proxies must add Via headers, they are highly unlikely to work.
+    // Many CONNECT proxies limit connectivity to port 443, so we prefer SOCKS, if configured.
+
+    if (!proxyDictionary) {
+        m_connectionType = Direct;
+        return;
+    }
+
+    // FIXME: check proxy bypass list and ExcludeSimpleHostnames.
+    // FIXME: Support PAC files.
+
+    CFTypeRef socksEnableCF = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSEnable);
+    int socksEnable;
+    if (socksEnableCF && CFGetTypeID(socksEnableCF) == CFNumberGetTypeID() && CFNumberGetValue(static_cast<CFNumberRef>(socksEnableCF), kCFNumberIntType, &socksEnable) && socksEnable) {
+        CFTypeRef proxyHost = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSProxy);
+        CFTypeRef proxyPort = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesSOCKSPort);
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            m_connectionType = SOCKSProxy;
+            return;
+        }
+    }
+
+    CFTypeRef httpsEnableCF = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSEnable);
+    int httpsEnable;
+    if (httpsEnableCF && CFGetTypeID(httpsEnableCF) == CFNumberGetTypeID() && CFNumberGetValue(static_cast<CFNumberRef>(httpsEnableCF), kCFNumberIntType, &httpsEnable) && httpsEnable) {
+        CFTypeRef proxyHost = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSProxy);
+        CFTypeRef proxyPort = CFDictionaryGetValue(proxyDictionary.get(), kSCPropNetProxiesHTTPSPort);
+
+        if (proxyHost && CFGetTypeID(proxyHost) == CFStringGetTypeID() && proxyPort && CFGetTypeID(proxyPort) == CFNumberGetTypeID()) {
+            m_proxyHost = static_cast<CFStringRef>(proxyHost);
+            m_proxyPort = static_cast<CFNumberRef>(proxyPort);
+            m_connectionType = CONNECTProxy;
+            return;
+        }
+    }
+
+    m_connectionType = Direct;
+}
+#endif // BUILDING_ON_TIGER
+
+void SocketStreamHandle::createStreams()
+{
+    if (m_connectionType == Unknown)
+        chooseProxy();
+
+    // If it's still unknown, then we're resolving a PAC file asynchronously.
+    if (m_connectionType == Unknown)
+        return;
+
+    RetainPtr<CFStringRef> host(AdoptCF, m_url.host().createCFString());
+
+    // Creating streams to final destination, not to proxy.
+    CFReadStreamRef readStream = 0;
+    CFWriteStreamRef writeStream = 0;
+    CFStreamCreatePairWithSocketToHost(0, host.get(), m_url.port(), &readStream, &writeStream);
+
+    m_readStream.adoptCF(readStream);
+    m_writeStream.adoptCF(writeStream);
+
+    switch (m_connectionType) {
+    case Unknown:
+        ASSERT_NOT_REACHED();
+        break;
+    case Direct:
+        break;
+    case SOCKSProxy: {
+        // FIXME: SOCKS5 doesn't do challenge-response, should we try to apply credentials from Keychain right away?
+        // But SOCKS5 credentials don't work at the time of this writing anyway, see <rdar://6776698>.
+        const void* proxyKeys[] = { kCFStreamPropertySOCKSProxyHost, kCFStreamPropertySOCKSProxyPort };
+        const void* proxyValues[] = { m_proxyHost.get(), m_proxyPort.get() };
+        RetainPtr<CFDictionaryRef> connectDictionary(AdoptCF, CFDictionaryCreate(0, proxyKeys, proxyValues, sizeof(proxyKeys) / sizeof(*proxyKeys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+        CFReadStreamSetProperty(m_readStream.get(), kCFStreamPropertySOCKSProxy, connectDictionary.get());
+        break;
+        }
+    case CONNECTProxy:
+        wkSetCONNECTProxyForStream(m_readStream.get(), m_proxyHost.get(), m_proxyPort.get());
+        break;
+    }
+
+    if (shouldUseSSL()) {
+        const void* keys[] = { kCFStreamSSLPeerName, kCFStreamSSLLevel };
+        const void* values[] = { host.get(), kCFStreamSocketSecurityLevelNegotiatedSSL };
+        RetainPtr<CFDictionaryRef> settings(AdoptCF, CFDictionaryCreate(0, keys, values, sizeof(keys) / sizeof(*keys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+        CFReadStreamSetProperty(m_readStream.get(), kCFStreamPropertySSLSettings, settings.get());
+        CFWriteStreamSetProperty(m_writeStream.get(), kCFStreamPropertySSLSettings, settings.get());
+    }
+}
+
+static bool getStoredCONNECTProxyCredentials(const ProtectionSpace& protectionSpace, String& login, String& password)
+{
+    // Try system credential storage first, matching HTTP behavior (CFNetwork only asks the client for password if it couldn't find it in Keychain).
+    Credential storedCredential = CredentialStorage::getFromPersistentStorage(protectionSpace);
+    if (storedCredential.isEmpty())
+        storedCredential = CredentialStorage::get(protectionSpace);
+
+    if (storedCredential.isEmpty())
+        return false;
+
+    login = storedCredential.user();
+    password = storedCredential.password();
+
+    return true;
+}
+
+static ProtectionSpaceAuthenticationScheme authenticationSchemeFromAuthenticationMethod(CFStringRef method)
+{
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeBasic))
+        return ProtectionSpaceAuthenticationSchemeHTTPBasic;
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeDigest))
+        return ProtectionSpaceAuthenticationSchemeHTTPDigest;
+#ifndef BUILDING_ON_TIGER
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeNTLM))
+        return ProtectionSpaceAuthenticationSchemeNTLM;
+    if (CFEqual(method, kCFHTTPAuthenticationSchemeNegotiate))
+        return ProtectionSpaceAuthenticationSchemeNegotiate;
+#endif
+    ASSERT_NOT_REACHED();
+    return ProtectionSpaceAuthenticationSchemeDefault;
+}
+
+void SocketStreamHandle::addCONNECTCredentials(CFHTTPMessageRef proxyResponse)
+{
+    RetainPtr<CFHTTPAuthenticationRef> authentication(AdoptCF, CFHTTPAuthenticationCreateFromResponse(0, proxyResponse));
+
+    if (!CFHTTPAuthenticationRequiresUserNameAndPassword(authentication.get())) {
+        // That's all we can offer...
+        m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+        return;
+    }
+
+    int port = 0;
+    CFNumberGetValue(m_proxyPort.get(), kCFNumberIntType, &port);
+    RetainPtr<CFStringRef> methodCF(AdoptCF, CFHTTPAuthenticationCopyMethod(authentication.get()));
+    RetainPtr<CFStringRef> realmCF(AdoptCF, CFHTTPAuthenticationCopyRealm(authentication.get()));
+    ProtectionSpace protectionSpace(String(m_proxyHost.get()), port, ProtectionSpaceProxyHTTPS, String(realmCF.get()), authenticationSchemeFromAuthenticationMethod(methodCF.get()));
+    String login;
+    String password;
+    if (!m_sentStoredCredentials && getStoredCONNECTProxyCredentials(protectionSpace, login, password)) {
+        // Try to apply stored credentials, if we haven't tried those already.
+        RetainPtr<CFStringRef> loginCF(AdoptCF, login.createCFString());
+        RetainPtr<CFStringRef> passwordCF(AdoptCF, password.createCFString());
+        // Creating a temporary request to make CFNetwork apply credentials to it. Unfortunately, this cannot work with NTLM authentication.
+        RetainPtr<CFHTTPMessageRef> dummyRequest(AdoptCF, CFHTTPMessageCreateRequest(0, CFSTR("GET"), m_httpsURL.get(), kCFHTTPVersion1_1));
+
+        Boolean appliedCredentials = CFHTTPMessageApplyCredentials(dummyRequest.get(), authentication.get(), loginCF.get(), passwordCF.get(), 0);
+        ASSERT_UNUSED(appliedCredentials, appliedCredentials);
+
+        RetainPtr<CFStringRef> proxyAuthorizationString(AdoptCF, CFHTTPMessageCopyHeaderFieldValue(dummyRequest.get(), CFSTR("Proxy-Authorization")));
+
+        if (!proxyAuthorizationString) {
+            // Fails e.g. for NTLM auth.
+            m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+            return;
+        }
+
+        // Setting the authorization results in a new connection attempt.
+        wkSetCONNECTProxyAuthorizationForStream(m_readStream.get(), proxyAuthorizationString.get());
+        m_sentStoredCredentials = true;
+        return;
+    }
+
+    // FIXME: Ask the client if credentials could not be found.
+
+    m_client->didFail(this, SocketStreamError()); // FIXME: Provide a sensible error.
+}
+
+CFStringRef SocketStreamHandle::copyCFStreamDescription(void* info)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(info);
+    return ("WebKit socket stream, " + handle->m_url.string()).createCFString();
+}
+
+struct MainThreadEventCallbackInfo {
+    MainThreadEventCallbackInfo(CFStreamEventType type, SocketStreamHandle* handle) : type(type), handle(handle) { }
+    CFStreamEventType type;
+    SocketStreamHandle* handle;
+};
+
+void SocketStreamHandle::readStreamCallback(CFReadStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(clientCallBackInfo);
+    ASSERT_UNUSED(stream, stream == handle->m_readStream.get());
+#if PLATFORM(WIN)
+    MainThreadEventCallbackInfo info(type, handle);
+    callOnMainThreadAndWait(readStreamCallbackMainThread, &info);
+#else
+    ASSERT(isMainThread());
+    handle->readStreamCallback(type);
+#endif
+}
+
+void SocketStreamHandle::writeStreamCallback(CFWriteStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
+{
+    SocketStreamHandle* handle = static_cast<SocketStreamHandle*>(clientCallBackInfo);
+    ASSERT_UNUSED(stream, stream == handle->m_writeStream.get());
+#if PLATFORM(WIN)
+    MainThreadEventCallbackInfo info(type, handle);
+    callOnMainThreadAndWait(writeStreamCallbackMainThread, &info);
+#else
+    ASSERT(isMainThread());
+    handle->writeStreamCallback(type);
+#endif
+}
+
+#if PLATFORM(WIN)
+void SocketStreamHandle::readStreamCallbackMainThread(void* invocation)
+{
+    MainThreadEventCallbackInfo* info = static_cast<MainThreadEventCallbackInfo*>(invocation);
+    info->handle->readStreamCallback(info->type);
+}
+
+void SocketStreamHandle::writeStreamCallbackMainThread(void* invocation)
+{
+    MainThreadEventCallbackInfo* info = static_cast<MainThreadEventCallbackInfo*>(invocation);
+    info->handle->writeStreamCallback(info->type);
+}
+#endif // PLATFORM(WIN)
+
+void SocketStreamHandle::readStreamCallback(CFStreamEventType type)
+{
+    switch(type) {
+    case kCFStreamEventNone:
+        break;
+    case kCFStreamEventOpenCompleted:
+        break;
+    case kCFStreamEventHasBytesAvailable: {
+        if (m_connectingSubstate == WaitingForConnect) {
+            if (m_connectionType == CONNECTProxy) {
+                RetainPtr<CFHTTPMessageRef> proxyResponse(AdoptCF, wkCopyCONNECTProxyResponse(m_readStream.get(), m_httpsURL.get()));
+                if (proxyResponse && (407 == CFHTTPMessageGetResponseStatusCode(proxyResponse.get()))) {
+                    addCONNECTCredentials(proxyResponse.get());
+                    return;
+                }
+            }
+        } else if (m_connectingSubstate == WaitingForCredentials)
+            break;
+
+        if (m_connectingSubstate == WaitingForConnect) {
+            m_connectingSubstate = Connected;
+            m_state = Open;
+
+            RefPtr<SocketStreamHandle> protect(this); // The client can close the handle, potentially removing the last reference.
+            m_client->didOpen(this);
+            if (m_state == Closed)
+                break;
+            // Fall through.
+        } else if (m_state == Closed)
+            break;
+
+        ASSERT(m_state == Open);
+        ASSERT(m_connectingSubstate == Connected);
+
+        CFIndex length;
+        UInt8 localBuffer[1024]; // Used if CFReadStreamGetBuffer couldn't return anything.
+        const UInt8* ptr = CFReadStreamGetBuffer(m_readStream.get(), 0, &length);
+        if (!ptr) {
+            length = CFReadStreamRead(m_readStream.get(), localBuffer, sizeof(localBuffer));
+            ptr = localBuffer;
+        }
+
+        m_client->didReceiveData(this, reinterpret_cast<const char*>(ptr), length);
+
+        break;
+    }
+    case kCFStreamEventCanAcceptBytes:
+        ASSERT_NOT_REACHED();
+        break;
+    case kCFStreamEventErrorOccurred: {
+        CFStreamError error = CFReadStreamGetError(m_readStream.get());
+        m_client->didFail(this, SocketStreamError(error.error)); // FIXME: Provide a sensible error.
+        break;
+    }
+    case kCFStreamEventEndEncountered:
+        platformClose();
+        break;
+    }
+}
+
+void SocketStreamHandle::writeStreamCallback(CFStreamEventType type)
+{
+    switch(type) {
+    case kCFStreamEventNone:
+        break;
+    case kCFStreamEventOpenCompleted:
+        break;
+    case kCFStreamEventHasBytesAvailable:
+        ASSERT_NOT_REACHED();
+        break;
+    case kCFStreamEventCanAcceptBytes: {
+        // Possibly, a spurious event from CONNECT handshake.
+        if (!CFWriteStreamCanAcceptBytes(m_writeStream.get()))
+            return;
+
+        if (m_connectingSubstate == WaitingForCredentials)
+            break;
+
+        if (m_connectingSubstate == WaitingForConnect) {
+            m_connectingSubstate = Connected;
+            m_state = Open;
+
+            RefPtr<SocketStreamHandle> protect(this); // The client can close the handle, potentially removing the last reference.
+            m_client->didOpen(this);
+            break;
+        }
+
+        ASSERT(m_state = Open);
+        ASSERT(m_connectingSubstate == Connected);
+
+        sendPendingData();
+        break;
+    }
+    case kCFStreamEventErrorOccurred: {
+        CFStreamError error = CFWriteStreamGetError(m_writeStream.get());
+        m_client->didFail(this, SocketStreamError(error.error)); // FIXME: Provide a sensible error.
+        break;
+    }
+    case kCFStreamEventEndEncountered:
+        // FIXME: Currently, we handle closing in read callback, but these can come independently (e.g. a server can stop listening, but keep sending data).
+        break;
+    }
 }
 
 SocketStreamHandle::~SocketStreamHandle()
 {
-    LOG(Network, "SocketStreamHandle %p delete", this);
-    setClient(0);
-    notImplemented();
+    LOG(Network, "SocketStreamHandle %p dtor", this);
+
+#ifndef BUILDING_ON_TIGER
+    ASSERT(!m_pacRunLoopSource);
+#endif
 }
 
-int SocketStreamHandle::platformSend(const char*, int)
+int SocketStreamHandle::platformSend(const char* data, int length)
 {
-    LOG(Network, "SocketStreamHandle %p platformSend", this);
-    notImplemented();
-    return 0;
+    if (!CFWriteStreamCanAcceptBytes(m_writeStream.get()))
+        return 0;
+
+    return CFWriteStreamWrite(m_writeStream.get(), reinterpret_cast<const UInt8*>(data), length);
 }
 
 void SocketStreamHandle::platformClose()
 {
     LOG(Network, "SocketStreamHandle %p platformClose", this);
-    notImplemented();
-}
 
-void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
-{
-    notImplemented();
+#ifndef BUILDING_ON_TIGER
+    if (m_pacRunLoopSource) 
+        removePACRunLoopSource();
+#endif
+
+    ASSERT(!m_readStream == !m_writeStream);
+    if (!m_readStream)
+        return;
+
+    CFReadStreamUnscheduleFromRunLoop(m_readStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+    CFWriteStreamUnscheduleFromRunLoop(m_writeStream.get(), CFRunLoopGetCurrent(), kCFRunLoopCommonModes);
+
+    CFReadStreamClose(m_readStream.get());
+    CFWriteStreamClose(m_writeStream.get());
+    
+    m_readStream = 0;
+    m_writeStream = 0;
+
+    m_client->didClose(this);
 }
 
 void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
 {
-    notImplemented();
 }
 
 void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
 {
-    notImplemented();
 }
 
 void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
 {
-    notImplemented();
 }
 
 }  // namespace WebCore
diff --git a/WebCore/platform/network/chromium/AuthenticationChallenge.h b/WebCore/platform/network/chromium/AuthenticationChallenge.h
index cd1b430..e2d1f42 100644
--- a/WebCore/platform/network/chromium/AuthenticationChallenge.h
+++ b/WebCore/platform/network/chromium/AuthenticationChallenge.h
@@ -28,25 +28,23 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-    class ResourceHandle;
-
     class AuthenticationChallenge : public AuthenticationChallengeBase {
     public:
         AuthenticationChallenge() {}
         AuthenticationChallenge(const ProtectionSpace&, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse&, const ResourceError&);
 
-        ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
+        AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
 
     private:
         friend class AuthenticationChallengeBase;
         static bool platformCompare(const AuthenticationChallenge&, const AuthenticationChallenge&);
 
-        RefPtr<ResourceHandle> m_sourceHandle;
+        RefPtr<AuthenticationClient> m_authenticationClient;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/CookieJarChromium.cpp b/WebCore/platform/network/chromium/CookieJarChromium.cpp
index 7862cc3..279d9b0 100644
--- a/WebCore/platform/network/chromium/CookieJarChromium.cpp
+++ b/WebCore/platform/network/chromium/CookieJarChromium.cpp
@@ -53,16 +53,14 @@ bool cookiesEnabled(const Document*)
     return true;
 }
 
-bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+bool getRawCookies(const Document* document, const KURL& url, Vector<Cookie>& rawCookies)
 {
-    // FIXME: Not yet implemented
-    rawCookies.clear();
-    return false; // return true when implemented
+    return ChromiumBridge::rawCookies(url, document->firstPartyForCookies(), &rawCookies);
 }
 
-void deleteCookie(const Document*, const KURL&, const String&)
+void deleteCookie(const Document*, const KURL& url, const String& cookieName)
 {
-    // FIXME: Not yet implemented
+    return ChromiumBridge::deleteCookie(url, cookieName);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceRequest.cpp b/WebCore/platform/network/chromium/ResourceRequest.cpp
index 76d1288..5b27c1b 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.cpp
+++ b/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -23,6 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
+#include "ResourceRequest.h"
+
 namespace WebCore {
 
 // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index 48ff1e7..176f923 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -35,22 +35,13 @@ namespace WebCore {
 
     class Frame;
 
-    struct ResourceRequest : public ResourceRequestBase {
+    class ResourceRequest : public ResourceRequestBase {
     public:
-        enum TargetType {
-            TargetIsMainFrame,
-            TargetIsSubFrame,
-            TargetIsSubResource,
-            TargetIsObject,
-            TargetIsMedia
-        };
-
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -59,7 +50,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
             , m_securityInfo(securityInfo)
         {
         }
@@ -69,7 +59,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -78,7 +67,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
             setHTTPReferrer(referrer);
         }
@@ -88,7 +76,6 @@ namespace WebCore {
             , m_requestorID(0)
             , m_requestorProcessID(0)
             , m_appCacheHostID(0)
-            , m_targetType(TargetIsSubResource)
         {
         }
 
@@ -96,10 +83,6 @@ namespace WebCore {
         int requestorID() const { return m_requestorID; }
         void setRequestorID(int requestorID) { m_requestorID = requestorID; }
 
-        // What this request is for.
-        TargetType targetType() const { return m_targetType; }
-        void setTargetType(TargetType type) { m_targetType = type; }
-
         // The process id of the process from which this request originated. In
         // the case of out-of-process plugins, this allows to link back the
         // request to the plugin process (as it is processed through a render
@@ -129,7 +112,6 @@ namespace WebCore {
         int m_requestorID;
         int m_requestorProcessID;
         int m_appCacheHostID;
-        TargetType m_targetType;
         CString m_securityInfo;
     };
 
diff --git a/WebCore/platform/network/curl/AuthenticationChallenge.h b/WebCore/platform/network/curl/AuthenticationChallenge.h
index a64d575..7ace096 100644
--- a/WebCore/platform/network/curl/AuthenticationChallenge.h
+++ b/WebCore/platform/network/curl/AuthenticationChallenge.h
@@ -26,13 +26,11 @@
 #define AuthenticationChallenge_h
 
 #include "AuthenticationChallengeBase.h"
-#include "ResourceHandle.h"
+#include "AuthenticationClient.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-class ResourceHandle;
-
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
     AuthenticationChallenge()
@@ -44,9 +42,9 @@ public:
     {
     }
 
-    ResourceHandle* sourceHandle() const { return m_sourceHandle.get(); }
+    AuthenticationClient* authenticationClient() const { return m_authenticationClient.get(); }
 
-    RefPtr<ResourceHandle> m_sourceHandle;    
+    RefPtr<AuthenticationClient> m_authenticationClient;
 };
 
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index d8a812f..a006a14 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -49,6 +49,11 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
+#if !PLATFORM(WIN_OS)
+#include <sys/param.h>
+#define MAX_PATH MAXPATHLEN
+#endif
+
 namespace WebCore {
 
 const int selectTimeoutMS = 5;
diff --git a/WebCore/platform/network/curl/ResourceRequest.h b/WebCore/platform/network/curl/ResourceRequest.h
index 3fa2795..40e1e8f 100644
--- a/WebCore/platform/network/curl/ResourceRequest.h
+++ b/WebCore/platform/network/curl/ResourceRequest.h
@@ -33,8 +33,8 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url)
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
diff --git a/WebCore/platform/network/mac/AuthenticationChallenge.h b/WebCore/platform/network/mac/AuthenticationChallenge.h
index e8f3a2d..d74a92c 100644
--- a/WebCore/platform/network/mac/AuthenticationChallenge.h
+++ b/WebCore/platform/network/mac/AuthenticationChallenge.h
@@ -37,21 +37,25 @@ class NSURLAuthenticationChallenge;
 
 namespace WebCore {
 
+class AuthenticationClient;
+
 class AuthenticationChallenge : public AuthenticationChallengeBase {
 public:
-    AuthenticationChallenge() {}
+    AuthenticationChallenge() { }
     AuthenticationChallenge(const ProtectionSpace& protectionSpace, const Credential& proposedCredential, unsigned previousFailureCount, const ResourceResponse& response, const ResourceError& error);
     AuthenticationChallenge(NSURLAuthenticationChallenge *);
 
     id sender() const { return m_sender.get(); }
-    NSURLAuthenticationChallenge *nsURLAuthenticationChallenge() const { return m_macChallenge.get(); }
+    NSURLAuthenticationChallenge *nsURLAuthenticationChallenge() const { return m_nsChallenge.get(); }
+
+    void setAuthenticationClient(AuthenticationClient*); // Changes sender to one that invokes client methods.
 
 private:
     friend class AuthenticationChallengeBase;
     static bool platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b);
 
-    RetainPtr<id> m_sender;
-    RetainPtr<NSURLAuthenticationChallenge *> m_macChallenge;
+    RetainPtr<id> m_sender; // Always the same as [m_macChallenge.get() sender], cached here for performance.
+    RetainPtr<NSURLAuthenticationChallenge *> m_nsChallenge;
 };
 
 }
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 93725d5..ea06ecd 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -26,6 +26,7 @@
 #import "AuthenticationMac.h"
 
 #import "AuthenticationChallenge.h"
+#import "AuthenticationClient.h"
 #import "Credential.h"
 #import "ProtectionSpace.h"
 
@@ -33,6 +34,51 @@
 #import <Foundation/NSURLCredential.h>
 #import <Foundation/NSURLProtectionSpace.h>
 
+using namespace WebCore;
+
+@interface WebCoreAuthenticationClientAsChallengeSender : NSObject <NSURLAuthenticationChallengeSender>
+{
+    AuthenticationClient* m_client;
+}
+- (id)initWithAuthenticationClient:(AuthenticationClient*)client;
+- (void)detachClient;
+@end
+
+@implementation WebCoreAuthenticationClientAsChallengeSender
+
+- (id)initWithAuthenticationClient:(AuthenticationClient*)client
+{
+    self = [self init];
+    if (!self)
+        return nil;
+    m_client = client;
+    return self;
+}
+
+- (void)detachClient
+{
+    m_client = 0;
+}
+
+- (void)useCredential:(NSURLCredential *)credential forAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedCredential(core(challenge), core(credential));
+}
+
+- (void)continueWithoutCredentialForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedRequestToContinueWithoutCredential(core(challenge));
+}
+
+- (void)cancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+{
+    if (m_client)
+        m_client->receivedCancellation(core(challenge));
+}
+
+@end
 
 namespace WebCore {
 
@@ -49,17 +95,28 @@ AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protecti
 {
 }
 
-AuthenticationChallenge::AuthenticationChallenge(NSURLAuthenticationChallenge *macChallenge)
-    : AuthenticationChallengeBase(core([macChallenge protectionSpace]),
-                                  core([macChallenge proposedCredential]),
-                                  [macChallenge previousFailureCount],
-                                  [macChallenge failureResponse],
-                                  [macChallenge error])
-    , m_sender([macChallenge sender])
-    , m_macChallenge(macChallenge)
+AuthenticationChallenge::AuthenticationChallenge(NSURLAuthenticationChallenge *challenge)
+    : AuthenticationChallengeBase(core([challenge protectionSpace]),
+                                  core([challenge proposedCredential]),
+                                  [challenge previousFailureCount],
+                                  [challenge failureResponse],
+                                  [challenge error])
+    , m_sender([challenge sender])
+    , m_nsChallenge(challenge)
 {
 }
 
+void AuthenticationChallenge::setAuthenticationClient(AuthenticationClient* client)
+{
+    if (client) {
+        m_sender.adoptNS([[WebCoreAuthenticationClientAsChallengeSender alloc] initWithAuthenticationClient:client]);
+        m_nsChallenge.adoptNS([[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:m_nsChallenge.get() sender:m_sender.get()]);
+    } else {
+        if ([m_sender.get() isMemberOfClass:[WebCoreAuthenticationClientAsChallengeSender class]])
+            [(WebCoreAuthenticationClientAsChallengeSender *)m_sender.get() detachClient];
+    }
+}
+
 bool AuthenticationChallenge::platformCompare(const AuthenticationChallenge& a, const AuthenticationChallenge& b)
 {
     if (a.sender() != b.sender())
@@ -131,6 +188,11 @@ NSURLProtectionSpace *mac(const ProtectionSpace& coreSpace)
         case ProtectionSpaceAuthenticationSchemeHTMLForm:
             method = NSURLAuthenticationMethodHTMLForm;
             break;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        case ProtectionSpaceAuthenticationSchemeNTLM:
+            method = NSURLAuthenticationMethodNTLM;
+            break;
+#endif
         default:
             ASSERT_NOT_REACHED();
     }
@@ -167,6 +229,15 @@ NSURLCredential *mac(const Credential& coreCredential)
             ASSERT_NOT_REACHED();
     }
 
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    if (coreCredential.type() == CredentialTypeClientCertificate) {
+        return [[[NSURLCredential alloc] initWithIdentity:coreCredential.identity()
+                                             certificates:(NSArray *)coreCredential.certificates()
+                                              persistence:persistence]
+                                              autorelease];
+    }
+#endif
+
     return [[[NSURLCredential alloc] initWithUser:coreCredential.user()
                                         password:coreCredential.password()
                                      persistence:persistence]
@@ -218,6 +289,10 @@ ProtectionSpace core(NSURLProtectionSpace *macSpace)
         scheme = ProtectionSpaceAuthenticationSchemeHTTPDigest;
     else if ([method isEqualToString:NSURLAuthenticationMethodHTMLForm])
         scheme = ProtectionSpaceAuthenticationSchemeHTMLForm;
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    else if ([method isEqualToString:NSURLAuthenticationMethodNTLM])
+        scheme = ProtectionSpaceAuthenticationSchemeNTLM;
+#endif
     else
         ASSERT_NOT_REACHED();
         
@@ -240,6 +315,12 @@ Credential core(NSURLCredential *macCredential)
         default:
             ASSERT_NOT_REACHED();
     }
+
+#if CERTIFICATE_CREDENTIALS_SUPPORTED
+    SecIdentityRef identity = [macCredential identity];
+    if (identity)
+        return Credential(identity, (CFArrayRef)[macCredential certificates], persistence);
+#endif
     
     return Credential([macCredential user], [macCredential password], persistence);
 }
diff --git a/WebCore/platform/network/mac/CredentialStorageMac.mm b/WebCore/platform/network/mac/CredentialStorageMac.mm
new file mode 100644
index 0000000..66e94e9
--- /dev/null
+++ b/WebCore/platform/network/mac/CredentialStorageMac.mm
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "AuthenticationMac.h"
+#include "Credential.h"
+
+namespace WebCore {
+
+Credential CredentialStorage::getFromPersistentStorage(const ProtectionSpace& protectionSpace)
+{
+    NSURLCredential *credential = [[NSURLCredentialStorage sharedCredentialStorage] defaultCredentialForProtectionSpace:mac(protectionSpace)];
+    return credential ? core(credential) : Credential();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp b/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
index c0918a4..2045eb3 100644
--- a/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
+++ b/WebCore/platform/network/mac/NetworkStateNotifierMac.cpp
@@ -28,10 +28,10 @@
 
 #include <SystemConfiguration/SystemConfiguration.h>
 
-#ifdef BUILDING_ON_TIGER
-// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger.
-extern "C" CFRunLoopRef CFRunLoopGetMain();
-#endif
+#ifdef BUILDING_ON_TIGER 
+// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger. 
+extern "C" CFRunLoopRef CFRunLoopGetMain(); 
+#endif 
 
 namespace WebCore {
 
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index 3630b30..360425e 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -55,7 +55,7 @@ typedef int NSInteger;
 
 using namespace WebCore;
 
-@interface WebCoreResourceHandleAsDelegate : NSObject <NSURLAuthenticationChallengeSender>
+@interface WebCoreResourceHandleAsDelegate : NSObject
 {
     ResourceHandle* m_handle;
 }
@@ -138,6 +138,7 @@ ResourceHandleInternal::~ResourceHandleInternal()
 ResourceHandle::~ResourceHandle()
 {
     releaseDelegate();
+    d->m_currentWebChallenge.setAuthenticationClient(0);
 
     LOG(Network, "Handle %p destroyed", this);
 }
@@ -511,10 +512,8 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
 #endif
 
     d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
-    NSURLAuthenticationChallenge *webChallenge = [[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:d->m_currentMacChallenge 
-                                                                                       sender:(id<NSURLAuthenticationChallengeSender>)delegate()];
-    d->m_currentWebChallenge = core(webChallenge);
-    [webChallenge release];
+    d->m_currentWebChallenge = core(d->m_currentMacChallenge);
+    d->m_currentWebChallenge.setAuthenticationClient(this);
 
     if (client())
         client()->didReceiveAuthenticationChallenge(this, d->m_currentWebChallenge);
@@ -523,8 +522,8 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
 void ResourceHandle::didCancelAuthenticationChallenge(const AuthenticationChallenge& challenge)
 {
     ASSERT(d->m_currentMacChallenge);
+    ASSERT(d->m_currentMacChallenge == challenge.nsURLAuthenticationChallenge());
     ASSERT(!d->m_currentWebChallenge.isNull());
-    ASSERT(d->m_currentWebChallenge == challenge);
 
     if (client())
         client()->didCancelAuthenticationChallenge(this, challenge);
@@ -547,7 +546,7 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // Manage per-session credentials internally, because once NSURLCredentialPersistenceForSession is used, there is no way
         // to ignore it for a particular request (short of removing it altogether).
         // <rdar://problem/6867598> gallery.me.com is temporarily whitelisted, so that QuickTime plug-in could see the credentials.
-        Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
+        Credential webCredential(credential, CredentialPersistenceNone);
         KURL urlToStore;
         if (challenge.failureResponse().httpStatusCode() == 401)
             urlToStore = d->m_request.url();
@@ -868,27 +867,6 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     return newResponse;
 }
 
-- (void)useCredential:(NSURLCredential *)credential forAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedCredential(core(challenge), core(credential));
-}
-
-- (void)continueWithoutCredentialForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedRequestToContinueWithoutCredential(core(challenge));
-}
-
-- (void)cancelAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
-{
-    if (!m_handle)
-        return;
-    m_handle->receivedCancellation(core(challenge));
-}
-
 @end
 
 #ifndef BUILDING_ON_TIGER
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index ed5e024..f7bbb9d 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -21,8 +21,6 @@
 #include "config.h"
 #include "QNetworkReplyHandler.h"
 
-#if QT_VERSION >= 0x040400
-
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
 #include "ResourceHandle.h"
@@ -140,10 +138,14 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
         m_method = QNetworkAccessManager::PostOperation;
     else if (r.httpMethod() == "PUT")
         m_method = QNetworkAccessManager::PutOperation;
+#if QT_VERSION >= 0x040600
+    else if (r.httpMethod() == "DELETE")
+        m_method = QNetworkAccessManager::DeleteOperation;
+#endif
     else
         m_method = QNetworkAccessManager::UnknownOperation;
 
-    m_request = r.toNetworkRequest();
+    m_request = r.toNetworkRequest(m_resourceHandle->getInternal()->m_frame);
 
     if (m_loadMode == LoadNormal)
         start();
@@ -255,7 +257,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
-    if (m_reply->error())
+    if (m_reply->error() && !ignoreHttpError(m_reply, m_responseDataSent))
         return;
 
     if (m_responseSent || !m_resourceHandle)
@@ -305,9 +307,15 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
         // Add remaining headers.
+#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
+        foreach (const QNetworkReply::RawHeaderPair& pair, m_reply->rawHeaderPairs()) {
+            response.setHTTPHeaderField(QString::fromAscii(pair.first), QString::fromAscii(pair.second));
+        }
+#else
         foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
             response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
         }
+#endif
     }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
@@ -321,12 +329,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
             newRequest.setHTTPMethod("GET");
         }
 
+        // Should not set Referer after a redirect from a secure resource to non-secure one.
+        if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
+            newRequest.clearHTTPReferrer();
+
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
-        m_request = newRequest.toNetworkRequest();
-
-        ResourceHandleInternal* d = m_resourceHandle->getInternal();
-        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        m_request = newRequest.toNetworkRequest(m_resourceHandle->getInternal()->m_frame);
         return;
     }
 
@@ -368,8 +377,6 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
-    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
-
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
@@ -398,6 +405,12 @@ void QNetworkReplyHandler::start()
             putDevice->setParent(m_reply);
             break;
         }
+#if QT_VERSION >= 0x040600
+        case QNetworkAccessManager::DeleteOperation: {
+            m_reply = manager->deleteResource(m_request);
+            break;
+        }
+#endif
         case QNetworkAccessManager::UnknownOperation: {
             m_reply = 0;
             ResourceHandleClient* client = m_resourceHandle->client();
@@ -461,5 +474,3 @@ void QNetworkReplyHandler::sendQueuedItems()
 }
 
 #include "moc_QNetworkReplyHandler.cpp"
-
-#endif
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index fccc4a6..2171083 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -21,8 +21,6 @@
 
 #include <QObject>
 
-#if QT_VERSION >= 0x040400
-
 #include <QNetworkRequest>
 #include <QNetworkAccessManager>
 
@@ -113,6 +111,4 @@ private:
 
 }
 
-#endif
-
 #endif // QNETWORKREPLYHANDLER_H
diff --git a/WebCore/platform/network/qt/ResourceHandleQt.cpp b/WebCore/platform/network/qt/ResourceHandleQt.cpp
index f4c30c9..09cdefd 100644
--- a/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -48,13 +48,9 @@
 #endif
 #include <QCoreApplication>
 #include <QUrl>
-#if QT_VERSION >= 0x040400
 #include <QNetworkAccessManager>
 #include <QNetworkRequest>
 #include <QNetworkReply>
-#else
-#include "qwebnetworkinterface_p.h"
-#endif
 
 namespace WebCore {
 
@@ -131,24 +127,25 @@ bool ResourceHandle::start(Frame* frame)
     if (!page)
         return false;
 
+    if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
+        // If credentials were specified for this request, add them to the url,
+        // so that they will be passed to QNetworkRequest.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
+
     getInternal()->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
-#if QT_VERSION < 0x040400
-    return QWebNetworkManager::self()->add(this, getInternal()->m_frame->page()->d->networkInterface);
-#else
     ResourceHandleInternal *d = getInternal();
     d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::LoadMode(d->m_defersLoading));
     return true;
-#endif
 }
 
 void ResourceHandle::cancel()
 {
-#if QT_VERSION < 0x040400
-    QWebNetworkManager::self()->cancel(this);
-#else
     if (d->m_job)
         d->m_job->abort();
-#endif
 }
 
 bool ResourceHandle::loadsBlocked()
@@ -196,17 +193,17 @@ void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, S
     WebCoreSynchronousLoader syncLoader;
     ResourceHandle handle(request, &syncLoader, true, false, true);
 
-#if QT_VERSION < 0x040400
-    if (!QWebNetworkManager::self()->add(&handle, QWebNetworkInterface::defaultInterface(), QWebNetworkManager::SynchronousJob)) {
-        // FIXME Create a sane ResourceError
-        error = ResourceError(String(), -1, String(), String());
-        return;
-    }
-#else
     ResourceHandleInternal *d = handle.getInternal();
+    if (!(d->m_user.isEmpty() || d->m_pass.isEmpty())) {
+        // If credentials were specified for this request, add them to the url,
+        // so that they will be passed to QNetworkRequest.
+        KURL urlWithCredentials(d->m_request.url());
+        urlWithCredentials.setUser(d->m_user);
+        urlWithCredentials.setPass(d->m_pass);
+        d->m_request.setURL(urlWithCredentials);
+    }
     d->m_frame = static_cast<FrameLoaderClientQt*>(frame->loader()->client())->webFrame();
     d->m_job = new QNetworkReplyHandler(&handle, QNetworkReplyHandler::LoadNormal);
-#endif
 
     syncLoader.waitForCompletion();
     error = syncLoader.resourceError();
@@ -219,10 +216,8 @@ void ResourceHandle::setDefersLoading(bool defers)
 {
     d->m_defersLoading = defers;
 
-#if QT_VERSION >= 0x040400
     if (d->m_job)
         d->m_job->setLoadMode(QNetworkReplyHandler::LoadMode(defers));
-#endif
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/qt/ResourceRequest.h b/WebCore/platform/network/qt/ResourceRequest.h
index 93dacf3..fb69326 100644
--- a/WebCore/platform/network/qt/ResourceRequest.h
+++ b/WebCore/platform/network/qt/ResourceRequest.h
@@ -31,12 +31,13 @@
 
 QT_BEGIN_NAMESPACE
 class QNetworkRequest;
+class QObject;
 QT_END_NAMESPACE
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url) 
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -58,9 +59,7 @@ namespace WebCore {
         {
         }
 
-#if QT_VERSION >= 0x040400
-        QNetworkRequest toNetworkRequest() const;
-#endif
+        QNetworkRequest toNetworkRequest(QObject* originatingObject) const;
 
     private:
         friend class ResourceRequestBase;
diff --git a/WebCore/platform/network/qt/ResourceRequestQt.cpp b/WebCore/platform/network/qt/ResourceRequestQt.cpp
index c8f6ad5..752abfe 100644
--- a/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -21,24 +21,31 @@
 #include "ResourceRequest.h"
 
 #include <qglobal.h>
-#if QT_VERSION >= 0x040400
 
 #include <QNetworkRequest>
 #include <QUrl>
 
 namespace WebCore {
 
-QNetworkRequest ResourceRequest::toNetworkRequest() const
+QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) const
 {
     QNetworkRequest request;
     request.setUrl(url());
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+    request.setOriginatingObject(originatingFrame);
+#endif
 
     const HTTPHeaderMap &headers = httpHeaderFields();
     for (HTTPHeaderMap::const_iterator it = headers.begin(), end = headers.end();
          it != end; ++it) {
         QByteArray name = QString(it->first).toAscii();
         QByteArray value = QString(it->second).toAscii();
-        request.setRawHeader(name, value);
+        // QNetworkRequest::setRawHeader() would remove the header if the value is null
+        // Make sure to set an empty header instead of null header.
+        if (!value.isNull())
+            request.setRawHeader(name, value);
+        else
+            request.setRawHeader(name, "");
     }
 
     switch (cachePolicy()) {
@@ -62,4 +69,3 @@ QNetworkRequest ResourceRequest::toNetworkRequest() const
 
 }
 
-#endif
diff --git a/WebCore/platform/network/soup/DNSSoup.cpp b/WebCore/platform/network/soup/DNSSoup.cpp
index 1ffe1a0..ce55143 100644
--- a/WebCore/platform/network/soup/DNSSoup.cpp
+++ b/WebCore/platform/network/soup/DNSSoup.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +27,19 @@
 #include "config.h"
 #include "DNS.h"
 
-#include "NotImplemented.h"
+#include "CString.h"
+#include "ResourceHandle.h"
 
 namespace WebCore {
 
 void prefetchDNS(const String& hostname)
 {
-    notImplemented();
+    #ifdef HAVE_LIBSOUP_2_29_3
+    String uri = "http://"+hostname;
+    SoupURI* soupUri = soup_uri_new(uri.utf8().data());
+    soup_session_prepare_for_uri(ResourceHandle::defaultSession(), soupUri);
+    soup_uri_free(soupUri);
+    #endif
 }
 
 }
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 2177bd2..6367a3e 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -200,6 +200,13 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     request.setURL(newURL);
     request.setHTTPMethod(msg->method);
     fillResponseFromMessage(msg, &response);
+
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https")) {
+        request.clearHTTPReferrer();
+        soup_message_headers_remove(msg->request_headers, "Referer");
+    }
+
     if (d->client())
         d->client()->willSendRequest(handle, request, response);
 }
@@ -686,6 +693,13 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 
     g_input_stream_close_finish(d->m_inputStream, res, 0);
     cleanupGioOperation(handle.get());
+
+    // The load may have been cancelled, the client may have been
+    // destroyed already. In such cases calling didFinishLoading is a
+    // bad idea.
+    if (d->m_cancelled || !client)
+        return;
+
     client->didFinishLoading(handle.get());
 }
 
@@ -866,7 +880,7 @@ static bool startGio(ResourceHandle* handle, KURL url)
     // using GIO internally, and providing URIs instead of file paths
     url.removeFragmentIdentifier();
     url.setQuery(String());
-    url.setPort(0);
+    url.removePort();
 
 #if !PLATFORM(WIN_OS)
     // we avoid the escaping for local files, because
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index 42b7baa..8270863 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -33,8 +33,8 @@
 
 namespace WebCore {
 
-    struct ResourceRequest : ResourceRequestBase {
-
+    class ResourceRequest : public ResourceRequestBase {
+    public:
         ResourceRequest(const String& url)
             : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
@@ -66,7 +66,7 @@ namespace WebCore {
         void updateFromSoupMessage(SoupMessage* soupMessage);
 
     private:
-        friend struct ResourceRequestBase;
+        friend class ResourceRequestBase;
 
         void doUpdatePlatformRequest() {};
         void doUpdateResourceRequest() {};
diff --git a/WebCore/platform/network/soup/ResourceResponse.h b/WebCore/platform/network/soup/ResourceResponse.h
index 5fa31a0..ecd9f21 100644
--- a/WebCore/platform/network/soup/ResourceResponse.h
+++ b/WebCore/platform/network/soup/ResourceResponse.h
@@ -44,7 +44,14 @@ public:
     {
     }
 
+    ResourceResponse(SoupMessage* soupMessage)
+        : ResourceResponseBase()
+    {
+        updateFromSoupMessage(soupMessage);
+    }
+
     SoupMessage* toSoupMessage() const;
+    void updateFromSoupMessage(SoupMessage* soupMessage);
 
 private:
     friend class ResourceResponseBase;
diff --git a/WebCore/platform/network/soup/ResourceResponseSoup.cpp b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
index 293577f..caf0b31 100644
--- a/WebCore/platform/network/soup/ResourceResponseSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
@@ -22,6 +22,7 @@
 #include "ResourceResponse.h"
 
 #include "CString.h"
+#include "GOwnPtr.h"
 #include "PlatformString.h"
 
 using namespace std;
@@ -49,4 +50,21 @@ SoupMessage* ResourceResponse::toSoupMessage() const
     return soupMessage;
 }
 
+void ResourceResponse::updateFromSoupMessage(SoupMessage* soupMessage)
+{
+    SoupURI* soupURI = soup_message_get_uri(soupMessage);
+    GOwnPtr<gchar> uri(soup_uri_to_string(soupURI, FALSE));
+    m_url = KURL(KURL(), String::fromUTF8(uri.get()));
+
+    m_httpStatusCode = soupMessage->status_code;
+
+    SoupMessageHeadersIter headersIter;
+    const char* headerName;
+    const char* headerValue;
+
+    soup_message_headers_iter_init(&headersIter, soupMessage->response_headers);
+    while (soup_message_headers_iter_next(&headersIter, &headerName, &headerValue))
+        m_httpHeaderFields.set(String::fromUTF8(headerName), String::fromUTF8(headerValue));
+}
+
 }
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 9d2c452..f9940a6 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -95,21 +95,7 @@ void ClipboardQt::clearData(const String& type)
         return;
 
     if (m_writableData) {
-#if QT_VERSION >= 0x040400
         m_writableData->removeFormat(type);
-#else
-        const QString toClearType = type;
-        QMap<QString, QByteArray> formats;
-        foreach (QString format, m_writableData->formats()) {
-            if (format != toClearType)
-                formats[format] = m_writableData->data(format);
-        }
-
-        m_writableData->clear();
-        QMap<QString, QByteArray>::const_iterator it, end = formats.constEnd();
-        for (it = formats.begin(); it != end; ++it)
-            m_writableData->setData(it.key(), it.value());
-#endif
         if (m_writableData->formats().isEmpty()) {
             if (isForDragging())
                 delete m_writableData;
diff --git a/WebCore/platform/qt/CookieJarQt.cpp b/WebCore/platform/qt/CookieJarQt.cpp
index a27a06e..b621e7e 100644
--- a/WebCore/platform/qt/CookieJarQt.cpp
+++ b/WebCore/platform/qt/CookieJarQt.cpp
@@ -33,19 +33,14 @@
 #include "KURL.h"
 #include "PlatformString.h"
 
-#if QT_VERSION >= 0x040400
 #include "qwebpage.h"
 #include "qwebframe.h"
 #include "FrameLoaderClientQt.h"
 #include <QNetworkAccessManager>
 #include <QNetworkCookie>
-#else
-#include <qcookiejar.h>
-#endif
 
 namespace WebCore {
 
-#if QT_VERSION >= 0x040400
 static QNetworkCookieJar *cookieJar(const Document *document)
 {
     if (!document)
@@ -62,13 +57,11 @@ static QNetworkCookieJar *cookieJar(const Document *document)
     QNetworkCookieJar* jar = manager->cookieJar();
     return jar;
 }
-#endif
 
 void setCookies(Document* document, const KURL& url, const String& value)
 {
     QUrl u(url);
     QUrl p(document->firstPartyForCookies());
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return;
@@ -84,15 +77,11 @@ void setCookies(Document* document, const KURL& url, const String& value)
     }
 #endif
     jar->setCookiesFromUrl(cookies, u);
-#else
-    QCookieJar::cookieJar()->setCookies(u, p, (QString)value);
-#endif
 }
 
 String cookies(const Document* document, const KURL& url)
 {
     QUrl u(url);
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     if (!jar)
         return String();
@@ -112,23 +101,12 @@ String cookies(const Document* document, const KURL& url)
     }
 
     return resultCookies.join(QLatin1String("; "));
-#else
-    QString cookies = QCookieJar::cookieJar()->cookies(u);
-    int idx = cookies.indexOf(QLatin1Char(';'));
-    if (idx > 0)
-        cookies = cookies.left(idx);
-    return cookies;
-#endif
 }
 
 bool cookiesEnabled(const Document* document)
 {
-#if QT_VERSION >= 0x040400
     QNetworkCookieJar* jar = cookieJar(document);
     return (jar != 0);
-#else
-    return QCookieJar::cookieJar()->isEnabled();
-#endif
 }
 
 bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
diff --git a/WebCore/platform/qt/CursorQt.cpp b/WebCore/platform/qt/CursorQt.cpp
index 3fc83f9..87f4fce 100644
--- a/WebCore/platform/qt/CursorQt.cpp
+++ b/WebCore/platform/qt/CursorQt.cpp
@@ -73,7 +73,7 @@ Cursor& Cursor::operator=(const Cursor& other)
 namespace {
 
 // FIXME: static deleter
-class Cursors {
+class Cursors : public Noncopyable {
 protected:
     Cursors()
 #ifndef QT_NO_CURSOR
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index ca3ca9d..1768502 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -30,6 +30,7 @@
 
 #include "IntSize.h"
 #include "LocalizedStrings.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
 
 #include <QCoreApplication>
@@ -470,5 +471,47 @@ String localizedMediaTimeDescription(float time)
 }
 #endif  // ENABLE(VIDEO)
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 37ea681..f78c7d7 100644
--- a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -52,10 +52,8 @@ static String keyIdentifierForQtKeyCode(int keyCode)
         case Qt::Key_Return:
         case Qt::Key_Enter:
             return "Enter";
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return "Execute";
-#endif
         case Qt::Key_F1:
             return "F1";
         case Qt::Key_F2:
@@ -290,10 +288,8 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
             return VK_SELECT; // (29) SELECT key
         case Qt::Key_Print:
             return VK_PRINT; // (2A) PRINT key
-#if QT_VERSION >= 0x040200
         case Qt::Key_Execute:
             return VK_EXECUTE;// (2B) EXECUTE key
-#endif
             //dunno on this
             //case Qt::Key_PrintScreen:
             //      return VK_SNAPSHOT; // (2C) PRINT SCREEN key
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
index 28ef724..b510736 100644
--- a/WebCore/platform/qt/QWebPageClient.h
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -26,13 +26,19 @@
 #ifndef QWebPageClient_h
 #define QWebPageClient_h
 
+#ifndef QT_NO_CURSOR
+#include <QCursor>
+#endif
 #include <QRect>
 
 class QWebPageClient {
 public:
+    virtual ~QWebPageClient() { }
+        
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
     virtual void setInputMethodEnabled(bool enable) = 0;
+    virtual bool inputMethodEnabled() const = 0;
 #if QT_VERSION >= 0x040600
     virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
 #endif
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index b61d356..501a28b 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -45,6 +45,7 @@
 #include "RenderBox.h"
 #include "RenderTheme.h"
 #include "UserAgentStyleSheets.h"
+#include "QWebPageClient.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -757,12 +758,13 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
     if (result == RadioPart || result == CheckboxPart)
         option.state |= (isChecked(o) ? QStyle::State_On : QStyle::State_Off);
 
-    // If the webview has a custom palette, use it
+    // If the owner widget has a custom palette, use it
     Page* page = o->document()->page();
     if (page) {
-        QWidget* view = static_cast<ChromeClientQt*>(page->chrome()->client())->m_webPage->view();
-        if (view)
-            option.palette = view->palette();
+        ChromeClient* client = page->chrome()->client();
+        QWebPageClient* pageClient = client->platformPageClient();
+        if (pageClient)
+            option.palette = pageClient->palette();
     }
 
     return result;
diff --git a/WebCore/platform/qt/WheelEventQt.cpp b/WebCore/platform/qt/WheelEventQt.cpp
index 9cc27ab..162a4f2 100644
--- a/WebCore/platform/qt/WheelEventQt.cpp
+++ b/WebCore/platform/qt/WheelEventQt.cpp
@@ -45,8 +45,10 @@ void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
     // Use the same single scroll step as QTextEdit
     // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
     static const float cDefaultQtScrollStep = 20.f;
+#ifndef QT_NO_WHEELEVENT
     m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
     m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+#endif
 }
 
 PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
diff --git a/WebCore/platform/qt/WidgetQt.cpp b/WebCore/platform/qt/WidgetQt.cpp
index e9c99a4..252bdb4 100644
--- a/WebCore/platform/qt/WidgetQt.cpp
+++ b/WebCore/platform/qt/WidgetQt.cpp
@@ -91,13 +91,17 @@ void Widget::setCursor(const Cursor& cursor)
 
 void Widget::show()
 {
-    if (platformWidget())
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->show();
 }
 
 void Widget::hide()
 {
-    if (platformWidget())
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformWidget())
         platformWidget()->hide();
 }
 
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
index 3cf961f..752c613 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
@@ -58,7 +58,8 @@ int SQLiteFileSystem::openDatabase(const String& fileName, sqlite3** database)
     // open databases using the default VFS
     // in renderers, it should be Chromium's VFS; in the browser process it should be SQLite's default VFS
     return sqlite3_open_v2(fileName.utf8().data(), database,
-                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX, 0);
+                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX,
+                           "chromium_vfs");
 }
 
 String SQLiteFileSystem::getFileNameForNewDatabase(
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
index 2960a5f..0050a43 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
@@ -42,8 +42,11 @@ using namespace WebCore;
 
 // Defined in Chromium's codebase in third_party/sqlite/src/os_unix.c
 extern "C" {
-void initUnixFile(sqlite3_file* file);
-int fillInUnixFile(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+void chromium_sqlite3_initialize_unix_sqlite3_file(sqlite3_file* file);
+int chromium_sqlite3_fill_in_unix_sqlite3_file(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+int chromium_sqlite3_get_reusable_file_handle(sqlite3_file* file, const char* fileName, int flags, int* fd);
+void chromium_sqlite3_update_reusable_file_handle(sqlite3_file* file, int fd, int flags);
+void chromium_sqlite3_destroy_reusable_file_handle(sqlite3_file* file);
 }
 
 // Chromium's Posix implementation of SQLite VFS
@@ -59,18 +62,28 @@ namespace {
 int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
                  sqlite3_file* id, int desiredFlags, int* usedFlags)
 {
-    initUnixFile(id);
+    chromium_sqlite3_initialize_unix_sqlite3_file(id);
+    int fd = -1;
     int dirfd = -1;
-    int fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+    int result = chromium_sqlite3_get_reusable_file_handle(id, fileName, desiredFlags, &fd);
+    if (result != SQLITE_OK)
+        return result;
+
     if (fd < 0) {
-        if (desiredFlags & SQLITE_OPEN_READWRITE) {
+        fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+        if ((fd < 0) && (desiredFlags & SQLITE_OPEN_READWRITE)) {
             int newFlags = (desiredFlags & ~(SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE)) | SQLITE_OPEN_READONLY;
-            return chromiumOpen(vfs, fileName, id, newFlags, usedFlags);
-        } else
-            return SQLITE_CANTOPEN;
+            fd = ChromiumBridge::databaseOpenFile(fileName, newFlags, &dirfd);
+        }
+    }
+    if (fd < 0) {
+        chromium_sqlite3_destroy_reusable_file_handle(id);
+        return SQLITE_CANTOPEN;
     }
+
     if (usedFlags)
         *usedFlags = desiredFlags;
+    chromium_sqlite3_update_reusable_file_handle(id, fd, desiredFlags);
 
     fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
     if (dirfd >= 0)
@@ -79,7 +92,10 @@ int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
     // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
     int fileType = desiredFlags & 0x00007F00;
     int noLock = (fileType != SQLITE_OPEN_MAIN_DB);
-    return fillInUnixFile(vfs, fd, dirfd, id, fileName, noLock);
+    result = chromium_sqlite3_fill_in_unix_sqlite3_file(vfs, fd, dirfd, id, fileName, noLock);
+    if (result != SQLITE_OK)
+        chromium_sqlite3_destroy_reusable_file_handle(id);
+    return result;
 }
 
 // Deletes the given file.
@@ -184,7 +200,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         unix_vfs->xCurrentTime,
         unix_vfs->xGetLastError
     };
-    sqlite3_vfs_register(&chromium_vfs, 1);
+    sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
index 153793b..7b57db1 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
@@ -169,7 +169,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         win32_vfs->xCurrentTime,
         win32_vfs->xGetLastError
     };
-    sqlite3_vfs_register(&chromium_vfs, 1);
+    sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/text/AtomicString.h b/WebCore/platform/text/AtomicString.h
index 8805f4c..47d07c5 100644
--- a/WebCore/platform/text/AtomicString.h
+++ b/WebCore/platform/text/AtomicString.h
@@ -24,6 +24,14 @@
 #include "AtomicStringImpl.h"
 #include "PlatformString.h"
 
+// Define 'NO_IMPLICIT_ATOMICSTRING' before including this header,
+// to disallow (expensive) implicit String-->AtomicString conversions.
+#ifdef NO_IMPLICIT_ATOMICSTRING
+#define ATOMICSTRING_CONVERSION explicit
+#else
+#define ATOMICSTRING_CONVERSION
+#endif
+
 namespace WebCore {
 
 struct AtomicStringHash;
@@ -40,9 +48,9 @@ public:
     AtomicString(const JSC::UString& s) : m_string(add(s)) { }
     AtomicString(const JSC::Identifier& s) : m_string(add(s)) { }
 #endif
-    AtomicString(StringImpl* imp) : m_string(add(imp)) { }
+    ATOMICSTRING_CONVERSION AtomicString(StringImpl* imp) : m_string(add(imp)) { }
     AtomicString(AtomicStringImpl* imp) : m_string(imp) { }
-    AtomicString(const String& s) : m_string(add(s.impl())) { }
+    ATOMICSTRING_CONVERSION AtomicString(const String& s) : m_string(add(s.impl())) { }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     AtomicString(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
@@ -96,7 +104,7 @@ public:
 
     static void remove(StringImpl*);
     
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     AtomicString(CFStringRef s) :  m_string(add(String(s).impl())) { }
     CFStringRef createCFString() const { return m_string.createCFString(); }
 #endif    
diff --git a/WebCore/platform/text/AtomicStringImpl.h b/WebCore/platform/text/AtomicStringImpl.h
index d905afc..ba1c72c 100644
--- a/WebCore/platform/text/AtomicStringImpl.h
+++ b/WebCore/platform/text/AtomicStringImpl.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/platform/text/BidiContext.cpp b/WebCore/platform/text/BidiContext.cpp
index 546571e..59db7bd 100644
--- a/WebCore/platform/text/BidiContext.cpp
+++ b/WebCore/platform/text/BidiContext.cpp
@@ -30,7 +30,7 @@ using namespace WTF::Unicode;
 
 PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
 {
-    ASSERT(direction == level % 2 ? RightToLeft : LeftToRight);
+    ASSERT(direction == (level % 2 ? RightToLeft : LeftToRight));
 
     if (parent)
         return adoptRef(new BidiContext(level, direction, override, parent));
diff --git a/WebCore/platform/text/PlatformString.h b/WebCore/platform/text/PlatformString.h
index 8d19c17..247536a 100644
--- a/WebCore/platform/text/PlatformString.h
+++ b/WebCore/platform/text/PlatformString.h
@@ -41,7 +41,7 @@
 #include <wtf/OwnPtr.h>
 #endif
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -206,7 +206,7 @@ public:
 
     StringImpl* impl() const { return m_impl.get(); }
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     String(CFStringRef);
     CFStringRef createCFString() const;
 #endif
@@ -286,6 +286,11 @@ inline bool equalIgnoringCase(const String& a, const String& b) { return equalIg
 inline bool equalIgnoringCase(const String& a, const char* b) { return equalIgnoringCase(a.impl(), b); }
 inline bool equalIgnoringCase(const char* a, const String& b) { return equalIgnoringCase(a, b.impl()); }
 
+inline bool equalPossiblyIgnoringCase(const String& a, const String& b, bool ignoreCase) 
+{
+    return ignoreCase ? equalIgnoringCase(a, b) : (a == b);
+}
+
 inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
 
 inline bool operator!(const String& str) { return str.isNull(); }
diff --git a/WebCore/platform/text/RegularExpression.h b/WebCore/platform/text/RegularExpression.h
index 3254067..f1611e5 100644
--- a/WebCore/platform/text/RegularExpression.h
+++ b/WebCore/platform/text/RegularExpression.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RegularExpression {
+class RegularExpression : public FastAllocBase {
 public:
     RegularExpression(const String&, TextCaseSensitivity);
     ~RegularExpression();
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index 44582a9..24659a4 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -81,6 +81,9 @@ String::String(const char* str, unsigned length)
 
 void String::append(const String& str)
 {
+    if (str.isEmpty())
+       return;
+
     // FIXME: This is extremely inefficient. So much so that we might want to take this
     // out of String's API. We can make it better by optimizing the case where exactly
     // one String is pointing at this StringImpl, but even then it's going to require a
diff --git a/WebCore/platform/text/StringHash.h b/WebCore/platform/text/StringHash.h
index fc6cb3c..21a478e 100644
--- a/WebCore/platform/text/StringHash.h
+++ b/WebCore/platform/text/StringHash.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,6 +30,10 @@
 
 namespace WebCore {
 
+    // The hash() functions on StringHash and CaseFoldingHash do not support
+    // null strings. get(), contains(), and add() on HashMap<String,..., StringHash>
+    // cause a null-pointer dereference when passed null strings.
+
     // FIXME: We should really figure out a way to put the computeHash function that's
     // currently a member function of StringImpl into this file so we can be a little
     // closer to having all the nearly-identical hash functions in one place.
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index dac25b2..5155fa5 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -37,7 +37,7 @@
 #include <runtime/UString.h>
 #endif
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -168,7 +168,7 @@ public:
 
     WTF::Unicode::Direction defaultWritingDirection();
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
     CFStringRef createCFString();
 #endif
 #ifdef __OBJC__
diff --git a/WebCore/platform/text/TextBoundariesICU.cpp b/WebCore/platform/text/TextBoundaries.cpp
index b1e8ee2..2455f6d 100644
--- a/WebCore/platform/text/TextBoundariesICU.cpp
+++ b/WebCore/platform/text/TextBoundaries.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,39 +27,40 @@
 #include "config.h"
 #include "TextBoundaries.h"
 
-#include <unicode/ubrk.h>
-#include <unicode/uchar.h>
-
 #include "StringImpl.h"
 #include "TextBreakIterator.h"
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF;
+using namespace Unicode;
 
 namespace WebCore {
 
 int findNextWordFromIndex(const UChar* chars, int len, int position, bool forward)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
 
     if (forward) {
-        position = ubrk_following(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakFollowing(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character preceeding the break
             // is alphanumeric.
-            if (position < len && u_isalnum(chars[position - 1]))
+            if (position < len && isAlphanumeric(chars[position - 1]))
                 return position;
 
-            position = ubrk_following(it, position);
+            position = textBreakFollowing(it, position);
         }
 
         return len;
     } else {
-        position = ubrk_preceding(it, position);
-        while (position != UBRK_DONE) {
+        position = textBreakPreceding(it, position);
+        while (position != TextBreakDone) {
             // We stop searching when the character following the break
             // is alphanumeric.
-            if (position > 0 && u_isalnum(chars[position]))
+            if (position > 0 && isAlphanumeric(chars[position]))
                 return position;
 
-            position = ubrk_preceding(it, position);
+            position = textBreakPreceding(it, position);
         }
 
         return 0;
@@ -67,11 +69,11 @@ int findNextWordFromIndex(const UChar* chars, int len, int position, bool forwar
 
 void findWordBoundary(const UChar* chars, int len, int position, int* start, int* end)
 {
-    UBreakIterator* it = wordBreakIterator(chars, len);
-    *end = ubrk_following(it, position);
+    TextBreakIterator* it = wordBreakIterator(chars, len);
+    *end = textBreakFollowing(it, position);
     if (*end < 0)
-        *end = ubrk_last(it);
-    *start = ubrk_previous(it);
+        *end = textBreakLast(it);
+    *start = textBreakPrevious(it);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/text/TextBreakIterator.h b/WebCore/platform/text/TextBreakIterator.h
index 7b3b963..17cf5f0 100644
--- a/WebCore/platform/text/TextBreakIterator.h
+++ b/WebCore/platform/text/TextBreakIterator.h
@@ -47,7 +47,9 @@ namespace WebCore {
     TextBreakIterator* sentenceBreakIterator(const UChar*, int length);
 
     int textBreakFirst(TextBreakIterator*);
+    int textBreakLast(TextBreakIterator*);
     int textBreakNext(TextBreakIterator*);
+    int textBreakPrevious(TextBreakIterator*);
     int textBreakCurrent(TextBreakIterator*);
     int textBreakPreceding(TextBreakIterator*, int);
     int textBreakFollowing(TextBreakIterator*, int);
diff --git a/WebCore/platform/text/TextBreakIteratorICU.cpp b/WebCore/platform/text/TextBreakIteratorICU.cpp
index c922fbc..44423c0 100644
--- a/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -90,11 +90,21 @@ int textBreakFirst(TextBreakIterator* bi)
     return ubrk_first(bi);
 }
 
+int textBreakLast(TextBreakIterator* bi)
+{
+    return ubrk_last(bi);
+}
+
 int textBreakNext(TextBreakIterator* bi)
 {
     return ubrk_next(bi);
 }
 
+int textBreakPrevious(TextBreakIterator* bi)
+{
+    return ubrk_previous(bi);
+}
+
 int textBreakPreceding(TextBreakIterator* bi, int pos)
 {
     return ubrk_preceding(bi, pos);
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index c5c8cfd..ec9a8b0 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -32,10 +32,13 @@
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncodingRegistry.h"
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include <unicode/unorm.h>
 #elif USE(QT4_UNICODE)
 #include <QString>
+#elif USE(GLIB_UNICODE)
+#include <glib.h>
+#include <wtf/gtk/GOwnPtr.h>
 #endif
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -84,7 +87,7 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     if (!length)
         return "";
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     // FIXME: What's the right place to do normalization?
     // It's a little strange to do it inside the encode function.
     // Perhaps normalization should be an explicit step done before calling encode.
@@ -114,6 +117,18 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     QString str(reinterpret_cast<const QChar*>(characters), length);
     str = str.normalized(QString::NormalizationForm_C);
     return newTextCodec(*this)->encode(reinterpret_cast<const UChar *>(str.utf16()), str.length(), handling);
+#elif USE(GLIB_UNICODE)
+    GOwnPtr<char> UTF8Source;
+    UTF8Source.set(g_utf16_to_utf8(characters, length, 0, 0, 0));
+
+    GOwnPtr<char> UTF8Normalized;
+    UTF8Normalized.set(g_utf8_normalize(UTF8Source.get(), -1, G_NORMALIZE_NFC));
+
+    long UTF16Length;
+    GOwnPtr<UChar> UTF16Normalized;
+    UTF16Normalized.set(g_utf8_to_utf16(UTF8Normalized.get(), -1, 0, &UTF16Length, 0));
+
+    return newTextCodec(*this)->encode(UTF16Normalized.get(), UTF16Length, handling);
 #elif PLATFORM(WINCE)
     // normalization will be done by Windows CE API
     OwnPtr<TextCodec> textCodec = newTextCodec(*this);
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index d3e2965..a4be520 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -39,7 +39,7 @@
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
 #include "TextCodecICU.h"
 #endif
 #if PLATFORM(MAC)
@@ -48,6 +48,9 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
+#if USE(GLIB_UNICODE)
+#include "gtk/TextCodecGtk.h"
+#endif
 #if PLATFORM(WINCE) && !PLATFORM(QT)
 #include "TextCodecWince.h"
 #endif
@@ -217,11 +220,16 @@ static void buildBaseTextCodecMaps()
     TextCodecUserDefined::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUserDefined::registerCodecs(addToTextCodecMap);
 
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
 
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerBaseEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerBaseCodecs(addToTextCodecMap);
+#endif
+
 #if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerBaseCodecs(addToTextCodecMap);
@@ -230,7 +238,7 @@ static void buildBaseTextCodecMaps()
 
 static void extendTextCodecMaps()
 {
-#if USE(ICU_UNICODE) || USE(GLIB_ICU_UNICODE_HYBRID)
+#if USE(ICU_UNICODE)
     TextCodecICU::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecICU::registerExtendedCodecs(addToTextCodecMap);
 #endif
@@ -245,6 +253,11 @@ static void extendTextCodecMaps()
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
 
+#if USE(GLIB_UNICODE)
+    TextCodecGtk::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecGtk::registerExtendedCodecs(addToTextCodecMap);
+#endif
+
 #if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
diff --git a/WebCore/platform/text/cf/StringCF.cpp b/WebCore/platform/text/cf/StringCF.cpp
index b770d0e..97691e5 100644
--- a/WebCore/platform/text/cf/StringCF.cpp
+++ b/WebCore/platform/text/cf/StringCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "PlatformString.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 
@@ -52,4 +52,4 @@ CFStringRef String::createCFString() const
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/WebCore/platform/text/cf/StringImplCF.cpp b/WebCore/platform/text/cf/StringImplCF.cpp
index 8a2ae79..aff45b3 100644
--- a/WebCore/platform/text/cf/StringImplCF.cpp
+++ b/WebCore/platform/text/cf/StringImplCF.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "StringImpl.h"
 
-#if PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#if PLATFORM(CF)
 
 #include <CoreFoundation/CoreFoundation.h>
 #include <wtf/MainThread.h>
@@ -159,4 +159,4 @@ CFStringRef StringImpl::createCFString()
 
 }
 
-#endif // PLATFORM(CF) || (PLATFORM(QT) && PLATFORM(DARWIN))
+#endif // PLATFORM(CF)
diff --git a/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp b/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
new file mode 100644
index 0000000..7a10b41
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include <pango/pango.h>
+#include <wtf/gtk/GOwnPtr.h>
+
+namespace WebCore {
+
+enum UBreakIteratorType {
+    UBRK_CHARACTER,
+    UBRK_WORD,
+    UBRK_LINE,
+    UBRK_SENTENCE
+};
+
+class TextBreakIterator {
+public:
+    UBreakIteratorType m_type;
+    int m_length;
+    PangoLogAttr* m_logAttrs;
+    int m_index;
+};
+
+static TextBreakIterator* setUpIterator(bool& createdIterator, TextBreakIterator*& iterator,
+    UBreakIteratorType type, const UChar* string, int length)
+{
+    if (!string)
+        return 0;
+
+    if (!createdIterator) {
+        iterator = new TextBreakIterator();
+        createdIterator = true;
+    }
+    if (!iterator)
+        return 0;
+
+    long utf8len;
+    GOwnPtr<char> utf8;
+    utf8.set(g_utf16_to_utf8(string, length, 0, &utf8len, 0));
+
+    // FIXME: assumes no surrogate pairs
+
+    iterator->m_type = type;
+    iterator->m_length = length;
+    if (createdIterator)
+        g_free(iterator->m_logAttrs);
+    iterator->m_logAttrs = g_new0(PangoLogAttr, length + 1);
+    iterator->m_index = -1;
+    pango_get_log_attrs(utf8.get(), utf8len, -1, 0, iterator->m_logAttrs, length + 1);
+
+    return iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    static bool createdCharacterBreakIterator = false;
+    static TextBreakIterator* staticCharacterBreakIterator;
+    return setUpIterator(createdCharacterBreakIterator, staticCharacterBreakIterator, UBRK_CHARACTER, string, length);
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    // FIXME: This needs closer inspection to achieve behaviour identical to the ICU version.
+    return characterBreakIterator(string, length);
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    static bool createdWordBreakIterator = false;
+    static TextBreakIterator* staticWordBreakIterator;
+    return setUpIterator(createdWordBreakIterator, staticWordBreakIterator, UBRK_WORD, string, length);
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    static bool createdLineBreakIterator = false;
+    static TextBreakIterator* staticLineBreakIterator;
+    return setUpIterator(createdLineBreakIterator, staticLineBreakIterator, UBRK_LINE, string, length);
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    static bool createdSentenceBreakIterator = false;
+    static TextBreakIterator* staticSentenceBreakIterator;
+    return setUpIterator(createdSentenceBreakIterator, staticSentenceBreakIterator, UBRK_SENTENCE, string, length);
+}
+
+int textBreakFirst(TextBreakIterator* bi)
+{
+    // see textBreakLast
+    
+    int firstCursorPosition = -1;
+    int pos = 0;
+    while (pos <= bi->m_length && (firstCursorPosition < 0)) {
+        if (bi->m_logAttrs[pos].is_cursor_position)
+            firstCursorPosition = pos;
+    }
+    bi->m_index = firstCursorPosition;
+    return firstCursorPosition;
+}
+
+int textBreakLast(TextBreakIterator* bi)
+{
+    // TextBreakLast is not meant to find just any break according to bi->m_type 
+    // but really the one near the last character.
+    // (cmp ICU documentation for ubrk_first and ubrk_last)
+    // From ICU docs for ubrk_last:
+    // "Determine the index immediately beyond the last character in the text being scanned." 
+
+    // So we should advance or traverse back based on bi->m_logAttrs cursor positions.
+    // If last character position in the original string is a whitespace,
+    // traverse to the left until the first non-white character position is found
+    // and return the position of the first white-space char after this one.
+    // Otherwise return m_length, as "the first character beyond the last" is outside our string.
+    
+    bool whiteSpaceAtTheEnd = true;
+    int nextWhiteSpacePos = bi->m_length;
+    
+    int pos = bi->m_length;
+    while (pos >= 0 && whiteSpaceAtTheEnd) {
+        if (bi->m_logAttrs[pos].is_cursor_position) {
+            if (whiteSpaceAtTheEnd = bi->m_logAttrs[pos].is_white)
+                nextWhiteSpacePos = pos;
+        }
+        pos--;
+    }
+    bi->m_index = nextWhiteSpacePos;
+    return nextWhiteSpacePos;
+}
+
+int textBreakNext(TextBreakIterator* bi)
+{
+    for (int i = bi->m_index + 1; i <= bi->m_length; i++) {
+
+        // FIXME: UBRK_WORD case: Single multibyte characters (i.e. white space around them), such as the euro symbol €, 
+        // are not marked as word_start & word_end as opposed to the way ICU does it.
+        // This leads to - for example - different word selection behaviour when right clicking.
+
+        if ((bi->m_type == UBRK_LINE && bi->m_logAttrs[i].is_line_break)
+            || (bi->m_type == UBRK_WORD && (bi->m_logAttrs[i].is_word_start || bi->m_logAttrs[i].is_word_end))
+            || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[i].is_cursor_position)
+            || (bi->m_type == UBRK_SENTENCE && (bi->m_logAttrs[i].is_sentence_start || bi->m_logAttrs[i].is_sentence_end)) ) {
+            bi->m_index = i;
+            return i;
+        }
+    }
+    return TextBreakDone;
+}
+
+int textBreakPrevious(TextBreakIterator* bi)
+{
+    for (int i = bi->m_index - 1; i >= 0; i--) {
+        if ((bi->m_type == UBRK_LINE && bi->m_logAttrs[i].is_line_break)
+            || (bi->m_type == UBRK_WORD && (bi->m_logAttrs[i].is_word_start || bi->m_logAttrs[i].is_word_end))
+            || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[i].is_cursor_position)
+            || (bi->m_type == UBRK_SENTENCE && (bi->m_logAttrs[i].is_sentence_start || bi->m_logAttrs[i].is_sentence_end)) ) {
+            bi->m_index = i;
+            return i;
+        }
+    }
+    return textBreakFirst(bi);
+}
+
+int textBreakPreceding(TextBreakIterator* bi, int pos)
+{
+    bi->m_index = pos;
+    return textBreakPrevious(bi);
+}
+
+int textBreakFollowing(TextBreakIterator* bi, int pos)
+{
+    if (pos < 0)
+        pos = -1;
+    bi->m_index = pos;
+    return textBreakNext(bi);
+}
+
+int textBreakCurrent(TextBreakIterator* bi)
+{
+    return bi->m_index;
+}
+
+bool isTextBreak(TextBreakIterator* bi, int pos)
+{
+    if (bi->m_index < 0)
+        return false;
+
+    return ((bi->m_type == UBRK_LINE && bi->m_logAttrs[bi->m_index].is_line_break)
+        || (bi->m_type == UBRK_WORD && bi->m_logAttrs[bi->m_index].is_word_end)
+        || (bi->m_type == UBRK_CHARACTER && bi->m_logAttrs[bi->m_index].is_char_break)
+        || (bi->m_type == UBRK_SENTENCE && bi->m_logAttrs[bi->m_index].is_sentence_end) );
+}
+
+}
diff --git a/WebCore/platform/text/gtk/TextCodecGtk.cpp b/WebCore/platform/text/gtk/TextCodecGtk.cpp
new file mode 100644
index 0000000..31da3b7
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextCodecGtk.cpp
@@ -0,0 +1,446 @@
+/*
+ * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextCodecGtk.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/gtk/GOwnPtr.h>
+#include "Logging.h"
+
+using std::min;
+
+namespace WebCore {
+
+// TextCodec's appendOmittingBOM() is gone (http://trac.webkit.org/changeset/33380). 
+// That's why we need to avoid generating extra BOM's for the conversion result.
+// This can be achieved by specifying the UTF-16 codecs' endianness explicitly when initializing GLib.
+
+#if (G_BYTE_ORDER == G_BIG_ENDIAN)
+    const gchar* WebCore::TextCodecGtk::m_internalEncodingName = "UTF-16BE";
+#else 
+    const gchar* WebCore::TextCodecGtk::m_internalEncodingName = "UTF-16LE";
+#endif
+
+
+// We're specifying the list of text codecs and their aliases here. 
+// For each codec the first entry is the canonical name, remaining ones are used as aliases.
+// Each alias list must be terminated by a 0.
+
+// Unicode
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_UTF_8            = { "UTF-8", 0 }; 
+
+// Western
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_1       = { "ISO-8859-1", "CP819", "IBM819", "ISO-IR-100", "ISO8859-1", "ISO_8859-1", "ISO_8859-1:1987",  "L1", "LATIN1", "CSISOLATIN1", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACROMAN         = { "MACROMAN", "MAC", "MACINTOSH", "CSMACINTOSH", 0 };
+
+// Japanese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_SHIFT_JIS        = { "Shift_JIS", "MS_KANJI", "SHIFT-JIS", "SJIS", "CSSHIFTJIS", 0 };
+    TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_JP       = { "EUC-JP", "EUC_JP", "EUCJP", "EXTENDED_UNIX_CODE_PACKED_FORMAT_FOR_JAPANESE", "CSEUCPKDFMTJAPANESE", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_2022_JP      = { "ISO-2022-JP", 0 };
+
+// Traditional Chinese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_BIG5             = { "BIG5", "BIG-5", "BIG-FIVE", "BIG5", "BIGFIVE", "CN-BIG5", "CSBIG5", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_BIG5_HKSCS       = { "BIG5-HKSCS", "BIG5-HKSCS:2004", "BIG5HKSCS", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP950            = { "CP950", 0 };
+
+// Korean
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_2022_KR      = { "ISO-2022-KR", "CSISO2022KR", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP949            = { "CP949", "UHC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_KR           = { "EUC-KR", "CSEUCKR", 0 };
+
+// Arabic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_6       = { "ISO-8859-6", "ARABIC", "ASMO-708", "ECMA-114", "ISO-IR-127", "ISO8859-6", "ISO_8859-6", "ISO_8859-6:1987", "CSISOLATINARABIC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1256           = { "windows-1256", "CP1256", "MS-ARAB", 0 }; // rearranged, windows-1256 now declared the canonical name and put to lowercase to fix /fast/encoding/ahram-org-eg.html test case
+
+// Hebrew
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_8       = { "ISO-8859-8", "HEBREW", "ISO-8859-8", "ISO-IR-138", "ISO8859-8", "ISO_8859-8", "ISO_8859-8:1988", "CSISOLATINHEBREW", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1255           = { "windows-1255", "CP1255", "MS-HEBR", 0 }; // rearranged, moved windows-1255 as canonical and lowercased, fixing /fast/encoding/meta-charset.html
+
+// Greek
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_7       = { "ISO-8859-7", "ECMA-118", "ELOT_928", "GREEK", "GREEK8", "ISO-IR-126", "ISO8859-7", "ISO_8859-7", "ISO_8859-7:1987", "ISO_8859-7:2003", "CSI", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP869            = { "CP869", "869", "CP-GR", "IBM869", "CSIBM869", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_WINDOWS_1253     = { "WINDOWS-1253", 0 };
+
+// Cyrillic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_5       = { "ISO-8859-5", "CYRILLIC", "ISO-IR-144", "ISO8859-5", "ISO_8859-5", "ISO_8859-5:1988", "CSISOLATINCYRILLIC", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_KOI8_R           = { "KOI8-R", "CSKOI8R", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP866            = { "CP866", "866", "IBM866", "CSIBM866", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_KOI8_U           = { "KOI8-U", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_WINDOWS_1251     = { "windows-1251", "CP1251", 0 }; // CP1251 added to pass /fast/encoding/charset-cp1251.html
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACCYRILLIC      = { "mac-cyrillic", "MACCYRILLIC", "x-mac-cyrillic", 0 }; 
+
+// Thai
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP874            = { "CP874", "WINDOWS-874", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_TIS_620          = { "TIS-620", 0 };
+
+// Simplified Chinese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_GBK              = { "GBK", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_HZ               = { "HZ", "HZ-GB-2312", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_GB18030          = { "GB18030", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_EUC_CN           = { "EUC-CN", "EUCCN", "GB2312", "CN-GB", "CSGB2312", "EUC_CN", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_2312_80          = { "GB_2312-80", "CHINESE", "csISO58GB231280", "GB2312.1980-0", "ISO-IR-58" };
+
+// Central European
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_2       = { "ISO-8859-2", "ISO-IR-101", "ISO8859-2", "ISO_8859-2", "ISO_8859-2:1987", "L2", "LATIN2", "CSISOLATIN2", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1250           = { "CP1250", "MS-EE", "WINDOWS-1250", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_MACCENTRALEUROPE = { "MAC-CENTRALEUROPE", 0 };
+
+// Vietnamese
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1258           = { "CP1258", "WINDOWS-1258", 0 };
+
+// Turkish
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1254           = { "CP1254", "MS-TURK", "WINDOWS-1254", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_9       = { "ISO-8859-9", "ISO-IR-148", "ISO8859-9", "ISO_8859-9", "ISO_8859-9:1989", "L5", "LATIN5", "CSISOLATIN5", 0 };
+
+// Baltic
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_CP1257           = { "CP1257", "WINBALTRIM", "WINDOWS-1257", 0 };
+TextCodecGtk::codecAliasList TextCodecGtk::m_codecAliases_ISO_8859_4       = { "ISO-8859-4", "ISO-IR-110", "ISO8859-4", "ISO_8859-4", "ISO_8859-4:1988", "L4", "LATIN4", "CSISOLATIN4", 0 };
+
+gconstpointer const TextCodecGtk::m_iconvBaseCodecList[] = { 
+    // Unicode
+    &m_codecAliases_UTF_8,
+
+    // Western
+    &m_codecAliases_ISO_8859_1
+};
+
+gconstpointer const TextCodecGtk::m_iconvExtendedCodecList[] = 
+{
+    // Western
+    &m_codecAliases_MACROMAN,
+
+    // Japanese
+    &m_codecAliases_SHIFT_JIS,
+    &m_codecAliases_EUC_JP,
+    &m_codecAliases_ISO_2022_JP,
+
+    // Simplified Chinese
+    &m_codecAliases_BIG5,
+    &m_codecAliases_BIG5_HKSCS,
+    &m_codecAliases_CP950,
+
+    // Korean
+    &m_codecAliases_ISO_2022_KR,
+    &m_codecAliases_CP949,
+    &m_codecAliases_EUC_KR,
+
+    // Arabic
+    &m_codecAliases_ISO_8859_6,
+    &m_codecAliases_CP1256,
+    
+    // Hebrew
+    &m_codecAliases_ISO_8859_8,
+    &m_codecAliases_CP1255,
+    
+    // Greek
+    &m_codecAliases_ISO_8859_7,
+    &m_codecAliases_CP869,
+    &m_codecAliases_WINDOWS_1253,
+    
+    // Cyrillic
+    &m_codecAliases_ISO_8859_5,
+    &m_codecAliases_KOI8_R,
+    &m_codecAliases_CP866,
+    &m_codecAliases_KOI8_U,
+    &m_codecAliases_WINDOWS_1251,
+    &m_codecAliases_MACCYRILLIC,
+    
+    // Thai
+    &m_codecAliases_CP874,
+    &m_codecAliases_TIS_620,
+    
+    // Traditional Chinese
+    &m_codecAliases_GBK,
+    &m_codecAliases_HZ,
+    &m_codecAliases_GB18030,
+    &m_codecAliases_EUC_CN,
+    &m_codecAliases_2312_80,
+    
+    // Central European
+    &m_codecAliases_ISO_8859_2,
+    &m_codecAliases_CP1250,
+    &m_codecAliases_MACCENTRALEUROPE,
+    
+    // Vietnamese
+    &m_codecAliases_CP1258,
+    
+    // Turkish
+    &m_codecAliases_CP1254,
+    &m_codecAliases_ISO_8859_9,
+    
+    // Baltic
+    &m_codecAliases_CP1257,
+    &m_codecAliases_ISO_8859_4
+};
+
+
+const size_t ConversionBufferSize = 16384;
+    
+
+static PassOwnPtr<TextCodec> newTextCodecGtk(const TextEncoding& encoding, const void*)
+{
+    return new TextCodecGtk(encoding);
+}
+
+gboolean TextCodecGtk::isEncodingAvailable(const gchar* encName)
+{
+    GIConv tester;
+    // test decoding
+    tester = g_iconv_open(m_internalEncodingName, encName);
+    if (tester == reinterpret_cast<GIConv>(-1)) {
+        return false;
+    } else {
+        g_iconv_close(tester);
+        // test encoding
+        tester = g_iconv_open(encName, m_internalEncodingName);
+        if (tester == reinterpret_cast<GIConv>(-1)) {
+            return false;
+        } else {
+            g_iconv_close(tester);
+            return true;
+        }
+    }
+}
+
+void TextCodecGtk::registerEncodingNames(EncodingNameRegistrar registrar, bool extended)
+{
+    const void* const* encodingList;
+    unsigned int listLength = 0;
+    if (extended) {
+        encodingList = m_iconvExtendedCodecList;
+        listLength = sizeof(m_iconvExtendedCodecList)/sizeof(gpointer);
+    } else {
+        encodingList = m_iconvBaseCodecList;
+        listLength = sizeof(m_iconvBaseCodecList)/sizeof(gpointer);
+    }
+
+    for (unsigned int i = 0; i < listLength; ++i) {
+        codecAliasList *codecAliases = static_cast<codecAliasList*>(encodingList[i]);
+        
+        // Our convention is, the first entry in codecAliases is the canonical name, 
+        // see above in the list of declarations. 
+        // Probe GLib for this one first. If it's not available, we skip the whole group of aliases.
+
+        int codecCount = 0;
+        const char *canonicalName;
+        canonicalName = (*codecAliases)[codecCount];
+
+        if(!isEncodingAvailable(canonicalName)) {
+            LOG(TextConversion, "Canonical encoding %s not available, skipping.", canonicalName);
+            continue;
+        }
+        registrar(canonicalName, canonicalName);
+
+        const char *currentAlias;
+        while ((currentAlias = (*codecAliases)[++codecCount])) {
+            if (isEncodingAvailable(currentAlias)) {
+                LOG(TextConversion, "Registering encoding name alias %s to canonical %s", currentAlias, canonicalName);
+                registrar(currentAlias, canonicalName);
+            }
+        }
+
+    }
+}
+
+void TextCodecGtk::registerCodecs(TextCodecRegistrar registrar, bool extended)
+{
+    const void* const* encodingList;
+    unsigned int listLength = 0;
+    if (extended) {
+        encodingList = m_iconvExtendedCodecList;
+        listLength = sizeof(m_iconvExtendedCodecList)/sizeof(gpointer);
+    } else {
+        encodingList = m_iconvBaseCodecList;
+        listLength = sizeof(m_iconvBaseCodecList)/sizeof(gpointer);
+    }
+
+    for (unsigned int i = 0; i < listLength; ++i) {
+        codecAliasList *codecAliases = static_cast<codecAliasList*>(encodingList[i]);
+        // by convention, the first "alias" should be the canonical name, see the definition of the alias lists 
+        const gchar *codecName = (*codecAliases)[0];
+        if (isEncodingAvailable(codecName))
+            registrar(codecName, newTextCodecGtk, 0);
+    }
+}
+
+void TextCodecGtk::registerBaseEncodingNames(EncodingNameRegistrar registrar)
+{
+    registerEncodingNames(registrar, false);
+}
+
+void TextCodecGtk::registerBaseCodecs(TextCodecRegistrar registrar)
+{
+    registerCodecs(registrar, false);
+}
+
+void TextCodecGtk::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
+{
+    registerEncodingNames(registrar, true);
+}
+
+void TextCodecGtk::registerExtendedCodecs(TextCodecRegistrar registrar)
+{
+    registerCodecs(registrar, true);
+}
+
+TextCodecGtk::TextCodecGtk(const TextEncoding& encoding)
+    : m_encoding(encoding)
+    , m_numBufferedBytes(0)
+    , m_iconvDecoder(reinterpret_cast<GIConv>(-1))
+    , m_iconvEncoder(reinterpret_cast<GIConv>(-1))
+{
+}
+
+TextCodecGtk::~TextCodecGtk()
+{
+    if (m_iconvDecoder != reinterpret_cast<GIConv>(-1)) {
+        g_iconv_close(m_iconvDecoder);
+        m_iconvDecoder = reinterpret_cast<GIConv>(-1);
+    }
+    if (m_iconvEncoder != reinterpret_cast<GIConv>(-1)) {
+        g_iconv_close(m_iconvEncoder);
+        m_iconvEncoder = reinterpret_cast<GIConv>(-1);
+    }
+}
+
+void TextCodecGtk::createIConvDecoder() const
+{
+    ASSERT(m_iconvDecoder == reinterpret_cast<GIConv>(-1));
+
+    m_iconvDecoder = g_iconv_open(m_internalEncodingName, m_encoding.name());
+}
+
+void TextCodecGtk::createIConvEncoder() const
+{
+    ASSERT(m_iconvDecoder == reinterpret_cast<GIConv>(-1));
+
+    m_iconvEncoder = g_iconv_open(m_encoding.name(), m_internalEncodingName);
+}
+
+String TextCodecGtk::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+{
+    // Get a converter for the passed-in encoding.
+    if (m_iconvDecoder == reinterpret_cast<GIConv>(-1)) {
+        createIConvDecoder();
+        ASSERT(m_iconvDecoder != reinterpret_cast<GIConv>(-1));
+        if (m_iconvDecoder == reinterpret_cast<GIConv>(-1)) {
+            LOG_ERROR("Error creating IConv encoder even though encoding was in table.");
+            return String();
+        }
+    }
+
+    size_t countWritten, countRead, conversionLength;
+    const char* conversionBytes;
+    char* prefixedBytes = 0;
+
+    if (m_numBufferedBytes) {
+        conversionLength = length + m_numBufferedBytes;
+        prefixedBytes = static_cast<char*>(fastMalloc(conversionLength));
+        memcpy(prefixedBytes, m_bufferedBytes, m_numBufferedBytes);
+        memcpy(prefixedBytes + m_numBufferedBytes, bytes, length);
+        
+        conversionBytes = prefixedBytes;
+        
+        // all buffered bytes are consumed now
+        m_numBufferedBytes = 0;
+    } else {
+        // no previously buffered partial data, 
+        // just convert the data that was passed in
+        conversionBytes = bytes;
+        conversionLength = length;
+    }
+
+    GOwnPtr<GError> err;
+    GOwnPtr<UChar> buffer;
+
+    buffer.outPtr() = reinterpret_cast<UChar*>(g_convert_with_iconv(conversionBytes, conversionLength, m_iconvDecoder, &countRead, &countWritten, &err.outPtr())); 
+
+
+    if (err) {
+        LOG_ERROR("GIConv conversion error, Code %d: \"%s\"", err->code, err->message);
+        m_numBufferedBytes = 0; // reset state for subsequent calls to decode
+        fastFree(prefixedBytes);
+        sawError = true;
+        return String();
+    }
+    
+    // Partial input at the end of the string may not result in an error being raised. 
+    // From the gnome library documentation on g_convert_with_iconv:
+    // "Even if the conversion was successful, this may be less than len if there were partial characters at the end of the input."
+    // That's why we need to compare conversionLength against countRead 
+
+    m_numBufferedBytes = conversionLength - countRead;
+    if (m_numBufferedBytes > 0) {
+        if (flush) {
+            LOG_ERROR("Partial bytes at end of input while flush requested.");
+            m_numBufferedBytes = 0; // reset state for subsequent calls to decode
+            fastFree(prefixedBytes);
+            sawError = true;
+            return String();
+        }
+        memcpy(m_bufferedBytes, conversionBytes + countRead, m_numBufferedBytes);
+    }
+
+    fastFree(prefixedBytes);
+    
+    Vector<UChar> result;
+
+    result.append(buffer.get(), countWritten / sizeof(UChar));
+
+    return String::adopt(result);
+}
+
+CString TextCodecGtk::encode(const UChar* characters, size_t length, UnencodableHandling handling)
+{
+    if (!length)
+        return "";
+
+    if (m_iconvEncoder == reinterpret_cast<GIConv>(-1))
+        createIConvEncoder();
+    if (m_iconvEncoder == reinterpret_cast<GIConv>(-1))
+        return CString();
+
+    size_t count;
+
+    GOwnPtr<GError> err;
+    GOwnPtr<char> buffer;
+
+    buffer.outPtr() = g_convert_with_iconv(reinterpret_cast<const char*>(characters), length * sizeof(UChar), m_iconvEncoder, 0, &count, &err.outPtr());
+    if (err) {
+        LOG_ERROR("GIConv conversion error, Code %d: \"%s\"", err->code, err->message);
+        return CString();
+    }
+
+    return CString(buffer.get(), count);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/text/gtk/TextCodecGtk.h b/WebCore/platform/text/gtk/TextCodecGtk.h
new file mode 100644
index 0000000..a8af752
--- /dev/null
+++ b/WebCore/platform/text/gtk/TextCodecGtk.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ * Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ * Copyright (C) 2009 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextCodecGTK_h
+#define TextCodecGTK_h
+
+#include <glib.h>
+#include "TextCodec.h"
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+    class TextCodecGtk : public TextCodec {
+    public:
+        static void registerBaseEncodingNames(EncodingNameRegistrar);
+        static void registerBaseCodecs(TextCodecRegistrar);
+
+        static void registerExtendedEncodingNames(EncodingNameRegistrar);
+        static void registerExtendedCodecs(TextCodecRegistrar);
+
+        TextCodecGtk(const TextEncoding&);
+        virtual ~TextCodecGtk();
+
+        virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
+        virtual CString encode(const UChar*, size_t length, UnencodableHandling);
+
+    private:
+        void createIConvDecoder() const;
+        void createIConvEncoder() const;
+
+        static void registerEncodingNames(EncodingNameRegistrar registrar, bool extended);        
+        static void registerCodecs(TextCodecRegistrar registrar, bool extended);
+        static gboolean isEncodingAvailable(const gchar*);
+
+        TextEncoding m_encoding;
+        size_t m_numBufferedBytes;
+        unsigned char m_bufferedBytes[16]; // bigger than any single multi-byte character        
+        mutable GIConv m_iconvDecoder;
+        mutable GIConv m_iconvEncoder;
+
+        static const gchar* m_internalEncodingName;
+
+        typedef const gchar* const codecAliasList[];
+
+        // Unicode
+        static codecAliasList m_codecAliases_UTF_8;
+
+        // Western
+        static codecAliasList m_codecAliases_ISO_8859_1;
+        static codecAliasList m_codecAliases_MACROMAN;
+
+        // Japanese
+        static codecAliasList m_codecAliases_SHIFT_JIS;
+        static codecAliasList m_codecAliases_EUC_JP;
+        static codecAliasList m_codecAliases_ISO_2022_JP;
+
+        // Traditional Chinese
+        static codecAliasList m_codecAliases_BIG5;
+        static codecAliasList m_codecAliases_BIG5_HKSCS;
+        static codecAliasList m_codecAliases_CP950;
+
+        // Korean
+        static codecAliasList m_codecAliases_ISO_2022_KR;
+        static codecAliasList m_codecAliases_CP949;
+        static codecAliasList m_codecAliases_EUC_KR;
+
+        // Arabic
+        static codecAliasList m_codecAliases_ISO_8859_6;
+        static codecAliasList m_codecAliases_CP1256;
+
+        // Hebrew
+        static codecAliasList m_codecAliases_ISO_8859_8;
+        static codecAliasList m_codecAliases_CP1255;
+
+        // Greek
+        static codecAliasList m_codecAliases_ISO_8859_7;
+        static codecAliasList m_codecAliases_CP869;
+        static codecAliasList m_codecAliases_WINDOWS_1253;
+
+        // Cyrillic
+        static codecAliasList m_codecAliases_ISO_8859_5;
+        static codecAliasList m_codecAliases_KOI8_R;
+        static codecAliasList m_codecAliases_CP866;
+        static codecAliasList m_codecAliases_KOI8_U;
+        static codecAliasList m_codecAliases_WINDOWS_1251;
+        static codecAliasList m_codecAliases_MACCYRILLIC;
+
+        // Thai
+        static codecAliasList m_codecAliases_CP874;
+        static codecAliasList m_codecAliases_TIS_620;
+
+        // Simplified Chinese
+        static codecAliasList m_codecAliases_GBK;
+        static codecAliasList m_codecAliases_HZ;
+        static codecAliasList m_codecAliases_GB18030;
+        static codecAliasList m_codecAliases_EUC_CN;
+        static codecAliasList m_codecAliases_2312_80; 
+
+        // Central European
+        static codecAliasList m_codecAliases_ISO_8859_2;
+        static codecAliasList m_codecAliases_CP1250;
+        static codecAliasList m_codecAliases_MACCENTRALEUROPE;
+
+        // Vietnamese
+        static codecAliasList m_codecAliases_CP1258;
+
+        // Turkish
+        static codecAliasList m_codecAliases_CP1254;
+        static codecAliasList m_codecAliases_ISO_8859_9;
+
+        // Baltic
+        static codecAliasList m_codecAliases_CP1257;
+        static codecAliasList m_codecAliases_ISO_8859_4;
+
+        static gconstpointer const m_iconvBaseCodecList[];
+        static gconstpointer const m_iconvExtendedCodecList[];
+
+    };
+
+} // namespace WebCore
+
+#endif // TextCodecGTK_h
diff --git a/WebCore/platform/text/qt/TextBoundaries.cpp b/WebCore/platform/text/qt/TextBoundariesQt.cpp
index ffc4c44..a354ca6 100644
--- a/WebCore/platform/text/qt/TextBoundaries.cpp
+++ b/WebCore/platform/text/qt/TextBoundariesQt.cpp
@@ -36,7 +36,6 @@
 #include <QDebug>
 #include <stdio.h>
 
-#if QT_VERSION >= 0x040400
 #include <qtextboundaryfinder.h>
 
 namespace WebCore {
@@ -76,48 +75,3 @@ void findWordBoundary(UChar const* buffer, int len, int position, int* start, in
 
 }
 
-#else
-namespace WebCore {
-
-int findNextWordFromIndex(UChar const* buffer, int len, int position, bool forward)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-    notImplemented();
-    return 0;
-}
-
-void findWordBoundary(UChar const* buffer, int len, int position, int* start, int* end)
-{
-    QString str(reinterpret_cast<QChar const*>(buffer), len);
-
-    if (position > str.length()) {
-        *start = 0;
-        *end = 0;
-        return;
-    }
-
-    int currentPosition = position - 1;
-    QString foundWord;
-    while (currentPosition >= 0 &&
-           str[currentPosition].isLetter()) {
-        foundWord.prepend(str[currentPosition]);
-        --currentPosition;
-    }
-
-    // currentPosition == 0 means the first char is not letter
-    // currentPosition == -1 means we reached the beginning
-    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
-    currentPosition = position;
-    if (str[currentPosition].isLetter()) {
-            while (str[currentPosition].isLetter()) {
-                foundWord.append(str[currentPosition]);
-                ++currentPosition;
-            }
-    }
-
-    *start = startPos;
-    *end = currentPosition;
-}
-
-}
-#endif
diff --git a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index d80e270..101947c 100644
--- a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +21,6 @@
 #include "config.h"
 #include "TextBreakIterator.h"
 
-#if QT_VERSION >= 0x040400
 #include <QtCore/qtextboundaryfinder.h>
 #include <qdebug.h>
 
@@ -132,183 +129,3 @@ namespace WebCore {
     }
 
 }
-#else
-#include <qtextlayout.h>
-
-namespace WebCore {
-
-    class TextBreakIterator {
-    public:
-        virtual int first() = 0;
-        virtual int next() = 0;
-        virtual int previous() = 0;
-        inline int following(int pos)
-        {
-            currentPos = pos;
-            return next();
-        }
-        inline int preceding(int pos)
-        {
-            currentPos = pos;
-            return previous();
-        }
-        int currentPos;
-        const UChar *string;
-        int length;
-    };
-
-    class WordBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-    };
-
-    class CharBreakIteratorQt : public TextBreakIterator {
-    public:
-        virtual int first();
-        virtual int next();
-        virtual int previous();
-        QTextLayout layout;
-    };
-
-    int WordBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::next()
-    {
-        if (currentPos >= length) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos < length) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            ++currentPos;
-        }
-        return currentPos;
-    }
-
-    int WordBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0) {
-            currentPos = -1;
-            return currentPos;
-        }
-        bool haveSpace = false;
-        while (currentPos > 0) {
-            if (haveSpace && !QChar(string[currentPos]).isSpace())
-                break;
-            if (QChar(string[currentPos]).isSpace())
-                haveSpace = true;
-            --currentPos;
-        }
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::first()
-    {
-        currentPos = 0;
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::next()
-    {
-        if (currentPos >= length)
-            return -1;
-        currentPos = layout.nextCursorPosition(currentPos);
-        return currentPos;
-    }
-
-    int CharBreakIteratorQt::previous()
-    {
-        if (currentPos <= 0)
-            return -1;
-        currentPos = layout.previousCursorPosition(currentPos);
-        return currentPos;
-    }
-
-
-TextBreakIterator* wordBreakIterator(const UChar* string, int length)
-{
-    static WordBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new WordBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-
-    return iterator;
-}
-
-TextBreakIterator* characterBreakIterator(const UChar* string, int length)
-{
-    static CharBreakIteratorQt *iterator = 0;
-    if (!iterator)
-        iterator = new CharBreakIteratorQt;
-
-    iterator->string = string;
-    iterator->length = length;
-    iterator->currentPos = 0;
-    iterator->layout.setText(QString(reinterpret_cast<const QChar*>(string), length));
-
-    return iterator;
-}
-
-TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
-{
-    return characterBreakIterator(string, length);
-}
-
-TextBreakIterator* lineBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-TextBreakIterator* sentenceBreakIterator(const UChar*, int)
-{
-    // not yet implemented
-    return 0;
-}
-
-int textBreakFirst(TextBreakIterator* bi)
-{
-    return bi->first();
-}
-
-int textBreakNext(TextBreakIterator* bi)
-{
-    return bi->next();
-}
-
-int textBreakPreceding(TextBreakIterator* bi, int pos)
-{
-    return bi->preceding(pos);
-}
-
-int textBreakFollowing(TextBreakIterator* bi, int pos)
-{
-    return bi->following(pos);
-}
-
-int textBreakCurrent(TextBreakIterator* bi)
-{
-    return bi->currentPos;
-}
-
-bool isTextBreak(TextBreakIterator*, int)
-{
-    return true;
-}
-
-}
-
-#endif
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.cpp b/WebCore/platform/text/wince/TextBoundariesWince.cpp
index c8a1397..df6f757 100644
--- a/WebCore/html/canvas/CanvasArrayBuffer.cpp
+++ b/WebCore/platform/text/wince/TextBoundariesWince.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,38 +21,55 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
+#include "TextBoundaries.h"
 
-#if ENABLE(3D_CANVAS)
+#include "NotImplemented.h"
+#include "PlatformString.h"
 
-#include "CanvasArrayBuffer.h"
+using namespace WTF::Unicode;
 
 namespace WebCore {
-    
-    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
-    {
-        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
-    }
-    
-    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
-        m_sizeInBytes = sizeInBytes;
-        m_data = WTF::fastZeroedMalloc(sizeInBytes);
-    }
-    
-    void* CanvasArrayBuffer::data() {
-        return m_data;
+
+int findNextWordFromIndex(const UChar * buffer, int len, int position, bool forward)
+{
+    notImplemented();
+    return 0;
+}
+
+void findWordBoundary(const UChar * buffer, int len, int position, int* start, int* end)
+{
+    if (position > len) {
+        *start = 0;
+        *end = 0;
+        return;
     }
 
-    unsigned CanvasArrayBuffer::byteLength() const {
-        return m_sizeInBytes;
+    String str(buffer, len);
+
+    int currentPosition = position - 1;
+    String foundWord;
+    while (currentPosition >= 0 && isLetter(str[currentPosition])) {
+        UChar c = str[currentPosition];
+        foundWord.insert(&c, 1, 0);
+        --currentPosition;
     }
 
-    CanvasArrayBuffer::~CanvasArrayBuffer() {
-        WTF::fastFree(m_data);
+    // currentPosition == 0 means the first char is not letter
+    // currentPosition == -1 means we reached the beginning
+    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
+    currentPosition = position;
+    while (isLetter(str[currentPosition])) {
+        foundWord.append(str[currentPosition]);
+        ++currentPosition;
     }
+
+    *start = startPos;
+    *end = currentPosition;
 }
 
-#endif // ENABLE(3D_CANVAS)
+
+}
diff --git a/WebCore/platform/text/wince/TextBreakIteratorWince.cpp b/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
new file mode 100644
index 0000000..26a5be2
--- /dev/null
+++ b/WebCore/platform/text/wince/TextBreakIteratorWince.cpp
@@ -0,0 +1,311 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include "PlatformString.h"
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+// Hack, not entirely correct
+static inline bool isCharStop(UChar c)
+{
+    CharCategory charCategory = category(c);
+    return charCategory != Mark_NonSpacing && (charCategory != Other_Surrogate || (c < 0xd800 || c >= 0xdc00));
+}
+
+static inline bool isLineStop(UChar c)
+{
+    return category(c) != Separator_Line;
+}
+
+static inline bool isSentenceStop(UChar c)
+{
+    return isPunct(c);
+}
+
+class TextBreakIterator {
+public:
+    void reset(const UChar* str, int len)
+    {
+        string = str;
+        length = len;
+        currentPos = 0;
+    }
+    virtual int first() = 0;
+    virtual int next() = 0;
+    virtual int previous() = 0;
+    int following(int position)
+    {
+        currentPos = position;
+        return next();
+    }
+    int preceding(int position)
+    {
+        currentPos = position;
+        return previous();
+    }
+
+    int currentPos;
+    const UChar* string;
+    int length;
+};
+
+struct WordBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct CharBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct LineBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct SentenceBreakIterator : TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+int WordBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int WordBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int WordBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int CharBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int CharBreakIterator::next()
+{
+    if (currentPos >= length)
+        return -1;
+    ++currentPos;
+    while (currentPos < length && !isCharStop(string[currentPos]))
+        ++currentPos;
+    return currentPos;
+}
+
+int CharBreakIterator::previous()
+{
+    if (currentPos <= 0)
+        return -1;
+    if (currentPos > length)
+        currentPos = length;
+    --currentPos;
+    while (currentPos > 0 && !isCharStop(string[currentPos]))
+        --currentPos;
+    return currentPos;
+}
+
+int LineBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int LineBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int LineBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int SentenceBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(WordBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(CharBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(LineBreakIterator , iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(SentenceBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+int textBreakFirst(TextBreakIterator* breakIterator)
+{
+    return breakIterator->first();
+}
+
+int textBreakNext(TextBreakIterator* breakIterator)
+{
+    return breakIterator->next();
+}
+
+int textBreakPreceding(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->preceding(position);
+}
+
+int textBreakFollowing(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->following(position);
+}
+
+int textBreakCurrent(TextBreakIterator* breakIterator)
+{
+    return breakIterator->currentPos;
+}
+
+bool isTextBreak(TextBreakIterator*, int)
+{
+    return true;
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    return characterBreakIterator(string, length);
+}
+
+}
diff --git a/WebCore/platform/win/PlatformMouseEventWin.cpp b/WebCore/platform/win/PlatformMouseEventWin.cpp
index e9c0e3e..dc4dd2f 100644
--- a/WebCore/platform/win/PlatformMouseEventWin.cpp
+++ b/WebCore/platform/win/PlatformMouseEventWin.cpp
@@ -24,6 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
 #include "PlatformMouseEvent.h"
 
 #include <wtf/Assertions.h>
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index 1d9eb71..7d8c8d5 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -617,11 +617,11 @@ void PopupMenu::paint(const IntRect& damageRect, HDC hdc)
 
         // Draw the background for this menu item
         if (itemStyle.isVisible())
-            context.fillRect(itemRect, optionBackgroundColor);
+            context.fillRect(itemRect, optionBackgroundColor, DeviceColorSpace);
 
         if (client()->itemIsSeparator(index)) {
             IntRect separatorRect(itemRect.x() + separatorPadding, itemRect.y() + (itemRect.height() - separatorHeight) / 2, itemRect.width() - 2 * separatorPadding, separatorHeight);
-            context.fillRect(separatorRect, optionTextColor);
+            context.fillRect(separatorRect, optionTextColor, DeviceColorSpace);
             continue;
         }
 
@@ -631,7 +631,7 @@ void PopupMenu::paint(const IntRect& damageRect, HDC hdc)
         const UChar* string = itemText.characters();
         TextRun textRun(string, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
 
-        context.setFillColor(optionTextColor);
+        context.setFillColor(optionTextColor, DeviceColorSpace);
         
         Font itemFont = client()->menuStyle().font();
         if (client()->itemIsLabel(index)) {
diff --git a/WebCore/platform/win/WebCoreTextRenderer.cpp b/WebCore/platform/win/WebCoreTextRenderer.cpp
index affeb9d..f771e00 100644
--- a/WebCore/platform/win/WebCoreTextRenderer.cpp
+++ b/WebCore/platform/win/WebCoreTextRenderer.cpp
@@ -49,7 +49,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
 {
     TextRun run(text.characters(), text.length());
 
-    context.setFillColor(color);
+    context.setFillColor(color, DeviceColorSpace);
     if (isOneLeftToRightRun(run))
         font.drawText(&context, run, point);
     else
@@ -71,7 +71,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
         IntPoint underlinePoint(point);
         underlinePoint.move(beforeWidth, 1);
 
-        context.setStrokeColor(color);
+        context.setStrokeColor(color, DeviceColorSpace);
         context.drawLineForText(underlinePoint, underlinedWidth, false);
     }
 }
diff --git a/WebCore/platform/wx/FileSystemWx.cpp b/WebCore/platform/wx/FileSystemWx.cpp
index 109278f..1ee87ae 100644
--- a/WebCore/platform/wx/FileSystemWx.cpp
+++ b/WebCore/platform/wx/FileSystemWx.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007 Kevin Ollivier
  * Copyright (C) 2008 Collabora, Ltd.
+ * Copyright (C) 2009 Peter Laufenberg @ Inhance Digital Corp
  *
  * All rights reserved.
  * 
@@ -34,13 +35,23 @@
 #include "PlatformString.h"
 
 #include <wx/wx.h>
+#include <wx/datetime.h>
+#include <wx/dir.h>
+#include <wx/dynlib.h>
+#include <wx/file.h>
+#include <wx/filefn.h>
 #include <wx/filename.h>
 
+#if PLATFORM(DARWIN)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
 namespace WebCore {
 
 bool fileExists(const String& path)
 {
-    return wxFileName::FileExists(path);
+    // NOTE: This is called for directory paths too so we need to check both.
+    return wxFileName::FileExists(path) || wxFileName::DirExists(path);
 }
 
 bool deleteFile(const String& path)
@@ -114,16 +125,71 @@ int writeToFile(PlatformFileHandle, const char* data, int length)
     return 0;
 }
 
-bool unloadModule(PlatformModule)
+bool unloadModule(PlatformModule mod)
 {
-    notImplemented();
-    return false;
+#if PLATFORM(WIN_OS)
+    return ::FreeLibrary(mod);
+#elif PLATFORM(DARWIN)
+    CFRelease(mod);
+    return true;
+#else
+    wxASSERT(mod);
+    delete mod;
+    return true;
+#endif
 }
 
+
+class wxDirTraverserNonRecursive : public wxDirTraverser {
+public:
+    wxDirTraverserNonRecursive(wxString basePath, wxArrayString& files) : m_basePath(basePath), m_files(files) { }
+
+    virtual wxDirTraverseResult OnFile(const wxString& filename)
+    {
+        wxFileName afile(filename);
+        afile.MakeRelativeTo(m_basePath);
+        if (afile.GetFullPath().Find(afile.GetPathSeparator()) == wxNOT_FOUND)
+            m_files.push_back(filename);
+
+        return wxDIR_CONTINUE;
+    }
+
+    virtual wxDirTraverseResult OnDir(const wxString& dirname)
+    {
+        wxFileName dirfile(dirname);
+        dirfile.MakeRelativeTo(m_basePath);
+        if (dirfile.GetFullPath().Find(dirfile.GetPathSeparator()) == wxNOT_FOUND)
+            m_files.push_back(dirname);
+
+        return wxDIR_CONTINUE;
+    }
+
+private:
+    wxString m_basePath;
+    wxArrayString& m_files;
+
+    DECLARE_NO_COPY_CLASS(wxDirTraverserNonRecursive)
+};
+
 Vector<String> listDirectory(const String& path, const String& filter)
 {
+    wxArrayString   file_paths;
+    // wxDir::GetAllFiles recurses and for platforms like Mac where
+    // a .plugin or .bundle can be a dir wx will recurse into the bundle
+    // and list the files rather than just returning the plugin name, so
+    // we write a special traverser that works around that issue.
+    wxDirTraverserNonRecursive traverser(path, file_paths);
+    
+    wxDir dir(path);
+    dir.Traverse(traverser, _T(""), wxDIR_FILES | wxDIR_DIRS);
+
     Vector<String> entries;
-    notImplemented();
+    
+    for (int i = 0; i < file_paths.GetCount(); i++)
+    {
+        entries.append(file_paths[i]);
+    }   
+    
     return entries;
 }
 
diff --git a/WebCore/platform/wx/LocalizedStringsWx.cpp b/WebCore/platform/wx/LocalizedStringsWx.cpp
index 5bede52..6a389f2 100644
--- a/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "LocalizedStrings.h"
 
+#include "NotImplemented.h"
 #include "PlatformString.h"
 
 namespace WebCore {
@@ -323,4 +324,46 @@ String AXDefinitionListDefinitionText()
     return String();
 }
 
+String validationMessageValueMissingText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTypeMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessagePatternMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageTooLongText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeUnderflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageRangeOverflowText()
+{
+    notImplemented();
+    return String();
+}
+
+String validationMessageStepMismatchText()
+{
+    notImplemented();
+    return String();
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.cpp b/WebCore/platform/wx/ScrollbarThemeWx.cpp
index 6904f41..82e4a15 100644
--- a/WebCore/platform/wx/ScrollbarThemeWx.cpp
+++ b/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -28,6 +28,7 @@
 
 #include "HostWindow.h"
 #include "NotImplemented.h"
+#include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
 #include "ScrollbarClient.h"
 #include "scrollbar_render.h"
@@ -70,6 +71,11 @@ bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
     return thumbLength(scrollbar) > 0;
 }
 
+int ScrollbarThemeWx::minimumThumbLength(Scrollbar* scrollbar)
+{
+    return 20;
+}
+
 IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
 {
 #ifdef __WXMAC__
@@ -79,6 +85,22 @@ IntSize ScrollbarThemeWx::buttonSize(Scrollbar*)
 #endif
 }
 
+void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+{
+    ScrollbarThemeComposite::splitTrack(scrollbar, unconstrainedTrackRect, beforeThumbRect, thumbRect, afterThumbRect);
+#ifdef __WXMAC__
+    // on Mac, there are a few pixels drawn above the actual track and so adjust
+    // the hit testing rects accordingly
+    int trackStart = 10; 
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        thumbRect.setX(thumbRect.x() + trackStart);
+        afterThumbRect.setX(afterThumbRect.x() - trackStart);
+    } else {
+        thumbRect.setY(thumbRect.y() + trackStart);
+        afterThumbRect.setY(afterThumbRect.y() - trackStart);
+    }
+#endif
+}
 
 IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
 {
@@ -111,10 +133,16 @@ IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     IntSize size = buttonSize(scrollbar);
     int x, y;
     if (scrollbar->orientation() == HorizontalScrollbar) {
+#ifdef __WXMAC__
+        size.setWidth(size.width() + cMacButtonOverlap);
+#endif
         x = scrollbar->x() + scrollbar->width() - size.width();
         y = scrollbar->y();
     } else {
         x = scrollbar->x();
+#ifdef __WXMAC__
+        size.setHeight(size.height() + cMacButtonOverlap);
+#endif
         y = scrollbar->y() + scrollbar->height() - size.height();
     }
     return IntRect(x, y, size.width(), size.height());
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.h b/WebCore/platform/wx/ScrollbarThemeWx.h
index 2b3bff0..79b10b3 100644
--- a/WebCore/platform/wx/ScrollbarThemeWx.h
+++ b/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -48,6 +48,10 @@ protected:
     virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
     virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
     virtual IntRect trackRect(Scrollbar*, bool painting = false);
+
+    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    
+    virtual int minimumThumbLength(Scrollbar*);
 };
 
 }
diff --git a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
index f74b076..3b4daa8 100644
--- a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
+++ b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
@@ -116,9 +116,18 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wx
     dc.SetPen(wxPen(wxSystemSettings::GetColour(wxSYS_COLOUR_BTNSHADOW)));
     dc.DrawRectangle(rect.x, rect.y, rect.width, rect.height);
 
+    // when going from Cairo -> Gdk, any Cairo context transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = wxDynamicCast(&dc, wxGCDC);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+
     wxRendererNative& renderer = wxRendererNative::Get();
-    int x = rect.x;
-    int y = rect.y;
+    int x = rect.x + (int)xtrans;
+    int y = rect.y + (int)ytrans;
 
     int buttonLength = 16;
 
@@ -138,13 +147,15 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wx
     physicalLength -= buttonLength*2;
     int thumbStart = 0;
     int thumbLength = 0;
-    calcThumbStartAndLength(physicalLength, max + step, current, step, &thumbStart, &thumbLength);
+    calcThumbStartAndLength(physicalLength, max, current, step, &thumbStart, &thumbLength);
 
     if (horiz) {
-        buttonRect.x = thumbStart + buttonLength;
+        buttonRect.x = x + thumbStart + buttonLength;
+        buttonRect.y = y;
         buttonRect.width = thumbLength;
     } else {
-        buttonRect.y = thumbStart + buttonLength;
+        buttonRect.x = x;
+        buttonRect.y = y + thumbStart + buttonLength;
         buttonRect.height = thumbLength;
     }
 
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index c4c4d48..47eb1f8 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -56,7 +56,7 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     wxGCDC* dc = static_cast<wxGCDC*>(graphicsContext->platformContext());
 
     wxFont* wxfont = font->getWxFont();
-    graphicsContext->setFillColor(graphicsContext->fillColor());
+    graphicsContext->setFillColor(graphicsContext->fillColor(), DeviceColorSpace);
 
     CGContextRef cgContext = static_cast<CGContextRef>(dc->GetGraphicsContext()->GetNativeContext());
 
diff --git a/WebCore/platform/wx/wxcode/scrollbar_render.h b/WebCore/platform/wx/wxcode/scrollbar_render.h
index 7a0ba1c..5e0ea8e 100644
--- a/WebCore/platform/wx/wxcode/scrollbar_render.h
+++ b/WebCore/platform/wx/wxcode/scrollbar_render.h
@@ -50,16 +50,17 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
                                        int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, 
                                        int max, int step, int flags=0);
 
-inline void calcThumbStartAndLength(int physicalLength, int virtualLength, int current, 
+inline void calcThumbStartAndLength(int physicalLength, int max, int current, 
                                 int step, int *thumbStart, int *thumbLength)
 {
-        float proportion = (float)physicalLength / virtualLength;
-        float scale = (float)virtualLength / physicalLength;
-        int thumbSize = proportion * physicalLength;
-        int currentPos = current / scale;
-        
+        float proportion = ((float)physicalLength - 8)/ (max + step);
+        float thumbSize =  proportion * (float)physicalLength;
+        if (thumbSize < 20)
+            thumbSize = 20;
+
+        float thumbPos = ((float)current / (float)max) * ((float)physicalLength - thumbSize);
         if (thumbStart)
-            *thumbStart = currentPos;
+            *thumbStart = thumbPos;
         
         if (thumbLength)
             *thumbLength = thumbSize;
diff --git a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
index 4d6bbc0..890db00 100644
--- a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
+++ b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
@@ -30,6 +30,8 @@
 #include <wx/defs.h>
 
 #include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/graphics.h>
 #include <wx/renderer.h>
 #include <wx/window.h>
 
@@ -131,8 +133,24 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
         part = SP_TRACKENDVERT;
 
     int xpState = TS_NORMAL;
+    wxRect transRect = rect;
+
+#if USE(WXGC)
+    // when going from GdiPlus -> Gdi, any GdiPlus transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = wxDynamicCast(&dc, wxGCDC);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+
+    transRect.x += (int)xtrans;
+    transRect.y += (int)ytrans;
+#endif
+
     RECT r;
-    wxCopyRectToRECT(rect, r);
+    wxCopyRectToRECT(transRect, r);
 
     // Unlike Mac, on MSW you draw the scrollbar piece by piece.
     // so we draw the track first, then the buttons
@@ -163,14 +181,14 @@ void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
         physicalLength -= buttonSize*2;
         int thumbStart = 0;
         int thumbLength = 0;
-        calcThumbStartAndLength(physicalLength, max + step, 
+        calcThumbStartAndLength(physicalLength, max, 
                             current, step, &thumbStart, &thumbLength);
         buttonRect = r;
         if (horiz) {
-            buttonRect.left = thumbStart + buttonSize;
+            buttonRect.left = buttonRect.left + thumbStart + buttonSize;
             buttonRect.right = buttonRect.left + thumbLength;
         } else {
-            buttonRect.top = thumbStart + buttonSize;
+            buttonRect.top = buttonRect.top + thumbStart + buttonSize;
             buttonRect.bottom = buttonRect.top + thumbLength;
         }
 
diff --git a/WebCore/plugins/PluginData.h b/WebCore/plugins/PluginData.h
index b2866bf..6960a25 100644
--- a/WebCore/plugins/PluginData.h
+++ b/WebCore/plugins/PluginData.h
@@ -29,14 +29,14 @@ namespace WebCore {
     class Page;
     struct PluginInfo;
 
-    struct MimeClassInfo {
+    struct MimeClassInfo : Noncopyable {
         String type;
         String desc;
         String suffixes;
         PluginInfo* plugin;
     };
 
-    struct PluginInfo {
+    struct PluginInfo : Noncopyable {
         String name;
         String file;
         String desc;
diff --git a/WebCore/plugins/PluginDatabase.cpp b/WebCore/plugins/PluginDatabase.cpp
index 25e6000..dcd7208 100644
--- a/WebCore/plugins/PluginDatabase.cpp
+++ b/WebCore/plugins/PluginDatabase.cpp
@@ -325,7 +325,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX) || !ENABLE(NETSCAPE_PLUGIN_API))
+#if (!PLATFORM(WINCE)) && (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || !ENABLE(NETSCAPE_PLUGIN_API))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -385,7 +385,7 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     // Add paths specific to each port
 #if PLATFORM(QT)
     Vector<String> qtPaths;
-    String qtPath(getenv("QTWEBKIT_PLUGIN_PATH"));
+    String qtPath(qgetenv("QTWEBKIT_PLUGIN_PATH").constData());
     qtPath.split(UChar(':'), /* allowEmptyEntries */ false, qtPaths);
     paths.append(qtPaths);
 #endif
diff --git a/WebCore/plugins/PluginDatabase.h b/WebCore/plugins/PluginDatabase.h
index fe74682..90214ca 100644
--- a/WebCore/plugins/PluginDatabase.h
+++ b/WebCore/plugins/PluginDatabase.h
@@ -51,7 +51,7 @@ namespace WebCore {
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
-    class PluginDatabase {
+    class PluginDatabase : public Noncopyable {
     public:
         PluginDatabase();
 
diff --git a/WebCore/plugins/PluginInfoStore.cpp b/WebCore/plugins/PluginInfoStore.cpp
index bd2f2d0..9a441f3 100644
--- a/WebCore/plugins/PluginInfoStore.cpp
+++ b/WebCore/plugins/PluginInfoStore.cpp
@@ -27,9 +27,15 @@
 #include "PluginInfoStore.h"
 
 #include "KURL.h"
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 #include "Page.h"
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 #include "PluginData.h"
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
@@ -96,8 +102,12 @@ bool PluginInfoStore::supportsMIMEType(const WebCore::String& mimeType)
 
 void refreshPlugins(bool reloadOpenPages)
 {
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
     Page::refreshPlugins(reloadOpenPages);
+<<<<<<< HEAD:WebCore/plugins/PluginInfoStore.cpp
 #else
     PluginDatabase::installedPlugins()->refresh();
 
@@ -105,6 +115,8 @@ void refreshPlugins(bool reloadOpenPages)
         // FIXME: reload open pages
     }
 #endif
+=======
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginInfoStore.cpp
 }
 
 }
diff --git a/WebCore/plugins/PluginMainThreadScheduler.h b/WebCore/plugins/PluginMainThreadScheduler.h
index 8872d56..610e89c 100644
--- a/WebCore/plugins/PluginMainThreadScheduler.h
+++ b/WebCore/plugins/PluginMainThreadScheduler.h
@@ -36,7 +36,7 @@ typedef NPP_t* NPP;
 
 namespace WebCore {
 
-class PluginMainThreadScheduler {
+class PluginMainThreadScheduler : public Noncopyable {
 public:
     typedef void MainThreadFunction(void*);
 
diff --git a/WebCore/plugins/PluginStream.cpp b/WebCore/plugins/PluginStream.cpp
index cd9f83d..4be3d13 100644
--- a/WebCore/plugins/PluginStream.cpp
+++ b/WebCore/plugins/PluginStream.cpp
@@ -120,6 +120,8 @@ void PluginStream::stop()
         m_loader->cancel();
         m_loader = 0;
     }
+
+    m_client = 0;
 }
 
 void PluginStream::startStream()
@@ -305,7 +307,7 @@ void PluginStream::destroyStream()
 
     m_streamState = StreamStopped;
 
-    if (!m_loadManually)
+    if (!m_loadManually && m_client)
         m_client->streamDidFinishLoading(this);
 
     if (!m_path.isNull()) {
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 0b2f6ec..3f40000 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -45,7 +45,7 @@
 #include "Page.h"
 #include "FocusController.h"
 #include "PlatformMouseEvent.h"
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
 #include "PluginMessageThrottlerWin.h"
 #endif
 #include "PluginPackage.h"
@@ -141,7 +141,7 @@ void PluginView::setFrameRect(const IntRect& rect)
 #if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
     // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
-#elif XP_UNIX
+#elif defined(XP_UNIX)
     // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
     if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
@@ -337,7 +337,6 @@ void PluginView::stop()
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
 #ifdef XP_WIN
     // Unsubclass the window
     if (m_isWindowed) {
@@ -354,7 +353,6 @@ void PluginView::stop()
 #endif
     }
 #endif // XP_WIN
-#endif // !PLATFORM(WX)
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
@@ -877,7 +875,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
 #if defined(XP_UNIX) || defined(Q_WS_X11)
     , m_needsXEmbed(false)
 #endif
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_pluginWndProc(0)
     , m_lastMessage(0)
     , m_isCallingPluginWndProc(false)
@@ -890,9 +888,11 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
 #if defined(XP_MACOSX)
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
+    , m_contextRef(0)
+    , m_fakeWindow(0)
 #endif
 #if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
-    , m_hasPendingGeometryChange(false)
+    , m_hasPendingGeometryChange(true)
     , m_drawable(0)
     , m_visual(0)
     , m_colormap(0)
@@ -1288,7 +1288,7 @@ void PluginView::paintMissingPluginIcon(GraphicsContext* context, const IntRect&
 
     context->save();
     context->clip(windowClipRect());
-    context->drawImage(nullPluginImage.get(), imageRect.location());
+    context->drawImage(nullPluginImage.get(), DeviceColorSpace, imageRect.location());
     context->restore();
 }
 
@@ -1333,4 +1333,9 @@ Node* PluginView::node() const
     return m_element;
 }
 
+String PluginView::pluginName() const
+{
+    return m_plugin->name();
+}
+
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index 8a5706f..dd2458e 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -2,6 +2,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,17 +47,24 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef PLUGIN_SCHEDULE_TIMER
 #include "PluginTimer.h"
 #endif
 
 #if PLATFORM(WIN_OS) && PLATFORM(QT)
+=======
+#if PLATFORM(WIN_OS) && (PLATFORM(QT) || PLATFORM(WX))
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginView.h
 typedef struct HWND__* HWND;
 typedef HWND PlatformPluginWidget;
 #elif defined(ANDROID_PLUGINS)
 typedef struct PluginWidgetAndroid* PlatformPluginWidget;
 #else
 typedef PlatformWidget PlatformPluginWidget;
+#if defined(XP_MACOSX) && PLATFORM(QT)
+#include <QPixmap>
+#endif
 #endif
 
 #if USE(JSC)
@@ -79,7 +87,7 @@ namespace WebCore {
     class TouchEvent;
 #endif
     class KURL;
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
     class PluginMessageThrottlerWin;
 #endif
     class PluginPackage;
@@ -94,7 +102,7 @@ namespace WebCore {
         PluginStatusLoadedSuccessfully
     };
 
-    class PluginRequest {
+    class PluginRequest : public Noncopyable {
     public:
         PluginRequest(const FrameLoadRequest& frameLoadRequest, bool sendNotification, void* notifyData, bool shouldAllowPopups)
             : m_frameLoadRequest(frameLoadRequest)
@@ -206,7 +214,7 @@ namespace WebCore {
         const String& mimeType() const { return m_mimeType; }
         const KURL& url() const { return m_url; }
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         static LRESULT CALLBACK PluginViewWndProc(HWND, UINT, WPARAM, LPARAM);
         LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
         WNDPROC pluginWndProc() const { return m_pluginWndProc; }
@@ -222,6 +230,8 @@ namespace WebCore {
         virtual void halt();
         virtual void restart();
         virtual Node* node() const;
+        virtual bool isWindowed() const { return m_isWindowed; }
+        virtual String pluginName() const;
 
         bool isHalted() const { return m_isHalted; }
         bool hasBeenHalted() const { return m_hasBeenHalted; }
@@ -254,7 +264,7 @@ namespace WebCore {
 
         void invalidateWindowlessPluginRect(const IntRect&);
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&);
         static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
         static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
@@ -335,7 +345,7 @@ namespace WebCore {
         bool m_needsXEmbed;
 #endif
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
+#if PLATFORM(WIN_OS) && ENABLE(NETSCAPE_PLUGIN_API)
         OwnPtr<PluginMessageThrottlerWin> m_messageThrottler;
         WNDPROC m_pluginWndProc;
         unsigned m_lastMessage;
@@ -344,11 +354,15 @@ namespace WebCore {
         bool m_haveUpdatedPluginWidget;
 #endif
 
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef PLUGIN_SCHEDULE_TIMER
         PluginTimerList m_timerList;
 #endif
 
 #if (PLATFORM(QT) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+=======
+#if ((PLATFORM(QT) || PLATFORM(WX)) && PLATFORM(WIN_OS)) || defined(XP_MACOSX)
+>>>>>>> webkit.org at r51976:WebCore/plugins/PluginView.h
         // On Mac OSX and Qt/Windows the plugin does not have its own native widget,
         // but is using the containing window as its reference for positioning/painting.
         PlatformPluginWidget m_window;
@@ -371,12 +385,15 @@ private:
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
-        OwnPtr<Timer<PluginView> > m_nullEventTimer;
         NPDrawingModel m_drawingModel;
         NPEventModel m_eventModel;
+        CGContextRef m_contextRef;
+        WindowRef m_fakeWindow;
+#if PLATFORM(QT)
+        QPixmap m_pixmap;
+#endif
 
         void setNPWindowIfNeeded();
-        void nullEventTimerFired(Timer<PluginView>*);
         Point globalMousePosForPlugin() const;
 #endif
 
diff --git a/WebCore/plugins/chromium/PluginDataChromium.cpp b/WebCore/plugins/chromium/PluginDataChromium.cpp
index 3df81af..5c28643 100644
--- a/WebCore/plugins/chromium/PluginDataChromium.cpp
+++ b/WebCore/plugins/chromium/PluginDataChromium.cpp
@@ -29,7 +29,7 @@
  */
 
 #include "config.h"
-#include "PluginData.h"
+#include "PluginDataChromium.h"
 
 #include "ChromiumBridge.h"
 
diff --git a/WebCore/html/canvas/CanvasArray.idl b/WebCore/plugins/chromium/PluginDataChromium.h
index 63b2dcd..78701b4 100644
--- a/WebCore/html/canvas/CanvasArray.idl
+++ b/WebCore/plugins/chromium/PluginDataChromium.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +23,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module html {
-    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
-        readonly attribute long length;
-        int sizeInBytes();
-        int alignedSizeInBytes();
-    };
-}
+#ifndef PluginDataChromium_h
+#define PluginDataChromium_h
+
+#include "PluginData.h"
+
+namespace WebCore {
+
+// Checks if any of the plugins handle this extension, and if so returns the
+// plugin's mime type for this extension.  Otherwise returns an empty string.
+String getPluginMimeTypeFromExtension(const String& extension);
+
+} // namespace WebCore
+
+#endif // PluginDataChromium_h
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index bc3a622..6ea9417 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -227,7 +227,7 @@ void PluginView::setNPWindowIfNeeded()
 
     GtkAllocation allocation = { m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height() };
     gtk_widget_size_allocate(platformPluginWidget(), &allocation);
-#if PLATFORM(XP_UNIX)
+#if defined(XP_UNIX)
     if (!m_needsXEmbed) {
         gtk_xtbin_set_position(GTK_XTBIN(platformPluginWidget()), m_windowRect.x(), m_windowRect.y());
         gtk_xtbin_resize(platformPluginWidget(), m_windowRect.width(), m_windowRect.height());
@@ -332,7 +332,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         return NPERR_GENERIC_ERROR;
 #endif
 
-#if PLATFORM(XP_UNIX)
+#if defined(XP_UNIX)
     case NPNVxtAppContext:
         if (!m_needsXEmbed) {
             *(void **)value = XtDisplayToApplicationContext (GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay);
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index 325bc4d..4aef3a0 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -177,7 +177,7 @@ bool PluginPackage::fetchInfo()
 
             WTF::RetainPtr<CFDictionaryRef> extensionsDict = (CFDictionaryRef)values[i];
 
-            WTF:RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
+            WTF::RetainPtr<CFNumberRef> enabled = (CFNumberRef)CFDictionaryGetValue(extensionsDict.get(), CFSTR("WebPluginTypeEnabled"));
             if (enabled) {
                 int enabledValue = 0;
                 if (CFNumberGetValue(enabled.get(), kCFNumberIntType, &enabledValue) && enabledValue == 0)
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index 6521c84..44a0262 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,6 +76,7 @@ using JSC::UString;
 #if PLATFORM(QT)
 #include <QWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include "QWebPageClient.h"
 QT_BEGIN_NAMESPACE
 #if QT_VERSION < 0x040500
@@ -85,6 +87,11 @@ extern Q_GUI_EXPORT OSWindowRef qt_mac_window_for(const QWidget* w);
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/wx.h>
+#endif
+
 using std::min;
 
 using namespace WTF;
@@ -101,6 +108,10 @@ static inline WindowRef nativeWindowFor(PlatformWidget widget)
     if (widget)
         return static_cast<WindowRef>(qt_mac_window_for(widget));
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (WindowRef)widget->MacGetTopLevelWindowRef();
+#endif
     return 0;
 }
 
@@ -110,6 +121,10 @@ static inline CGContextRef cgHandleFor(PlatformWidget widget)
     if (widget)
         return (CGContextRef)widget->macCGHandle();
 #endif
+#if PLATFORM(WX)
+    if (widget)
+        return (CGContextRef)widget->MacGetCGContextRef();
+#endif
     return 0;
 }
 
@@ -121,6 +136,12 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
         return widget->mapTo(topLevel, QPoint(0, 0)) + topLevel->geometry().topLeft() - topLevel->pos();
     }
 #endif
+#if PLATFORM(WX)
+    if (widget) {
+        PlatformWidget toplevel = wxGetTopLevelParent(widget);
+        return toplevel->ScreenToClient(widget->GetScreenPosition());
+    }
+#endif
     return IntPoint();
 }
 
@@ -173,18 +194,29 @@ bool PluginView::platformStart()
     }
 
 #if PLATFORM(QT)
+    // Set the platformPluginWidget only in the case of QWebView so that the context menu appears in the right place.
+    // In all other cases, we use off-screen rendering
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* widget = client->ownerWidget()) {
+        if (QWidget* widget = qobject_cast<QWidget*>(client->pluginParent()))
             setPlatformPluginWidget(widget);
-        }
     }
 #endif
+#if PLATFORM(WX)
+    if (wxWindow* widget = m_parentFrame->view()->hostWindow()->platformPageClient())
+        setPlatformPluginWidget(widget);
+#endif
 
-    show();
+    // Create a fake window relative to which all events will be sent when using offscreen rendering
+    if (!platformPluginWidget()) {
+        // Make the default size really big. It is unclear why this is required but with a smaller size, mouse move
+        // events don't get processed. Resizing the fake window to flash's size doesn't help.
+        ::Rect windowBounds = { 0, 0, 1000, 1000 };
+        CreateNewWindow(kDocumentWindowClass, kWindowStandardDocumentAttributes, &windowBounds, &m_fakeWindow);
+        // Flash requires the window to be hilited to process mouse move events.
+        HiliteWindow(m_fakeWindow, true); 
+    }
 
-    // TODO: Implement null timer throttling depending on plugin activation
-    m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
-    m_nullEventTimer->startRepeating(0.02);
+    show();
 
     return true;
 }
@@ -193,6 +225,11 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget())
         setPlatformPluginWidget(0);
+    else {
+        CGContextRelease(m_contextRef);
+        if (m_fakeWindow)
+            DisposeWindow(m_fakeWindow);
+    }
 }
 
 // Used before the plugin view has been initialized properly, and as a
@@ -322,7 +359,11 @@ void PluginView::setFocus()
     LOG(Plugins, "PluginView::setFocus()");
 
     if (platformPluginWidget())
+#if PLATFORM(QT)
        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+#else
+        platformPluginWidget()->SetFocus();
+#endif
    else
        Widget::setFocus();
 
@@ -357,15 +398,21 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
-    CGContextRef newContextRef = cgHandleFor(platformPluginWidget());
-    if (!newContextRef)
-        return;
+    CGContextRef newContextRef = 0;
+    WindowRef newWindowRef = 0;
+    if (platformPluginWidget()) {
+        newContextRef = cgHandleFor(platformPluginWidget());
+        newWindowRef = nativeWindowFor(platformPluginWidget());
+        m_npWindow.type = NPWindowTypeWindow;
+    } else {
+        newContextRef = m_contextRef;
+        newWindowRef = m_fakeWindow;
+        m_npWindow.type = NPWindowTypeDrawable;
+    }
 
-    WindowRef newWindowRef = nativeWindowFor(platformPluginWidget());
-    if (!newWindowRef)
+    if (!newContextRef || !newWindowRef)
         return;
 
-    m_npWindow.type = NPWindowTypeWindow;
     m_npWindow.window = (void*)&m_npCgContext;
     m_npCgContext.window = newWindowRef;
     m_npCgContext.context = newContextRef;
@@ -382,7 +429,7 @@ void PluginView::setNPWindowIfNeeded()
     m_npWindow.clipRect.bottom = m_windowRect.y() + m_windowRect.height();
 
     LOG(Plugins, "PluginView::setNPWindowIfNeeded(): window=%p, context=%p,"
-            " window.x:%d window.y:%d window.width:%d window.height:%d window.clipRect size:%dx%d",
+            " window.x:%ld window.y:%ld window.width:%d window.height:%d window.clipRect size:%dx%d",
             newWindowRef, newContextRef, m_npWindow.x, m_npWindow.y, m_npWindow.width, m_npWindow.height,
             m_npWindow.clipRect.right - m_npWindow.clipRect.left, m_npWindow.clipRect.bottom - m_npWindow.clipRect.top);
 
@@ -409,6 +456,17 @@ void PluginView::updatePluginWidget()
     IntPoint offset = topLevelOffsetFor(platformPluginWidget());
     m_windowRect.move(offset.x(), offset.y());
 
+    if (!platformPluginWidget()) {
+        if (m_windowRect.size() != oldWindowRect.size()) {
+            CGContextRelease(m_contextRef);
+#if PLATFORM(QT)
+            m_pixmap = QPixmap(m_windowRect.size());
+            m_pixmap.fill(Qt::transparent);
+            m_contextRef = qt_mac_cg_context(&m_pixmap);
+#endif
+        }
+    }
+
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
 
@@ -433,8 +491,29 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     CGContextSaveGState(cgContext);
-    IntPoint offset = frameRect().location();
-    CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    if (platformPluginWidget()) {
+        IntPoint offset = frameRect().location();
+        CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+    }
+
+    IntRect targetRect(frameRect());
+    targetRect.intersects(rect);
+
+    // clip the context so that plugin only updates the interested area.
+    CGRect r;
+    r.origin.x = targetRect.x() - frameRect().x();
+    r.origin.y = targetRect.y() - frameRect().y();
+    r.size.width = targetRect.width();
+    r.size.height = targetRect.height();
+    CGContextClipToRect(cgContext, r);
+
+    if (!platformPluginWidget() && m_isTransparent) { // clean the pixmap in transparent mode
+#if PLATFORM(QT)
+        QPainter painter(&m_pixmap);
+        painter.setCompositionMode(QPainter::CompositionMode_Clear);
+        painter.fillRect(QRectF(r.origin.x, r.origin.y, r.size.width, r.size.height), Qt::transparent);
+#endif
+    }
 
     EventRecord event;
     event.what = updateEvt;
@@ -448,18 +527,32 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         LOG(Events, "PluginView::paint(): Paint event not accepted");
 
     CGContextRestoreGState(cgContext);
+
+    if (!platformPluginWidget()) {
+#if PLATFORM(QT)
+        QPainter* painter = context->platformContext();
+        painter->drawPixmap(targetRect.x(), targetRect.y(), m_pixmap, 
+                            targetRect.x() - frameRect().x(), targetRect.y() - frameRect().y(), targetRect.width(), targetRect.height());
+#endif
+    }
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
     if (platformPluginWidget())
+#if PLATFORM(QT)
         platformPluginWidget()->update(convertToContainingWindow(rect));
+#else
+        platformPluginWidget()->RefreshRect(convertToContainingWindow(rect));
+#endif
+    else
+        invalidateWindowlessPluginRect(rect);
 }
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    // TODO: optimize
-    invalidate();
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    invalidateRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
@@ -484,8 +577,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     EventRecord record;
 
     if (event->type() == eventNames().mousemoveEvent) {
-        // Mouse movement is handled by null timer events
-        return;
+        record.what = nullEvent;
     } else if (event->type() == eventNames().mouseoverEvent) {
         record.what = adjustCursorEvent;
     } else if (event->type() == eventNames().mouseoutEvent) {
@@ -502,7 +594,20 @@ void PluginView::handleMouseEvent(MouseEvent* event)
         return;
     }
 
-    record.where = globalMousePosForPlugin();
+    if (platformPluginWidget()) {
+        record.where = globalMousePosForPlugin();
+    } else {
+        if (event->button() == 2) {
+            // always pass the global position for right-click since Flash uses it to position the context menu
+            record.where = globalMousePosForPlugin();
+        } else {
+            IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+            record.where.h = postZoomPos.x() + m_windowRect.x();
+            // The number 22 is the height of the title bar. As to why it figures in the calculation below 
+            // is left as an exercise to the reader :-)
+            record.where.v = postZoomPos.y() + m_windowRect.y() - 22;
+        }
+    }
     record.modifiers = modifiersForEvent(event);
 
     if (!event->buttonDown())
@@ -583,8 +688,10 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
 
     LOG(Plugins, "PV::hKE(): record.modifiers: %d", record.modifiers);
 
+#if PLATFORM(QT)
     LOG(Plugins, "PV::hKE(): PKE.qtEvent()->nativeVirtualKey: 0x%02X, charCode: %d",
                keyCode, int(uchar(charCodes[0])));
+#endif
 
     if (!dispatchNPEvent(record))
         LOG(Events, "PluginView::handleKeyboardEvent(): Keyboard event type %d not accepted", record.what);
@@ -592,22 +699,6 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
-void PluginView::nullEventTimerFired(Timer<PluginView>*)
-{
-    EventRecord record;
-
-    record.what = nullEvent;
-    record.message = 0;
-    record.when = TickCount();
-    record.where = globalMousePosForPlugin();
-    record.modifiers = GetCurrentKeyModifiers();
-    if (!Button())
-        record.modifiers |= btnState;
-
-    if (!dispatchNPEvent(record))
-        LOG(Events, "PluginView::nullEventTimerFired(): Null event not accepted");
-}
-
 static int modifiersForEvent(UIEventWithKeyState* event)
 {
     int modifiers = 0;
@@ -649,6 +740,18 @@ Point PluginView::globalMousePosForPlugin() const
     pos.h = short(pos.h * scaleFactor);
     pos.v = short(pos.v * scaleFactor);
 
+#if PLATFORM(WX)
+    // make sure the titlebar/toolbar size is included
+    WindowRef windowRef = nativeWindowFor(platformPluginWidget());
+    ::Rect content, structure;
+
+    GetWindowBounds(windowRef, kWindowStructureRgn, &structure);
+    GetWindowBounds(windowRef, kWindowContentRgn, &content);
+
+    int top = content.top  - structure.top;
+    pos.v -= top;
+#endif
+
     return pos;
 }
 
diff --git a/WebCore/plugins/qt/PluginDataQt.cpp b/WebCore/plugins/qt/PluginDataQt.cpp
index 5478d38..a836937 100644
--- a/WebCore/plugins/qt/PluginDataQt.cpp
+++ b/WebCore/plugins/qt/PluginDataQt.cpp
@@ -24,18 +24,15 @@
 #include "PluginDatabase.h"
 #include "PluginPackage.h"
 
-#if QT_VERSION >= 0x040400
 #include "ChromeClientQt.h"
 #include "Page.h"
 #include <qwebpage.h>
 #include <qwebpluginfactory.h>
-#endif
 
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-#if QT_VERSION >= 0x040400
     QWebPage* webPage = static_cast<ChromeClientQt*>(m_page->chrome()->client())->m_webPage;
     QWebPluginFactory* factory = webPage->pluginFactory();
     if (factory) {
@@ -62,7 +59,6 @@ void PluginData::initPlugins()
             m_plugins.append(info);
         }
     }
-#endif
 
     PluginDatabase *db = PluginDatabase::installedPlugins();
     const Vector<PluginPackage*> &plugins = db->plugins();
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index e61736b..063a7e5 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -138,26 +138,14 @@ void PluginView::setFocus()
 
 void PluginView::show()
 {
-    setSelfVisible(true);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(true);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to visible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::show();
 }
 
 void PluginView::hide()
 {
-    setSelfVisible(false);
-
-    if (isParentVisible() && platformPluginWidget())
-        platformPluginWidget()->setVisible(false);
-
-    // do not call parent impl. here as it will set the platformWidget
-    // (same as platformPluginWidget in the Qt port) to invisible, even
-    // when parent isn't visible.
+    Q_ASSERT(platformPluginWidget() == platformWidget());
+    Widget::hide();
 }
 
 void PluginView::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 5ccce0e..89eecc6 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -30,7 +30,9 @@
 #include "PluginView.h"
 
 #include "BitmapImage.h"
+#if !PLATFORM(WX)
 #include "BitmapInfo.h"
+#endif
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -81,12 +83,21 @@
 #include <QWidget>
 #endif
 
+#if PLATFORM(WX)
+#include <wx/defs.h>
+#include <wx/window.h>
+#endif
+
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
 #if PLATFORM(QT)
     if (!client)
         return 0;
     return client->ownerWidget()->winId();
+#elif PLATFORM(WX)
+    if (!client)
+        return 0;
+    return (HWND)client->GetHandle();
 #else
     return client;
 #endif
@@ -145,7 +156,7 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
          "push    %3\n"
          "call    *%4\n"
          : "=a" (result)
-         : "a" (beginPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*beginPaint)
+         : "a" (beginPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (beginPaint)
          : "memory"
         );
     return result;
@@ -175,7 +186,7 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
          "push   %3\n"
          "call   *%4\n"
          : "=a" (result)
-         : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*endPaint)
+         : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (endPaint)
         );
     return result;
 #elif defined (_M_IX86)
@@ -702,7 +713,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 
-#if !PLATFORM(QT) && !PLATFORM(WINCE)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(WINCE)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
     ignoreNextSetCursor = true;
@@ -987,7 +998,7 @@ bool PluginView::platformStart()
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
                                        0, 0, 0, 0, parentWindowHandle, 0, Page::instanceHandle(), 0);
 
-#if PLATFORM(WIN_OS) && PLATFORM(QT)
+#if PLATFORM(WIN_OS) && (PLATFORM(QT) || PLATFORM(WX))
         m_window = window;
 #else
         setPlatformWidget(window);
@@ -1030,6 +1041,7 @@ void PluginView::platformDestroy()
 
 PassRefPtr<Image> PluginView::snapshot()
 {
+#if !PLATFORM(WX)
     OwnPtr<HDC> hdc(CreateCompatibleDC(0));
 
     if (!m_isWindowed) {
@@ -1059,6 +1071,9 @@ PassRefPtr<Image> PluginView::snapshot()
     SelectObject(hdc.get(), hbmpOld);
 
     return BitmapImage::create(hbmp.get());
+#else
+    return 0;
+#endif
 }
 
 void PluginView::halt()
diff --git a/WebCore/plugins/wx/PluginDataWx.cpp b/WebCore/plugins/wx/PluginDataWx.cpp
new file mode 100644
index 0000000..58ee315
--- /dev/null
+++ b/WebCore/plugins/wx/PluginDataWx.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com> All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "PluginData.h"
+
+#include "NotImplemented.h"
+#include "PluginDatabase.h"
+#include "PluginPackage.h"
+
+namespace WebCore {
+
+void PluginData::initPlugins()
+{
+    PluginDatabase* db = PluginDatabase::installedPlugins();
+    const Vector<PluginPackage*> &plugins = db->plugins();
+
+    for (unsigned int i = 0; i < plugins.size(); ++i) {
+        PluginInfo* info = new PluginInfo;
+        PluginPackage* package = plugins[i];
+
+        info->name = package->name();
+        info->file = package->fileName();
+        info->desc = package->description();
+
+        const MIMEToDescriptionsMap& mimeToDescriptions = package->mimeToDescriptions();
+        MIMEToDescriptionsMap::const_iterator end = mimeToDescriptions.end();
+        for (MIMEToDescriptionsMap::const_iterator it = mimeToDescriptions.begin(); it != end; ++it) {
+            MimeClassInfo* mime = new MimeClassInfo;
+            info->mimes.append(mime);
+
+            mime->type = it->first;
+            mime->desc = it->second;
+            mime->plugin = info;
+
+            Vector<String> extensions = package->mimeToExtensions().get(mime->type);
+
+            for (unsigned i = 0; i < extensions.size(); i++) {
+                if (i > 0)
+                    mime->suffixes += ",";
+
+                mime->suffixes += extensions[i];
+            }
+        }
+
+        m_plugins.append(info);
+    }
+}
+
+void PluginData::refresh()
+{
+    notImplemented();
+}
+
+};
diff --git a/WebCore/rendering/AutoTableLayout.h b/WebCore/rendering/AutoTableLayout.h
index 641a68b..f1ef768 100644
--- a/WebCore/rendering/AutoTableLayout.h
+++ b/WebCore/rendering/AutoTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index f546abb..95a3748 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  *
@@ -46,7 +44,58 @@ CounterNode::CounterNode(RenderObject* o, bool isReset, int value)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
-{   
+{
+}
+
+CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
+{
+    if (this == stayWithin)
+        return 0;
+
+    CounterNode* next = m_nextSibling;
+    if (next)
+        return next;
+    next = m_parent;
+    while (next && !next->m_nextSibling) {
+        if (next == stayWithin)
+            return 0;
+        next = next->m_parent;
+    }
+    if (next)
+        return next->m_nextSibling;
+    return 0;
+}
+
+CounterNode* CounterNode::nextInPreOrder(const CounterNode* stayWithin) const
+{
+    if (CounterNode* next = m_firstChild)
+        return next;
+
+    return nextInPreOrderAfterChildren(stayWithin);
+}
+
+CounterNode* CounterNode::lastDescendant() const
+{
+    CounterNode* last = m_lastChild;
+    if (!last)
+        return 0;
+
+    while (CounterNode* lastChild = last->m_lastChild)
+        last = lastChild;
+
+    return last;
+}
+
+CounterNode* CounterNode::previousInPreOrder() const
+{
+    CounterNode* previous = m_previousSibling;
+    if (!previous)
+        return m_parent;
+
+    while (CounterNode* lastChild = previous->m_lastChild)
+        previous = lastChild;
+
+    return previous;
 }
 
 int CounterNode::computeCountInParent() const
@@ -58,26 +107,37 @@ int CounterNode::computeCountInParent() const
     return m_parent->m_value + increment;
 }
 
-void CounterNode::recount()
+
+void CounterNode::resetRenderer(const AtomicString& identifier) const
+{
+    if (!m_renderer || m_renderer->documentBeingDestroyed())
+        return;
+    if (RenderObjectChildList* children = m_renderer->virtualChildren())
+        children->invalidateCounters(m_renderer, identifier);
+}
+
+void CounterNode::resetRenderers(const AtomicString& identifier) const
+{
+    const CounterNode* node = this;
+    do {
+        node->resetRenderer(identifier);
+        node = node->nextInPreOrder(this);
+    } while (node);
+}
+
+void CounterNode::recount(const AtomicString& identifier)
 {
-    for (CounterNode* c = this; c; c = c->m_nextSibling) {
-        int oldCount = c->m_countInParent;
-        int newCount = c->computeCountInParent();
+    for (CounterNode* node = this; node; node = node->m_nextSibling) {
+        int oldCount = node->m_countInParent;
+        int newCount = node->computeCountInParent();
         if (oldCount == newCount)
             break;
-        c->m_countInParent = newCount;
-        // m_renderer contains the parent of the render node
-        // corresponding to a CounterNode. Let's find the counter
-        // child and make this re-layout.
-        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
-            if (!o->documentBeingDestroyed() && o->isCounter()) {
-                o->setNeedsLayoutAndPrefWidthsRecalc();
-                break;
-            }
+        node->m_countInParent = newCount;
+        node->resetRenderers(identifier);
     }
 }
 
-void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
+void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, const AtomicString& identifier)
 {
     ASSERT(newChild);
     ASSERT(!newChild->m_parent);
@@ -109,77 +169,56 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild)
 
     newChild->m_countInParent = newChild->computeCountInParent();
     if (next)
-        next->recount();
+        next->recount(identifier);
 }
 
-void CounterNode::removeChild(CounterNode* oldChild)
+void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identifier)
 {
     ASSERT(oldChild);
     ASSERT(!oldChild->m_firstChild);
     ASSERT(!oldChild->m_lastChild);
 
     CounterNode* next = oldChild->m_nextSibling;
-    CounterNode* prev = oldChild->m_previousSibling;
+    CounterNode* previous = oldChild->m_previousSibling;
 
     oldChild->m_nextSibling = 0;
     oldChild->m_previousSibling = 0;
     oldChild->m_parent = 0;
 
-    if (prev) 
-        prev->m_nextSibling = next;
+    if (previous) 
+        previous->m_nextSibling = next;
     else {
         ASSERT(m_firstChild == oldChild);
         m_firstChild = next;
     }
-    
+
     if (next)
-        next->m_previousSibling = prev;
+        next->m_previousSibling = previous;
     else {
         ASSERT(m_lastChild == oldChild);
-        m_lastChild = prev;
+        m_lastChild = previous;
     }
-    
+
     if (next)
-        next->recount();
+        next->recount(identifier);
 }
 
 #ifndef NDEBUG
 
-static const CounterNode* nextInPreOrderAfterChildren(const CounterNode* node)
-{
-    CounterNode* next = node->nextSibling();
-    if (!next) {
-        next = node->parent();
-        while (next && !next->nextSibling())
-            next = next->parent();
-        if (next)
-            next = next->nextSibling();
-    }
-    return next;
-}
-
-static const CounterNode* nextInPreOrder(const CounterNode* node)
-{
-    if (CounterNode* child = node->firstChild())
-        return child;
-    return nextInPreOrderAfterChildren(node);
-}
-
 static void showTreeAndMark(const CounterNode* node)
 {
     const CounterNode* root = node;
     while (root->parent())
         root = root->parent();
 
-    for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
-        if (c == node)
-            fprintf(stderr, "*");
-        for (const CounterNode* d = c; d && d != root; d = d->parent())
-            fprintf(stderr, "\t");
-        if (c->isReset())
-            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
-        else
-            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
+    for (const CounterNode* current = root; current; current = current->nextInPreOrder()) {
+        fwrite((current == node) ? "*" : " ", 1, 1, stderr);
+        for (const CounterNode* parent = current; parent && parent != root; parent = parent->parent())
+            fwrite("  ", 1, 2, stderr);
+        fprintf(stderr, "%p %s: %d %d P:%p PS:%p NS:%p R:%p\n",
+            current, current->isReset() ? "reset____" : "increment", current->value(),
+            current->countInParent(), current->parent(), current->previousSibling(),
+            current->nextSibling(), current->renderer());
     }
 }
 
diff --git a/WebCore/rendering/CounterNode.h b/WebCore/rendering/CounterNode.h
index b432e1d..8081dc6 100644
--- a/WebCore/rendering/CounterNode.h
+++ b/WebCore/rendering/CounterNode.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class CounterNode : public Noncopyable {
@@ -51,13 +52,19 @@ public:
     CounterNode* nextSibling() const { return m_nextSibling; }
     CounterNode* firstChild() const { return m_firstChild; }
     CounterNode* lastChild() const { return m_lastChild; }
+    CounterNode* lastDescendant() const;
+    CounterNode* previousInPreOrder() const;
+    CounterNode* nextInPreOrder(const CounterNode* stayWithin = 0) const;
+    CounterNode* nextInPreOrderAfterChildren(const CounterNode* stayWithin = 0) const;
 
-    void insertAfter(CounterNode* newChild, CounterNode* beforeChild);
-    void removeChild(CounterNode*);
+    void insertAfter(CounterNode* newChild, CounterNode* beforeChild, const AtomicString& identifier);
+    void removeChild(CounterNode*, const AtomicString& identifier);
 
 private:
     int computeCountInParent() const;
-    void recount();
+    void recount(const AtomicString& identifier);
+    void resetRenderer(const AtomicString& identifier) const;
+    void resetRenderers(const AtomicString& identifier) const;
 
     bool m_isReset;
     int m_value;
diff --git a/WebCore/rendering/EllipsisBox.cpp b/WebCore/rendering/EllipsisBox.cpp
index db9a101..bea9d73 100644
--- a/WebCore/rendering/EllipsisBox.cpp
+++ b/WebCore/rendering/EllipsisBox.cpp
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
@@ -34,11 +32,11 @@ void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     RenderStyle* style = m_renderer->style(m_firstLine);
     Color textColor = style->color();
     if (textColor != context->fillColor())
-        context->setFillColor(textColor);
+        context->setFillColor(textColor, style->colorSpace());
     bool setShadow = false;
     if (style->textShadow()) {
         context->setShadow(IntSize(style->textShadow()->x, style->textShadow()->y),
-                           style->textShadow()->blur, style->textShadow()->color);
+                           style->textShadow()->blur, style->textShadow()->color, style->colorSpace());
         setShadow = true;
     }
 
diff --git a/WebCore/rendering/EllipsisBox.h b/WebCore/rendering/EllipsisBox.h
index 9dbd27f..a228d7a 100644
--- a/WebCore/rendering/EllipsisBox.h
+++ b/WebCore/rendering/EllipsisBox.h
@@ -1,6 +1,4 @@
 /**
-* This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index 4852708..09af518 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
diff --git a/WebCore/rendering/FixedTableLayout.h b/WebCore/rendering/FixedTableLayout.h
index ed7c089..758ddbb 100644
--- a/WebCore/rendering/FixedTableLayout.h
+++ b/WebCore/rendering/FixedTableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
diff --git a/WebCore/rendering/HitTestRequest.h b/WebCore/rendering/HitTestRequest.h
index 46dd7b8..ca1445a 100644
--- a/WebCore/rendering/HitTestRequest.h
+++ b/WebCore/rendering/HitTestRequest.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
  *
diff --git a/WebCore/rendering/HitTestResult.h b/WebCore/rendering/HitTestResult.h
index 25e1058..d1906ba 100644
--- a/WebCore/rendering/HitTestResult.h
+++ b/WebCore/rendering/HitTestResult.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index baea956..2bd1683 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -974,6 +974,7 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
             setClip = true;
         }
 
+        ColorSpace colorSpace = renderer()->style()->colorSpace();
         bool setShadow = false;
         do {
             if (shadow) {
@@ -982,24 +983,24 @@ void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int
                     ty -= extraOffset;
                     extraOffset = 0;
                 }
-                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+                context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
                 setShadow = true;
                 shadow = shadow->next;
             }
 
             if (paintUnderline) {
-                context->setStrokeColor(underline);
+                context->setStrokeColor(underline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 // Leave one pixel of white between the baseline and the underline.
                 context->drawLineForText(IntPoint(tx, ty + baselinePos + 1), w, isPrinting);
             }
             if (paintOverline) {
-                context->setStrokeColor(overline);
+                context->setStrokeColor(overline, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty), w, isPrinting);
             }
             if (paintLineThrough) {
-                context->setStrokeColor(linethrough);
+                context->setStrokeColor(linethrough, colorSpace);
                 context->setStrokeStyle(SolidStroke);
                 context->drawLineForText(IntPoint(tx, ty + 2 * baselinePos / 3), w, isPrinting);
             }
diff --git a/WebCore/rendering/InlineRunBox.h b/WebCore/rendering/InlineRunBox.h
index 0f7c29b..cbc82d5 100644
--- a/WebCore/rendering/InlineRunBox.h
+++ b/WebCore/rendering/InlineRunBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the line box implementation for KDE.
- *
  * Copyright (C) 2003, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 751340d..31e6967 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -214,7 +214,7 @@ Color correctedTextColor(Color textColor, Color backgroundColor)
     return textColor.light();
 }
 
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness)
+void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace colorSpace)
 {
     int mode = context->textDrawingMode();
     if (strokeThickness > 0) {
@@ -225,12 +225,12 @@ void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, con
         }
     }
     
-    if (mode & cTextFill && fillColor != context->fillColor())
-        context->setFillColor(fillColor);
+    if (mode & cTextFill && (fillColor != context->fillColor() || colorSpace != context->fillColorSpace()))
+        context->setFillColor(fillColor, colorSpace);
 
     if (mode & cTextStroke) {
         if (strokeColor != context->strokeColor())
-            context->setStrokeColor(strokeColor);
+            context->setStrokeColor(strokeColor, colorSpace);
         if (strokeThickness != context->strokeThickness())
             context->setStrokeThickness(strokeThickness);
     }
@@ -257,9 +257,10 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
 static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, const IntPoint& textOrigin, int x, int y, int w, int h, ShadowData* shadow, bool stroked)
 {
     Color fillColor = context->fillColor();
+    ColorSpace fillColorSpace = context->fillColorSpace();
     bool opaque = fillColor.alpha() == 255;
     if (!opaque)
-        context->setFillColor(Color::black);
+        context->setFillColor(Color::black, fillColorSpace);
 
     do {
         IntSize extraOffset;
@@ -279,9 +280,9 @@ static void paintTextWithShadows(GraphicsContext* context, const Font& font, con
                 extraOffset = IntSize(0, 2 * h + max(0, shadowOffset.height()) + shadowBlur);
                 shadowOffset -= extraOffset;
             }
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, fillColorSpace);
         } else if (!opaque)
-            context->setFillColor(fillColor);
+            context->setFillColor(fillColor, fillColorSpace);
 
         if (startOffset <= endOffset)
             context->drawText(font, textRun, textOrigin + extraOffset, startOffset, endOffset);
@@ -465,7 +466,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (textStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth);
+        updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
         if (!paintSelectedTextSeparately || ePos <= sPos) {
             // FIXME: Truncate right-to-left text correctly.
             paintTextWithShadows(context, font, textRun, 0, m_truncation == cNoTruncation ? m_len : m_truncation, textOrigin, m_x + tx, m_y + ty, width(), height(), textShadow, textStrokeWidth > 0);
@@ -481,7 +482,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         if (selectionStrokeWidth > 0)
             context->save();
 
-        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth);
+        updateGraphicsContext(context, selectionFillColor, selectionStrokeColor, selectionStrokeWidth, styleToUse->colorSpace());
         paintTextWithShadows(context, font, textRun, sPos, ePos, textOrigin, m_x + tx, m_y + ty, width(), height(), selectionShadow, selectionStrokeWidth > 0);
 
         if (selectionStrokeWidth > 0)
@@ -490,7 +491,7 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     // Paint decorations
     if (d != TDNONE && paintInfo.phase != PaintPhaseSelection && styleToUse->htmlHacks()) {
-        context->setStrokeColor(styleToUse->color());
+        context->setStrokeColor(styleToUse->color(), styleToUse->colorSpace());
         paintDecoration(context, tx, ty, d, textShadow);
     }
 
@@ -561,13 +562,13 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
         c = Color(0xff - c.red(), 0xff - c.green(), 0xff - c.blue());
 
     context->save();
-    updateGraphicsContext(context, c, c, 0);  // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace());  // Don't draw text at all!
     int y = selectionTop();
     int h = selectionHeight();
     context->clip(IntRect(m_x + tx, y + ty, m_width, h));
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, 
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -584,13 +585,13 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
 
     Color c = Color(225, 221, 85);
     
-    updateGraphicsContext(context, c, c, 0); // Don't draw text at all!
+    updateGraphicsContext(context, c, c, 0, style->colorSpace()); // Don't draw text at all!
 
     int y = selectionTop();
     int h = selectionHeight();
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
                                   direction() == RTL, m_dirOverride || style->visuallyOrdered()),
-                                  IntPoint(m_x + tx, y + ty), h, c, sPos, ePos);
+                                  IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
 
@@ -660,6 +661,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         setClip = true;
     }
 
+    ColorSpace colorSpace = renderer()->style()->colorSpace();
     bool setShadow = false;
     
     do {
@@ -669,24 +671,24 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
                 ty -= extraOffset;
                 extraOffset = 0;
             }
-            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color);
+            context->setShadow(IntSize(shadow->x, shadow->y - extraOffset), shadow->blur, shadow->color, colorSpace);
             setShadow = true;
             shadow = shadow->next;
         }
 
         if (deco & UNDERLINE) {
-            context->setStrokeColor(underline);
+            context->setStrokeColor(underline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             // Leave one pixel of white between the baseline and the underline.
             context->drawLineForText(IntPoint(tx, ty + baseline + 1), width, isPrinting);
         }
         if (deco & OVERLINE) {
-            context->setStrokeColor(overline);
+            context->setStrokeColor(overline, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty), width, isPrinting);
         }
         if (deco & LINE_THROUGH) {
-            context->setStrokeColor(linethrough);
+            context->setStrokeColor(linethrough, colorSpace);
             context->setStrokeStyle(SolidStroke);
             context->drawLineForText(IntPoint(tx, ty + 2 * baseline / 3), width, isPrinting);
         }
@@ -698,7 +700,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
         context->clearShadow();
 }
 
-void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font, bool grammar)
+void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font, bool grammar)
 {
     // Never print spelling/grammar markers (5327887)
     if (textRenderer()->document()->printing())
@@ -737,8 +739,11 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
         
         // Store rendered rects for bad grammar markers, so we can hit-test against it elsewhere in order to
         // display a toolTip. We don't do this for misspelling markers.
-        if (grammar)
+        if (grammar) {
+            markerRect.move(-tx, -ty);
+            markerRect = renderer()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
             renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
+        }
     }
     
     // IMPORTANT: The misspelling underline is not considered when calculating the text bounds, so we have to
@@ -761,7 +766,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
     pt->drawLineForMisspellingOrBadGrammar(IntPoint(tx + m_x + start, ty + m_y + underlineOffset), width, grammar);
 }
 
-void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Use same y positioning and height as for selection, so that when the selection and this highlight are on
     // the same word there are no pieces sticking out.
@@ -771,10 +776,10 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
     
-    // Always compute and store the rect associated with this marker
-    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
+    IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, y), h, sPos, ePos));
+    markerRect = root()->block()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
      
     // Optionally highlight the text
@@ -783,14 +788,14 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, Do
             renderer()->theme()->platformActiveTextSearchHighlightColor() :
             renderer()->theme()->platformInactiveTextSearchHighlightColor();
         pt->save();
-        updateGraphicsContext(pt, color, color, 0);  // Don't draw text at all!
+        updateGraphicsContext(pt, color, color, 0, style->colorSpace());  // Don't draw text at all!
         pt->clip(IntRect(tx + m_x, ty + y, m_width, h));
-        pt->drawHighlightForText(font, run, startPoint, h, color, sPos, ePos);
+        pt->drawHighlightForText(font, run, IntPoint(m_x + tx, y + ty), h, color, style->colorSpace(), sPos, ePos);
         pt->restore();
     }
 }
 
-void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMarker marker, RenderStyle* style, const Font& font)
+void InlineTextBox::computeRectForReplacementMarker(int /*tx*/, int /*ty*/, const DocumentMarker& marker, RenderStyle* style, const Font& font)
 {
     // Replacement markers are not actually drawn, but their rects need to be computed for hit testing.
     int y = selectionTop();
@@ -799,10 +804,11 @@ void InlineTextBox::computeRectForReplacementMarker(int tx, int ty, DocumentMark
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
     TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
-    IntPoint startPoint = IntPoint(m_x + tx, y + ty);
+    IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, sPos, ePos));
+    markerRect = root()->block()->localToAbsoluteQuad(FloatRect(markerRect)).enclosingBoundingBox();
     renderer()->document()->setRenderedRectForMarker(renderer()->node(), marker, markerRect);
 }
     
@@ -817,7 +823,7 @@ void InlineTextBox::paintDocumentMarkers(GraphicsContext* pt, int tx, int ty, Re
     // Give any document markers that touch this run a chance to draw before the text has been drawn.
     // Note end() points at the last char, not one past it like endOffset and ranges do.
     for ( ; markerIt != markers.end(); markerIt++) {
-        DocumentMarker marker = *markerIt;
+        const DocumentMarker& marker = *markerIt;
         
         // Paint either the background markers or the foreground markers, but not both
         switch (marker.type) {
@@ -911,7 +917,7 @@ void InlineTextBox::paintCompositionUnderline(GraphicsContext* ctx, int tx, int
     start += 1;
     width -= 2;
 
-    ctx->setStrokeColor(underline.color);
+    ctx->setStrokeColor(underline.color, renderer()->style()->colorSpace());
     ctx->setStrokeThickness(lineThickness);
     ctx->drawLineForText(IntPoint(tx + start, ty + height() - lineThickness), width, textRenderer()->document()->printing());
 }
@@ -936,7 +942,7 @@ int InlineTextBox::textPos() const
     if (x() == 0)
         return 0;
         
-    RenderBlock *blockElement = renderer()->containingBlock();
+    RenderBlock* blockElement = renderer()->containingBlock();
     return direction() == RTL ? x() - blockElement->borderRight() - blockElement->paddingRight()
                       : x() - blockElement->borderLeft() - blockElement->paddingLeft();
 }
@@ -947,7 +953,7 @@ int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
         return 0;
 
     RenderText* text = toRenderText(renderer());
-    RenderStyle *style = text->style(m_firstLine);
+    RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
     return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
                                 _x - m_x, includePartialGlyphs);
diff --git a/WebCore/rendering/InlineTextBox.h b/WebCore/rendering/InlineTextBox.h
index 3bbb453..80af2e3 100644
--- a/WebCore/rendering/InlineTextBox.h
+++ b/WebCore/rendering/InlineTextBox.h
@@ -34,7 +34,7 @@ const unsigned short cNoTruncation = USHRT_MAX;
 const unsigned short cFullTruncation = USHRT_MAX - 1;
 
 // Helper functions shared by InlineTextBox / SVGRootInlineBox
-void updateGraphicsContext(GraphicsContext* context, const Color& fillColor, const Color& strokeColor, float strokeThickness);
+void updateGraphicsContext(GraphicsContext*, const Color& fillColor, const Color& strokeColor, float strokeThickness, ColorSpace);
 Color correctedTextColor(Color textColor, Color backgroundColor);
 
 class InlineTextBox : public InlineRunBox {
@@ -131,9 +131,9 @@ protected:
 private:
     void paintDecoration(GraphicsContext*, int tx, int ty, int decoration, ShadowData*);
     void paintSelection(GraphicsContext*, int tx, int ty, RenderStyle*, const Font&);
-    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&, bool grammar);
-    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
-    void computeRectForReplacementMarker(int tx, int ty, DocumentMarker, RenderStyle*, const Font&);
+    void paintSpellingOrGrammarMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&, bool grammar);
+    void paintTextMatchMarker(GraphicsContext*, int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
+    void computeRectForReplacementMarker(int tx, int ty, const DocumentMarker&, RenderStyle*, const Font&);
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 9611660..9c56756 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -38,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "Page.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
@@ -347,6 +348,9 @@ MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId
     case MEDIA_CONTROLS_VOLUME_SLIDER:
         m_displayType = MediaVolumeSlider;
         break;
+    case MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON:
+        m_displayType = MediaShowClosedCaptionsButton;
+        break;
     default:
         ASSERT_NOT_REACHED();
         break;
@@ -577,6 +581,29 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
 
 // ----------------------------
 
+MediaControlToggleClosedCaptionsButtonElement::MediaControlToggleClosedCaptionsButtonElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlInputElement(doc, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON, "button", element)
+{
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->setClosedCaptionsVisible(!m_mediaElement->closedCaptionsVisible());
+        setChecked(m_mediaElement->closedCaptionsVisible());
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
+
+void MediaControlToggleClosedCaptionsButtonElement::updateDisplayType()
+{
+    setDisplayType(m_mediaElement->closedCaptionsVisible() ? MediaHideClosedCaptionsButton : MediaShowClosedCaptionsButton);
+}
+
+
+// ----------------------------
+
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
     : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
 {
@@ -649,10 +676,9 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 void MediaControlVolumeSliderElement::update()
 {
     float volume = m_mediaElement->volume();
-    if (value().toFloat() != volume) {
+    if (value().toFloat() != volume)
         setValue(String::number(volume));
-        MediaControlInputElement::update();
-    }
+    MediaControlInputElement::update();
 }
 
 // ----------------------------
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index 8b29773..0ba4aba 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -54,6 +54,8 @@ enum MediaControlElementType {
     MediaSliderThumb,
     MediaRewindButton,
     MediaReturnToRealtimeButton,
+    MediaShowClosedCaptionsButton,
+    MediaHideClosedCaptionsButton,
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
@@ -221,6 +223,15 @@ public:
 
 // ----------------------------
 
+class MediaControlToggleClosedCaptionsButtonElement : public MediaControlInputElement {
+public:
+    MediaControlToggleClosedCaptionsButtonElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+    virtual void updateDisplayType();
+};    
+
+// ----------------------------
+
 class MediaControlTimelineElement : public MediaControlInputElement {
 public:
     MediaControlTimelineElement(Document*, HTMLMediaElement*);
diff --git a/WebCore/rendering/PointerEventsHitRules.cpp b/WebCore/rendering/PointerEventsHitRules.cpp
index 214fb09..ababcfd 100644
--- a/WebCore/rendering/PointerEventsHitRules.cpp
+++ b/WebCore/rendering/PointerEventsHitRules.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/PointerEventsHitRules.h b/WebCore/rendering/PointerEventsHitRules.h
index 3d8939a..c17c19c 100644
--- a/WebCore/rendering/PointerEventsHitRules.h
+++ b/WebCore/rendering/PointerEventsHitRules.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/RenderArena.h b/WebCore/rendering/RenderArena.h
index ca35361..edf052a 100644
--- a/WebCore/rendering/RenderArena.h
+++ b/WebCore/rendering/RenderArena.h
@@ -36,12 +36,13 @@
 #define RenderArena_h
 
 #include "Arena.h"
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 static const size_t gMaxRecycledSize = 400;
 
-class RenderArena {
+class RenderArena : public Noncopyable {
 public:
     RenderArena(unsigned arenaSize = 4096);
     ~RenderArena();
diff --git a/WebCore/rendering/RenderBR.cpp b/WebCore/rendering/RenderBR.cpp
index e05c8b4..012a433 100644
--- a/WebCore/rendering/RenderBR.cpp
+++ b/WebCore/rendering/RenderBR.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
diff --git a/WebCore/rendering/RenderBR.h b/WebCore/rendering/RenderBR.h
index 7eae8ea..8850d46 100644
--- a/WebCore/rendering/RenderBR.h
+++ b/WebCore/rendering/RenderBR.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 7040e06..204a0c3 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -44,6 +44,7 @@
 #include "RenderView.h"
 #include "SelectionController.h"
 #include "Settings.h"
+#include "TransformState.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -62,13 +63,7 @@ static const int verticalLineClickFudgeFactor = 3;
 
 using namespace HTMLNames;
 
-static void moveChild(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* from, RenderObjectChildList* fromChildList, RenderObject* child)
-{
-    ASSERT(from == child->parent());
-    toChildList->appendChildNode(to, fromChildList->removeChildNode(from, child, false), false);
-}
-
-struct ColumnInfo {
+struct ColumnInfo : public Noncopyable {
     ColumnInfo()
         : m_desiredColumnWidth(0)
         , m_desiredColumnCount(1)
@@ -167,6 +162,7 @@ RenderBlock::~RenderBlock()
 
 void RenderBlock::destroy()
 {
+<<<<<<< HEAD:WebCore/rendering/RenderBlock.cpp
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will 
     // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. 
     children()->destroyLeftoverChildren(); 
@@ -178,7 +174,20 @@ void RenderBlock::destroy()
         m_inlineContinuation->destroy();
         m_inlineContinuation = 0; 
     }
+=======
+    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
+    // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
+    children()->destroyLeftoverChildren();
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderBlock.cpp
 
+    // Destroy our continuation before anything other than anonymous children.
+    // The reason we don't destroy it before anonymous children is that they may
+    // have continuations of their own that are anonymous children of our continuation.
+    if (m_inlineContinuation) {
+        m_inlineContinuation->destroy();
+        m_inlineContinuation = 0;
+    }
+    
     if (!documentBeingDestroyed()) {
         if (firstLineBox()) {
             // We can't wait for RenderBox::destroy to clear the selection,
@@ -406,6 +415,19 @@ RootInlineBox* RenderBlock::createAndAppendRootInlineBox()
     m_lineBoxes.appendLineBox(rootBox);
     return rootBox;
 }
+    
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    toChildList->appendChildNode(to, children()->removeChildNode(this, child, false), false);
+}
+
+void RenderBlock::moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child)
+{
+    ASSERT(this == child->parent());
+    ASSERT(!beforeChild || to == beforeChild->parent());
+    toChildList->insertChildNode(to, children()->removeChildNode(this, child, false), beforeChild, false);
+}
 
 void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
 {    
@@ -443,9 +465,9 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
             RenderObject* no = o;
             o = no->nextSibling();
             
-            moveChild(block, block->children(), this, children(), no);
+            moveChildTo(block, block->children(), no);
         }
-        moveChild(block, block->children(), this, children(), inlineRunEnd);
+        moveChildTo(block, block->children(), inlineRunEnd);
     }
 
 #ifndef NDEBUG
@@ -520,7 +542,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            moveChild(prevBlock, prevBlock->children(), nextBlock, nextBlock->children(), no);
+            nextBlock->moveChildTo(prevBlock, prevBlock->children(), no);
         }
  
         nextBlock->deleteLineBoxTree();
@@ -543,7 +565,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         while (o) {
             RenderObject* no = o;
             o = no->nextSibling();
-            moveChild(this, children(), anonBlock, anonBlock->children(), no);
+            anonBlock->moveChildTo(this, children(), no);
         }
 
         // Delete the now-empty block's lines and nuke it.
@@ -613,15 +635,15 @@ void RenderBlock::finishDelayUpdateScrollInfo()
     if (gDelayUpdateScrollInfo == 0) {
         ASSERT(gDelayedUpdateScrollInfoSet);
 
-        for (DelayedUpdateScrollInfoSet::iterator it = gDelayedUpdateScrollInfoSet->begin(); it != gDelayedUpdateScrollInfoSet->end(); ++it) {
+        OwnPtr<DelayedUpdateScrollInfoSet> infoSet(gDelayedUpdateScrollInfoSet);
+        gDelayedUpdateScrollInfoSet = 0;
+
+        for (DelayedUpdateScrollInfoSet::iterator it = infoSet->begin(); it != infoSet->end(); ++it) {
             RenderBlock* block = *it;
             if (block->hasOverflowClip()) {
                 block->layer()->updateScrollInfoAfterLayout();
             }
         }
-
-        delete gDelayedUpdateScrollInfoSet;
-        gDelayedUpdateScrollInfoSet = 0;
     }
 }
 
@@ -876,7 +898,11 @@ void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marg
             }
             y += (collapsedTopPos - collapsedTopNeg) - marginTop;
         }
-        child->layer()->setStaticY(y);
+        RenderLayer* childLayer = child->layer();
+        if (childLayer->staticY() != y) {
+            child->layer()->setStaticY(y);
+            child->setChildNeedsLayout(true, false);
+        }
     }
 }
 
@@ -965,7 +991,7 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
     // been regenerated by the new inline.
     for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
-        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+        if (runInIsGenerated || (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER)) {
             blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
             inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
@@ -1535,7 +1561,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground))
+    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && shouldPaintWithinRoot(paintInfo))
         layer()->paintOverflowControls(paintInfo.context, tx, ty, paintInfo.rect);
 }
 
@@ -1919,23 +1945,28 @@ bool RenderBlock::isSelectionRoot() const
     return false;
 }
 
-GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* /*repaintContainer*/)
+GapRects RenderBlock::selectionGapRectsForRepaint(RenderBoxModelObject* repaintContainer)
 {
     ASSERT(!needsLayout());
 
     if (!shouldPaintSelectionGaps())
         return GapRects();
 
-    // FIXME: this is broken with transforms and a non-null repaintContainer
-    FloatPoint absContentPoint = localToAbsolute(FloatPoint());
+    // FIXME: this is broken with transforms
+    TransformState transformState(TransformState::ApplyTransformDirection, FloatPoint());
+    mapLocalToContainer(repaintContainer, false, false, transformState);
+    FloatPoint offsetFromRepaintContainer = transformState.mappedPoint();
+    int x = offsetFromRepaintContainer.x();
+    int y = offsetFromRepaintContainer.y();
+
     if (hasOverflowClip())
-        absContentPoint -= layer()->scrolledContentOffset();
+        layer()->subtractScrolledContentOffset(x, y);
 
     int lastTop = 0;
     int lastLeft = leftSelectionOffset(this, lastTop);
     int lastRight = rightSelectionOffset(this, lastTop);
     
-    return fillSelectionGaps(this, absContentPoint.x(), absContentPoint.y(), absContentPoint.x(), absContentPoint.y(), lastTop, lastLeft, lastRight);
+    return fillSelectionGaps(this, x, y, x, y, lastTop, lastLeft, lastRight);
 }
 
 void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
@@ -1945,7 +1976,14 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
         int lastLeft = leftSelectionOffset(this, lastTop);
         int lastRight = rightSelectionOffset(this, lastTop);
         paintInfo.context->save();
-        fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        IntRect gapRectsBounds = fillSelectionGaps(this, tx, ty, tx, ty, lastTop, lastLeft, lastRight, &paintInfo);
+        if (!gapRectsBounds.isEmpty()) {
+            if (RenderLayer* layer = enclosingLayer()) {
+                IntSize offset = hasLayer() ? IntSize() : offsetFromAncestorContainer(layer->renderer());
+                gapRectsBounds.move(offset - IntSize(tx, ty));
+                layer->addBlockSelectionGapsBounds(gapRectsBounds);
+            }
+        }
         paintInfo.context->restore();
     }
 }
@@ -2132,7 +2170,7 @@ IntRect RenderBlock::fillHorizontalSelectionGap(RenderObject* selObj, int xPos,
         return IntRect();
     IntRect gapRect(xPos, yPos, width, height);
     if (paintInfo && selObj->style()->visibility() == VISIBLE)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2153,7 +2191,7 @@ IntRect RenderBlock::fillVerticalSelectionGap(int lastTop, int lastLeft, int las
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selectionBackgroundColor(), style()->colorSpace());
     return gapRect;
 }
 
@@ -2169,7 +2207,7 @@ IntRect RenderBlock::fillLeftSelectionGap(RenderObject* selObj, int xPos, int yP
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -2185,7 +2223,7 @@ IntRect RenderBlock::fillRightSelectionGap(RenderObject* selObj, int xPos, int y
 
     IntRect gapRect(left, top, width, height);
     if (paintInfo)
-        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor());
+        paintInfo->context->fillRect(gapRect, selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
@@ -3418,7 +3456,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     RootInlineBox* firstRootBoxWithChildren = 0;
     RootInlineBox* lastRootBoxWithChildren = 0;
     for (RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox()) {
-        if (!root->firstChild())
+        if (!root->firstLeafChild())
             continue;
         if (!firstRootBoxWithChildren)
             firstRootBoxWithChildren = root;
@@ -3565,11 +3603,15 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         } else if (colGap < availWidth) {
             desiredColumnCount = availWidth / colGap;
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else if (style()->hasAutoColumnCount()) {
         if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     } else {
@@ -3579,6 +3621,8 @@ void RenderBlock::calcColumnWidth()
             desiredColumnWidth = colWidth;
         } else if (colWidth < availWidth) {
             desiredColumnCount = (availWidth + colGap) / (colWidth + colGap);
+            if (desiredColumnCount < 1)
+                desiredColumnCount = 1;
             desiredColumnWidth = (availWidth - (desiredColumnCount - 1) * colGap) / desiredColumnCount;
         }
     }
@@ -3629,7 +3673,7 @@ Vector<IntRect>* RenderBlock::columnRects() const
     return &gColumnInfoMap->get(this)->m_columnRects;    
 }
 
-int RenderBlock::layoutColumns(int endOfContent)
+int RenderBlock::layoutColumns(int endOfContent, int requestedColumnHeight)
 {
     // Don't do anything if we have no columns
     if (!hasColumns())
@@ -3642,17 +3686,20 @@ int RenderBlock::layoutColumns(int endOfContent)
     
     bool computeIntrinsicHeight = (endOfContent == -1);
 
-    // Fill the columns in to the available height.  Attempt to balance the height of the columns
-    int availableHeight = contentHeight();
-    int colHeight = computeIntrinsicHeight ? availableHeight / desiredColumnCount : availableHeight;
-    
+    // Fill the columns in to the available height.  Attempt to balance the height of the columns.
     // Add in half our line-height to help with best-guess initial balancing.
     int columnSlop = lineHeight(false) / 2;
     int remainingSlopSpace = columnSlop * desiredColumnCount;
+    int availableHeight = contentHeight();
+    int colHeight;
+    if (computeIntrinsicHeight && requestedColumnHeight >= 0)
+        colHeight = requestedColumnHeight;
+    else if (computeIntrinsicHeight)
+        colHeight = availableHeight / desiredColumnCount + columnSlop;
+    else
+        colHeight = availableHeight;
+    int originalColHeight = colHeight;
 
-    if (computeIntrinsicHeight)
-        colHeight += columnSlop;
-                                                                            
     int colGap = columnGap();
 
     // Compute a collection of column rects.
@@ -3668,7 +3715,8 @@ int RenderBlock::layoutColumns(int endOfContent)
     int currY = top;
     unsigned colCount = desiredColumnCount;
     int maxColBottom = borderTop() + paddingTop();
-    int contentBottom = top + availableHeight; 
+    int contentBottom = top + availableHeight;
+    int minimumColumnHeight = -1;
     for (unsigned i = 0; i < colCount; i++) {
         // If we aren't constrained, then the last column can just get all the remaining space.
         if (computeIntrinsicHeight && i == colCount - 1)
@@ -3688,6 +3736,11 @@ int RenderBlock::layoutColumns(int endOfContent)
         paintObject(paintInfo, 0, 0);
         setHasColumns(true);
 
+        if (computeIntrinsicHeight && v->minimumColumnHeight() > originalColHeight) {
+            // The initial column height was too small to contain one line of text.
+            minimumColumnHeight = max(minimumColumnHeight, v->minimumColumnHeight());
+        }
+
         int adjustedBottom = v->bestTruncatedAt();
         if (adjustedBottom <= currY)
             adjustedBottom = currY + colHeight;
@@ -3724,6 +3777,11 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
+    if (minimumColumnHeight >= 0) {
+        // If originalColHeight was too small, we need to try to layout again.
+        return layoutColumns(endOfContent, minimumColumnHeight);
+    }
+
     int overflowRight = max(width(), currX - colGap);
     int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
     int overflowHeight = maxColBottom;
@@ -4208,6 +4266,10 @@ void RenderBlock::calcInlinePrefWidths()
                 } else
                     inlineMax += childMax;
             }
+
+            // Ignore spaces after a list marker.
+            if (child->isListMarker())
+                stripFrontSpaces = true;
         } else {
             m_minPrefWidth = max(inlineMin, m_minPrefWidth);
             m_maxPrefWidth = max(inlineMax, m_maxPrefWidth);
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 1628701..985074d 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -140,6 +140,9 @@ public:
     RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
 
 protected:
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* child);
+    void moveChildTo(RenderObject* to, RenderObjectChildList* toChildList, RenderObject* beforeChild, RenderObject* child);
+
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -377,13 +380,13 @@ private:
     void offsetForContents(int& tx, int& ty) const;
 
     void calcColumnWidth();
-    int layoutColumns(int endOfContent = -1);
+    int layoutColumns(int endOfContent = -1, int requestedColumnHeight = -1);
 
     bool expandsToEncloseOverhangingFloats() const;
 
     void updateScrollInfoAfterLayout();
 
-    struct FloatingObject {
+    struct FloatingObject : Noncopyable {
         enum Type {
             FloatLeft,
             FloatRight
@@ -499,7 +502,7 @@ private:
     RenderInline* m_inlineContinuation;
 
     // Allocated only when some of these fields have non-default values
-    struct MaxMargin {
+    struct MaxMargin : Noncopyable {
         MaxMargin(const RenderBlock* o) 
             : m_topPos(topPosDefault(o))
             , m_topNeg(topNegDefault(o))
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index cf6514e..8517d6d 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -1869,10 +1869,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
             trailingSpaceObject = 0;
-            
+
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot. -dwh
-            if (o->isListMarker() && !toRenderListMarker(o)->isInside()) {
+            if (o->isListMarker()) {
                 if (style()->collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -1880,6 +1880,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     currentCharacterIsWS = true;
                     ignoringSpaces = true;
                 }
+                if (toRenderListMarker(o)->isInside())
+                    tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
             } else
                 tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
         } else if (o->isText()) {
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 8e0f3b7..a7c2e63 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -1523,7 +1523,7 @@ void RenderBox::calcHeight()
     // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
     // height has nothing to be a percentage of, and it ends up being 0. That is bad.
     bool printingNeedsBaseHeight = document()->printing() && h.isPercent()
-        && (isRoot() || isBody() && document()->documentElement()->renderer()->style()->height().isPercent());
+        && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->height().isPercent()));
     if (stretchesToViewHeight() || printingNeedsBaseHeight) {
         int margins = collapsedMarginTop() + collapsedMarginBottom();
         int visHeight = document()->printing() ? view()->frameView()->visibleHeight() : view()->viewHeight();
@@ -2747,7 +2747,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
     if (!firstChild())
-        return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+        return createVisiblePosition(node() ? firstDeepEditingPositionForNode(node()) : Position(0, 0));
 
     int xPos = point.x();
     int yPos = point.y();
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 23dad2d..98960e0 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -441,14 +441,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
             if (baseColor.alpha() > 0) {
                 context->save();
                 context->setCompositeOperation(CompositeCopy);
-                context->fillRect(rect, baseColor);
+                context->fillRect(rect, baseColor, style()->colorSpace());
                 context->restore();
             } else
                 context->clearRect(rect);
         }
 
         if (bgColor.isValid() && bgColor.alpha() > 0)
-            context->fillRect(rect, bgColor);
+            context->fillRect(rect, bgColor, style()->colorSpace());
     }
 
     // no progressive loading of the background image
@@ -477,7 +477,7 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
                         clientForBackgroundImage = bodyRenderer;
                 }
             }
-            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), destRect, phase, tileSize, compositeOp);
+            context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), style()->colorSpace(), destRect, phase, tileSize, compositeOp);
         }
     }
 
@@ -706,6 +706,7 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
                       (imageHeight - topSlice - bottomSlice) > 0 && (h - topWidth - bottomWidth) > 0;
 
     Image* image = styleImage->image(this, imageSize);
+    ColorSpace colorSpace = style->colorSpace();
 
     if (drawLeft) {
         // Paint the top and bottom left corners.
@@ -713,18 +714,18 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top left corner rect is (tx, ty, leftWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (0, 0, leftSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx, ty, leftWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty, leftWidth, topWidth),
                                        IntRect(0, 0, leftSlice, topSlice), op);
 
         // The bottom left corner rect is (tx, ty + h - bottomWidth, leftWidth, bottomWidth)
         // The rect to use from within the image is (0, imageHeight - bottomSlice, leftSlice, botomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx, ty + h - bottomWidth, leftWidth, bottomWidth),
                                        IntRect(0, imageHeight - bottomSlice, leftSlice, bottomSlice), op);
 
         // Paint the left edge.
         // Have to scale and tile into the border rect.
-        graphicsContext->drawTiledImage(image, IntRect(tx, ty + topWidth, leftWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx, ty + topWidth, leftWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(0, topSlice, leftSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -735,17 +736,17 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
         // The top right corner rect is (tx + w - rightWidth, ty, rightWidth, topWidth)
         // The rect to use from within the image is obtained from our slice, and is (imageWidth - rightSlice, 0, rightSlice, topSlice)
         if (drawTop)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty, rightWidth, topWidth),
                                        IntRect(imageWidth - rightSlice, 0, rightSlice, topSlice), op);
 
         // The bottom right corner rect is (tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth)
         // The rect to use from within the image is (imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice)
         if (drawBottom)
-            graphicsContext->drawImage(image, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
+            graphicsContext->drawImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + h - bottomWidth, rightWidth, bottomWidth),
                                        IntRect(imageWidth - rightSlice, imageHeight - bottomSlice, rightSlice, bottomSlice), op);
 
         // Paint the right edge.
-        graphicsContext->drawTiledImage(image, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + w - rightWidth, ty + topWidth, rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(imageWidth - rightSlice, topSlice, rightSlice, imageHeight - topSlice - bottomSlice),
                                         Image::StretchTile, (Image::TileRule)vRule, op);
@@ -753,20 +754,20 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
 
     // Paint the top edge.
     if (drawTop)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty, w - leftWidth - rightWidth, topWidth),
                                         IntRect(leftSlice, 0, imageWidth - rightSlice - leftSlice, topSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the bottom edge.
     if (drawBottom)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + h - bottomWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + h - bottomWidth,
                                         w - leftWidth - rightWidth, bottomWidth),
                                         IntRect(leftSlice, imageHeight - bottomSlice, imageWidth - rightSlice - leftSlice, bottomSlice),
                                         (Image::TileRule)hRule, Image::StretchTile, op);
 
     // Paint the middle.
     if (drawMiddle)
-        graphicsContext->drawTiledImage(image, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
+        graphicsContext->drawTiledImage(image, colorSpace, IntRect(tx + leftWidth, ty + topWidth, w - leftWidth - rightWidth,
                                         h - topWidth - bottomWidth),
                                         IntRect(leftSlice, topSlice, imageWidth - rightSlice - leftSlice, imageHeight - topSlice - bottomSlice),
                                         (Image::TileRule)hRule, (Image::TileRule)vRule, op);
@@ -1198,7 +1199,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
             shadowOffset -= extraOffset;
             fillRect.move(extraOffset);
 
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             if (hasBorderRadius) {
                 IntRect rectToClipOut = rect;
                 IntSize topLeftToClipOut = topLeft;
@@ -1241,7 +1242,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOutRoundedRect(rectToClipOut, topLeftToClipOut, topRightToClipOut, bottomLeftToClipOut, bottomRightToClipOut);
-                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black);
+                context->fillRoundedRect(fillRect, topLeft, topRight, bottomLeft, bottomRight, Color::black, s->colorSpace());
             } else {
                 IntRect rectToClipOut = rect;
 
@@ -1258,7 +1259,7 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
                 if (!rectToClipOut.isEmpty())
                     context->clipOut(rectToClipOut);
-                context->fillRect(fillRect, Color::black);
+                context->fillRect(fillRect, Color::black, s->colorSpace());
             }
 
             context->restore();
@@ -1269,9 +1270,9 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
             if (holeRect.isEmpty()) {
                 if (hasBorderRadius)
-                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor);
+                    context->fillRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight, shadowColor, s->colorSpace());
                 else
-                    context->fillRect(rect, shadowColor);
+                    context->fillRect(rect, shadowColor, s->colorSpace());
                 continue;
             }
             if (!begin) {
@@ -1320,8 +1321,8 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
                 context->addPath(Path::createRectangle(holeRect));
 
             context->setFillRule(RULE_EVENODD);
-            context->setFillColor(fillColor);
-            context->setShadow(shadowOffset, shadowBlur, shadowColor);
+            context->setFillColor(fillColor, s->colorSpace());
+            context->setShadow(shadowOffset, shadowBlur, shadowColor, s->colorSpace());
             context->fillPath();
 
             context->restore();
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index f3ae558..3ecd382 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderButton.h b/WebCore/rendering/RenderButton.h
index 3a74589..7fd6ab0 100644
--- a/WebCore/rendering/RenderButton.h
+++ b/WebCore/rendering/RenderButton.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the html renderer for KDE.
- *
  * Copyright (C) 2005 Apple Computer
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 17c6dad..b0aefc5 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -38,7 +38,7 @@ using namespace HTMLNames;
 typedef HashMap<RefPtr<AtomicStringImpl>, CounterNode*> CounterMap;
 typedef HashMap<const RenderObject*, CounterMap*> CounterMaps;
 
-static CounterNode* counter(RenderObject*, const AtomicString& counterName, bool alwaysCreateCounter);
+static CounterNode* makeCounterNode(RenderObject*, const AtomicString& counterName, bool alwaysCreateCounter);
 
 static CounterMaps& counterMaps()
 {
@@ -53,30 +53,6 @@ static inline RenderObject* previousSiblingOrParent(RenderObject* object)
     return object->parent();
 }
 
-static CounterNode* lastDescendant(CounterNode* node)
-{
-    CounterNode* last = node->lastChild();
-    if (!last)
-        return 0;
-
-    while (CounterNode* lastChild = last->lastChild())
-        last = lastChild;
-
-    return last;
-}
-
-static CounterNode* previousInPreOrder(CounterNode* node)
-{
-    CounterNode* previous = node->previousSibling();
-    if (!previous)
-        return node->parent();
-
-    while (CounterNode* lastChild = previous->lastChild())
-        previous = lastChild;
-
-    return previous;
-}
-
 static bool planCounter(RenderObject* object, const AtomicString& counterName, bool& isReset, int& value)
 {
     ASSERT(object);
@@ -133,59 +109,124 @@ static bool planCounter(RenderObject* object, const AtomicString& counterName, b
     return false;
 }
 
-static bool findPlaceForCounter(RenderObject* object, const AtomicString& counterName,
-    bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
+// - Finds the insertion point for the counter described by counterOwner, isReset and 
+// identifier in the CounterNode tree for identifier and sets parent and
+// previousSibling accordingly.
+// - The function returns true if the counter whose insertion point is searched is NOT
+// the root of the tree.
+// - The root of the tree is a counter reference that is not in the scope of any other
+// counter with the same identifier.
+// - All the counter references with the same identifier as this one that are in
+// children or subsequent siblings of the renderer that owns the root of the tree
+// form the rest of of the nodes of the tree.
+// - The root of the tree is always a reset type reference.
+// - A subtree rooted at any reset node in the tree is equivalent to all counter 
+// references that are in the scope of the counter or nested counter defined by that
+// reset node.
+// - Non-reset CounterNodes cannot have descendants.
+
+static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString& identifier, bool isReset, CounterNode*& parent, CounterNode*& previousSibling)
 {
-    // Find the appropriate previous sibling for insertion into the parent node
-    // by searching in render tree order for a child of the counter.
-    parent = 0;
+    // We cannot stop searching for counters with the same identifier before we also
+    // check this renderer, because it may affect the positioning in the tree of our counter.
+    RenderObject* searchEndRenderer = previousSiblingOrParent(counterOwner);
+    // We check renderers in preOrder from the renderer that our counter is attached to
+    // towards the begining of the document for counters with the same identifier as the one
+    // we are trying to find a place for. This is the next renderer to be checked.
+    RenderObject* currentRenderer = counterOwner->previousInPreOrder();
     previousSibling = 0;
-    RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
-    RenderObject* prevCounterCandidate = object;
-    CounterNode* candidateCounter = 0;
-    // When a reset counter is chosen as candidateCounter, we'll
-    // decide the new node should be a child of the reset node or a
-    // sibling or the reset node. This flag controls it.
-    bool createChildForReset = true;
-    while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
-        CounterNode* c = counter(prevCounterCandidate, counterName, false);
-        if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter) {
-                candidateCounter = c;
-                createChildForReset = true;
-            }
-            if (candidateCounter) {
-                if (createChildForReset && candidateCounter->isReset()) {
-                    parent = candidateCounter;
-                    previousSibling = 0;
-                } else {
-                    parent = candidateCounter->parent();
-                    previousSibling = candidateCounter;
+    while (currentRenderer) {
+        CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
+        if (searchEndRenderer == currentRenderer) {
+            // We may be at the end of our search.
+            if (currentCounter) {
+                // We have a suitable counter on the EndSearchRenderer.
+                if (previousSibling) { // But we already found another counter that we come after.
+                    if (currentCounter->isReset()) {
+                        // We found a reset counter that is on a renderer that is a sibling of ours or a parent.
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            // We are also a reset counter and the previous reset was on a sibling renderer
+                            // hence we are the next sibling of that counter if that reset is not a root or
+                            // we are a root node if that reset is a root.
+                            parent = currentCounter->parent();
+                            previousSibling = parent ? currentCounter : 0;
+                            return parent;
+                        }
+                        // We are not a reset node or the previous reset must be on an ancestor of our renderer
+                        // hence we must be a child of that reset counter.
+                        parent = currentCounter;
+                        ASSERT(previousSibling->parent() == currentCounter);
+                        return true;
+                    }
+                    // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        // If the node we are placing is not reset or we have found a counter that is attached
+                        // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
+                        ASSERT(currentCounter->parent() == previousSibling->parent());
+                        parent = currentCounter->parent();
+                        return true;
+                    }
+                } else { 
+                    // We are at the potential end of the search, but we had no previous sibling candidate
+                    // In this case we follow pretty much the same logic as above but no ASSERTs about 
+                    // previousSibling, and when we are a sibling of the end counter we must set previousSibling
+                    // to currentCounter.
+                    if (currentCounter->isReset()) {
+                        if (isReset && currentRenderer->parent() == counterOwner->parent()) {
+                            parent = currentCounter->parent();
+                            previousSibling = currentCounter;
+                            return parent;
+                        }
+                        parent = currentCounter;
+                        return true;
+                    }
+                    if (!isReset || currentRenderer->parent() != counterOwner->parent()) {
+                        parent = currentCounter->parent();
+                        previousSibling = currentCounter;
+                        return true;
+                    }
+                    previousSibling = currentCounter;
                 }
-                return true;
             }
-            resetCandidate = previousSiblingOrParent(resetCandidate);
-        } else if (c) {
-            if (c->isReset()) {
-                if (c->parent()) {
-                    // The new node may be the next sibling of this reset node.
-                    createChildForReset = false;
-                    candidateCounter = c;
-                } else {
-                    createChildForReset = true;
-                    candidateCounter = 0;
-                }
-            } else if (!candidateCounter) {
-                createChildForReset = true;
-                candidateCounter = c;
+            // We come here if the previous sibling or parent of our renderer had no 
+            // good counter, or we are a reset node and the counter on the previous sibling
+            // of our renderer was not a reset counter.
+            // Set a new goal for the end of the search.
+            searchEndRenderer = previousSiblingOrParent(currentRenderer);
+        } else {
+            // We are searching descendants of a previous sibling of the renderer that the
+            // counter being placed is attached to.
+            if (currentCounter) {
+                // We found a suitable counter.
+                if (previousSibling) {
+                    // Since we had a suitable previous counter before, we should only consider this one as our 
+                    // previousSibling if it is a reset counter and hence the current previousSibling is its child.
+                    if (currentCounter->isReset()) {
+                        previousSibling = currentCounter;
+                        // We are no longer interested in previous siblings of the currentRenderer or their children
+                        // as counters they may have attached cannot be the previous sibling of the counter we are placing.
+                        currentRenderer = currentRenderer->parent();
+                        continue;
+                    }
+                } else
+                    previousSibling = currentCounter;
+                currentRenderer = previousSiblingOrParent(currentRenderer);
+                continue;
             }
         }
+        // This function is designed so that the same test is not done twice in an iteration, except for this one
+        // which may be done twice in some cases. Rearranging the decision points though, to accommodate this 
+        // performance improvement would create more code duplication than is worthwhile in my oppinion and may further
+        // impede the readability of this already complex algorithm.
+        if (previousSibling)
+            currentRenderer = previousSiblingOrParent(currentRenderer);
+        else
+            currentRenderer = currentRenderer->previousInPreOrder();
     }
-
     return false;
 }
 
-static CounterNode* counter(RenderObject* object, const AtomicString& counterName, bool alwaysCreateCounter)
+static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& counterName, bool alwaysCreateCounter)
 {
     ASSERT(object);
 
@@ -204,7 +245,7 @@ static CounterNode* counter(RenderObject* object, const AtomicString& counterNam
     CounterNode* newNode;
     if (findPlaceForCounter(object, counterName, isReset, newParent, newPreviousSibling)) {
         newNode = new CounterNode(object, isReset, value);
-        newParent->insertAfter(newNode, newPreviousSibling);
+        newParent->insertAfter(newNode, newPreviousSibling, counterName);
     } else {
         // Make a reset node for counters that aren't inside an existing reset node.
         newNode = new CounterNode(object, true, value);
@@ -246,7 +287,7 @@ PassRefPtr<StringImpl> RenderCounter::originalText() const
         return 0;
 
     if (!m_counterNode)
-        m_counterNode = counter(parent(), m_counter.identifier(), true);
+        m_counterNode = makeCounterNode(parent(), m_counter.identifier(), true);
 
     CounterNode* child = m_counterNode;
     int value = child->isReset() ? child->value() : child->countInParent();
@@ -272,24 +313,26 @@ void RenderCounter::calcPrefWidths(int lead)
     RenderText::calcPrefWidths(lead);
 }
 
-void RenderCounter::invalidate()
+void RenderCounter::invalidate(const AtomicString& identifier)
 {
+    if (m_counter.identifier() != identifier)
+        return;
     m_counterNode = 0;
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-static void destroyCounterNodeChildren(AtomicStringImpl* identifier, CounterNode* node)
+static void destroyCounterNodeChildren(const AtomicString& identifier, CounterNode* node)
 {
     CounterNode* previous;
-    for (CounterNode* child = lastDescendant(node); child && child != node; child = previous) {
-        previous = previousInPreOrder(child);
-        child->parent()->removeChild(child);
-        ASSERT(counterMaps().get(child->renderer())->get(identifier) == child);
-        counterMaps().get(child->renderer())->remove(identifier);
+    for (CounterNode* child = node->lastDescendant(); child && child != node; child = previous) {
+        previous = child->previousInPreOrder();
+        child->parent()->removeChild(child, identifier);
+        ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
+        counterMaps().get(child->renderer())->remove(identifier.impl());
         if (!child->renderer()->documentBeingDestroyed()) {
             RenderObjectChildList* children = child->renderer()->virtualChildren();
             if (children)
-                children->invalidateCounters(child->renderer());
+                children->invalidateCounters(child->renderer(), identifier);
         }
         delete child;
     }
@@ -306,9 +349,10 @@ void RenderCounter::destroyCounterNodes(RenderObject* object)
     CounterMap::const_iterator end = map->end();
     for (CounterMap::const_iterator it = map->begin(); it != end; ++it) {
         CounterNode* node = it->second;
-        destroyCounterNodeChildren(it->first.get(), node);
+        AtomicString identifier(it->first.get());
+        destroyCounterNodeChildren(identifier, node);
         if (CounterNode* parent = node->parent())
-            parent->removeChild(node);
+            parent->removeChild(node, identifier);
         delete node;
     }
 
diff --git a/WebCore/rendering/RenderCounter.h b/WebCore/rendering/RenderCounter.h
index 961968e..356f1bd 100644
--- a/WebCore/rendering/RenderCounter.h
+++ b/WebCore/rendering/RenderCounter.h
@@ -33,7 +33,11 @@ class RenderCounter : public RenderText {
 public:
     RenderCounter(Document*, const CounterContent&);
 
-    void invalidate();
+    // Removes the reference to the CounterNode associated with this renderer
+    // if its identifier matches the argument.
+    // This is used to cause a counter display update when the CounterNode
+    // tree for identifier changes.
+    void invalidate(const AtomicString& identifier);
 
     static void destroyCounterNodes(RenderObject*);
 
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 8618d11..1f2b371 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
diff --git a/WebCore/rendering/RenderFileUploadControl.cpp b/WebCore/rendering/RenderFileUploadControl.cpp
index 72623f7..37ee8fb 100644
--- a/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/WebCore/rendering/RenderFileUploadControl.cpp
@@ -63,8 +63,13 @@ private:
 RenderFileUploadControl::RenderFileUploadControl(HTMLInputElement* input)
     : RenderBlock(input)
     , m_button(0)
-    , m_fileChooser(FileChooser::create(this, input->value()))
 {
+    FileList* list = input->files();
+    Vector<String> filenames;
+    unsigned length = list ? list->length() : 0;
+    for (unsigned i = 0; i < length; ++i)
+        filenames.append(list->item(i)->path());
+    m_fileChooser = FileChooser::create(this, filenames);
 }
 
 RenderFileUploadControl::~RenderFileUploadControl()
@@ -184,7 +189,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
     }
 
     if (paintInfo.phase == PaintPhaseForeground) {
-        const String& displayedFilename = m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());        
+        const String& displayedFilename = fileTextValue();
         unsigned length = displayedFilename.length();
         const UChar* string = displayedFilename.characters();
         TextRun textRun(string, length, false, 0, 0, style()->direction() == RTL, style()->unicodeBidi() == Override);
@@ -204,7 +209,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
             + buttonRenderer->marginTop() + buttonRenderer->borderTop() + buttonRenderer->paddingTop()
             + buttonRenderer->baselinePosition(true, false);
 
-        paintInfo.context->setFillColor(style()->color());
+        paintInfo.context->setFillColor(style()->color(), style()->colorSpace());
         
         // Draw the filename
         paintInfo.context->drawBidiText(style()->font(), textRun, IntPoint(textX, textY));
@@ -284,7 +289,7 @@ String RenderFileUploadControl::buttonValue()
     return m_button->value();
 }
 
-String RenderFileUploadControl::fileTextValue()
+String RenderFileUploadControl::fileTextValue() const
 {
     return m_fileChooser->basenameForWidth(style()->font(), maxFilenameWidth());
 }
diff --git a/WebCore/rendering/RenderFileUploadControl.h b/WebCore/rendering/RenderFileUploadControl.h
index bd7d62a..72ba308 100644
--- a/WebCore/rendering/RenderFileUploadControl.h
+++ b/WebCore/rendering/RenderFileUploadControl.h
@@ -37,6 +37,8 @@ public:
     RenderFileUploadControl(HTMLInputElement*);
     virtual ~RenderFileUploadControl();
 
+    virtual bool isFileUploadControl() const { return true; }
+
     void click();
 
     void valueChanged();
@@ -44,7 +46,7 @@ public:
     void receiveDroppedFiles(const Vector<String>&);
 
     String buttonValue();
-    String fileTextValue();
+    String fileTextValue() const;
     
     bool allowsMultipleFiles();
 
@@ -66,10 +68,16 @@ private:
 
 inline RenderFileUploadControl* toRenderFileUploadControl(RenderObject* object)
 {
-    ASSERT(!object || !strcmp(object->renderName(), "RenderFileUploadControl"));
+    ASSERT(!object || object->isFileUploadControl());
     return static_cast<RenderFileUploadControl*>(object);
 }
 
+inline const RenderFileUploadControl* toRenderFileUploadControl(const RenderObject* object)
+{
+    ASSERT(!object || object->isFileUploadControl());
+    return static_cast<const RenderFileUploadControl*>(object);
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderFileUploadControl(const RenderFileUploadControl*);
 
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index f32e6e3..6882097 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -426,8 +426,13 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                         child->layer()->setStaticX(xPos);
                     else child->layer()->setStaticX(width() - xPos);
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(yPos);
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != yPos) {
+                        child->layer()->setStaticY(yPos);
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             }
@@ -656,7 +661,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
     // mainstream block layout); this is not really part of the XUL box model.
-    bool haveLineClamp = style()->lineClamp() >= 0 && style()->lineClamp() <= 100;
+    bool haveLineClamp = !style()->lineClamp().isNone();
     if (haveLineClamp) {
         int maxLineCount = 0;
         child = iterator.first();
@@ -681,7 +686,8 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         
         // Get the # of lines and then alter all block flow children with auto height to use the
         // specified height. We always try to leave room for at least one line.
-        int numVisibleLines = max(1, static_cast<int>((maxLineCount + 1) * style()->lineClamp() / 100.0));
+        LineClampValue lineClamp = style()->lineClamp();
+        int numVisibleLines = lineClamp.isPercentage() ? max(1, (maxLineCount + 1) * lineClamp.value() / 100) : lineClamp.value();
         if (numVisibleLines < maxLineCount) {
             for (child = iterator.first(); child; child = iterator.next()) {
                 if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
@@ -712,28 +718,25 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                 if (!lastLine)
                     continue;
                 
-                // See if the last item is an anchor
-                InlineBox* anchorBox = lastLine->lastChild();
-                if (!anchorBox)
-                    continue;
-                if (!anchorBox->renderer()->node())
-                    continue;
-                if (!anchorBox->renderer()->node()->isLink())
-                    continue;
-                
                 RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
                 if (!lastVisibleLine)
                     continue;
 
                 const UChar ellipsisAndSpace[2] = { horizontalEllipsis, ' ' };
                 DEFINE_STATIC_LOCAL(AtomicString, ellipsisAndSpaceStr, (ellipsisAndSpace, 2));
-
+                DEFINE_STATIC_LOCAL(AtomicString, ellipsisStr, (&horizontalEllipsis, 1));
                 const Font& font = style(numVisibleLines == 1)->font();
-                int ellipsisAndSpaceWidth = font.width(TextRun(ellipsisAndSpace, 2));
 
-                // Get ellipsis width + " " + anchor width
-                int totalWidth = ellipsisAndSpaceWidth + anchorBox->width();
-                
+                // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
+                int totalWidth;
+                InlineBox* anchorBox = lastLine->lastChild();
+                if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
+                    totalWidth = anchorBox->width() + font.width(TextRun(ellipsisAndSpace, 2));
+                else {
+                    anchorBox = 0;
+                    totalWidth = font.width(TextRun(&horizontalEllipsis, 1));
+                }
+                                
                 // See if this width can be accommodated on the last visible line
                 RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
                 RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
@@ -755,7 +758,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     continue;
 
                 // Let the truncation code kick in.
-                lastVisibleLine->placeEllipsis(ellipsisAndSpaceStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
+                lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
                 destBlock->setHasMarkupTruncation(true);
             }
         }
@@ -785,8 +788,13 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     else
                         child->layer()->setStaticX(borderRight()+paddingRight());
                 }
-                if (child->style()->hasStaticY())
-                    child->layer()->setStaticY(height());
+                if (child->style()->hasStaticY()) {
+                    RenderLayer* childLayer = child->layer();
+                    if (childLayer->staticY() != height()) {
+                        child->layer()->setStaticY(height());
+                        child->setChildNeedsLayout(true, false);
+                    }
+                }
                 child = iterator.next();
                 continue;
             } 
diff --git a/WebCore/rendering/RenderFrameSet.cpp b/WebCore/rendering/RenderFrameSet.cpp
index a855a08..09ad11f 100644
--- a/WebCore/rendering/RenderFrameSet.cpp
+++ b/WebCore/rendering/RenderFrameSet.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the KDE project.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
@@ -90,13 +88,14 @@ void RenderFrameSet::paintColumnBorder(const PaintInfo& paintInfo, const IntRect
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
     
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.width() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(1, height())), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.topRight(), IntSize(1, height())), borderEndEdgeColor(), colorSpace);
     }
 }
 
@@ -109,13 +108,14 @@ void RenderFrameSet::paintRowBorder(const PaintInfo& paintInfo, const IntRect& b
     
     // Fill first.
     GraphicsContext* context = paintInfo.context;
-    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor());
+    ColorSpace colorSpace = style()->colorSpace();
+    context->fillRect(borderRect, frameSet()->hasBorderColor() ? style()->borderLeftColor() : borderFillColor(), colorSpace);
 
     // Now stroke the edges but only if we have enough room to paint both edges with a little
     // bit of the fill color showing through.
     if (borderRect.height() >= 3) {
-        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor());
-        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor());
+        context->fillRect(IntRect(borderRect.topLeft(), IntSize(width(), 1)), borderStartEdgeColor(), colorSpace);
+        context->fillRect(IntRect(borderRect.bottomLeft(), IntSize(width(), 1)), borderEndEdgeColor(), colorSpace);
     }
 }
 
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index ff7c9c9..d06ca1f 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -53,7 +53,7 @@ namespace WebCore {
 static const double cInterpolationCutoff = 800. * 800.;
 static const double cLowQualityTimeThreshold = 0.050; // 50 ms
 
-class RenderImageScaleData {
+class RenderImageScaleData : public Noncopyable {
 public:
     RenderImageScaleData(RenderImage* image, const IntSize& size, double time, bool lowQualityScale)
         : m_size(size)
@@ -371,8 +371,8 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
             context->save();
 #endif
             context->setStrokeStyle(SolidStroke);
-            context->setStrokeColor(Color::lightGray);
-            context->setFillColor(Color::transparent);
+            context->setStrokeColor(Color::lightGray, style()->colorSpace());
+            context->setFillColor(Color::transparent, style()->colorSpace());
             context->drawRect(IntRect(tx + leftBorder + leftPad, ty + topBorder + topPad, cWidth, cHeight));
 #ifdef ANDROID_FIX // see http://b/issue?id=2052757
             context->restore();
@@ -396,13 +396,13 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
                     centerY = 0;
                 imageX = leftBorder + leftPad + centerX + 1;
                 imageY = topBorder + topPad + centerY + 1;
-                context->drawImage(image(), IntPoint(tx + imageX, ty + imageY));
+                context->drawImage(image(), style()->colorSpace(), IntPoint(tx + imageX, ty + imageY));
                 errorPictureDrawn = true;
             }
 
             if (!m_altText.isEmpty()) {
                 String text = document()->displayStringModifiedByEncoding(m_altText);
-                context->setFillColor(style()->color());
+                context->setFillColor(style()->color(), style()->colorSpace());
                 int ax = tx + leftBorder + leftPad;
                 int ay = ty + topBorder + topPad;
                 const Font& font = style()->font();
@@ -434,7 +434,7 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
         IntRect rect(IntPoint(tx + leftBorder + leftPad, ty + topBorder + topPad), contentSize);
         HTMLImageElement* imageElt = (node() && node()->hasTagName(imgTag)) ? static_cast<HTMLImageElement*>(node()) : 0;
         CompositeOperator compositeOperator = imageElt ? imageElt->compositeOperator() : CompositeSourceOver;
-        context->drawImage(image(cWidth, cHeight), rect, compositeOperator, useLowQualityScaling);
+        context->drawImage(image(cWidth, cHeight), style()->colorSpace(), rect, compositeOperator, useLowQualityScaling);
     }
 }
 
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 8b0c3c7..6df5ffe 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -56,6 +56,7 @@ void RenderInline::destroy()
     // properly dirty line boxes that they are removed from.  Effects that do :before/:after only on hover could crash otherwise.
     children()->destroyLeftoverChildren();
 
+<<<<<<< HEAD:WebCore/rendering/RenderInline.cpp
     // Destroy our continuation before anything other than anonymous children. 
     // The reason we don't destroy it before anonymous children is that they may 
     // have continuations of their own that are anonymous children of our continuation. 
@@ -64,6 +65,16 @@ void RenderInline::destroy()
         m_continuation = 0; 
     } 
 
+=======
+    // Destroy our continuation before anything other than anonymous children.
+    // The reason we don't destroy it before anonymous children is that they may
+    // have continuations of their own that are anonymous children of our continuation.
+    if (m_continuation) {
+        m_continuation->destroy();
+        m_continuation = 0;
+    }
+    
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderInline.cpp
     if (!documentBeingDestroyed()) {
         if (firstLineBox()) {
             // We can't wait for RenderBoxModelObject::destroy to clear the selection,
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index 8f2805a..ee7814c 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -243,14 +243,6 @@ bool RenderLayer::hasAcceleratedCompositing() const
 #endif
 }
 
-void RenderLayer::setStaticY(int staticY)
-{
-    if (m_staticY == staticY)
-        return;
-    m_staticY = staticY;
-    renderer()->setChildNeedsLayout(true, false);
-}
-
 void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
 {
     if (flags & DoFullRepaint) {
@@ -383,6 +375,20 @@ TransformationMatrix RenderLayer::currentTransform() const
     return *m_transform;
 }
 
+TransformationMatrix RenderLayer::renderableTransform(PaintBehavior paintBehavior) const
+{
+    if (!m_transform)
+        return TransformationMatrix();
+    
+    if (paintBehavior & PaintBehaviorFlattenCompositingLayers) {
+        TransformationMatrix matrix = *m_transform;
+        makeMatrixRenderable(matrix, false /* flatten 3d */);
+        return matrix;
+    }
+
+    return *m_transform;
+}
+
 void RenderLayer::setHasVisibleContent(bool b)
 { 
     if (m_hasVisibleContent == b && !m_visibleContentStatusDirty)
@@ -689,6 +695,27 @@ RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 }
 #endif
 
+RenderLayer* RenderLayer::clippingRoot() const
+{
+    const RenderLayer* current = this;
+    while (current) {
+        if (current->renderer()->isRenderView())
+            return const_cast<RenderLayer*>(current);
+
+        current = compositingContainer(current);
+        ASSERT(current);
+        if (current->transform()
+#if USE(ACCELERATED_COMPOSITING)
+            || current->isComposited()
+#endif
+        )
+            return const_cast<RenderLayer*>(current);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 IntPoint RenderLayer::absoluteToContents(const IntPoint& absolutePoint) const
 {
     // We don't use convertToLayerCoords because it doesn't know about transforms
@@ -727,46 +754,18 @@ RenderLayer* RenderLayer::transparentPaintingAncestor()
     return 0;
 }
 
-static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransform, const RenderLayer* l, const RenderLayer* rootLayer)
-{
-    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
-    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
-    // would be better to respect clips.
-    
-    if (rootLayer != l && l->paintsWithTransform()) {
-        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
-        // the transformed layer and all of its children.
-        int x = 0;
-        int y = 0;
-        l->convertToLayerCoords(rootLayer, x, y);
-
-        TransformationMatrix transform;
-        transform.translate(x, y);
-        transform = *l->transform() * transform;
-        transform = transform * enclosingTransform;
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior);
 
-        // We now have a transform that will produce a rectangle in our view's space.
-        IntRect clipRect = transform.mapRect(l->boundingBox(l));
-        
-        // Now shift the root layer to be us and pass down the new enclosing transform.
-        for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
-            if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(transform, curr, l));
-        }
-            
-        return clipRect;
-    }
-    
-    // Note: we don't have to walk z-order lists since transparent elements always establish
-    // a stacking context.  This means we can just walk the layer tree directly.
-    IntRect clipRect = l->boundingBox(rootLayer);
-    
+static void expandClipRectForDescendantsAndReflection(IntRect& clipRect, const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
     // If we have a mask, then the clip is limited to the border box area (and there is
     // no need to examine child layers).
     if (!l->renderer()->hasMask()) {
+        // Note: we don't have to walk z-order lists since transparent elements always establish
+        // a stacking context.  This means we can just walk the layer tree directly.
         for (RenderLayer* curr = l->firstChild(); curr; curr = curr->nextSibling()) {
             if (!l->reflection() || l->reflectionLayer() != curr)
-                clipRect.unite(transparencyClipBox(enclosingTransform, curr, rootLayer));
+                clipRect.unite(transparencyClipBox(curr, rootLayer, paintBehavior));
         }
     }
 
@@ -782,25 +781,54 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         clipRect.unite(l->renderBox()->reflectedRect(clipRect));
         clipRect.move(deltaX, deltaY);
     }
+}
 
-    // Now map the clipRect via the enclosing transform
-    return enclosingTransform.mapRect(clipRect);
+static IntRect transparencyClipBox(const RenderLayer* l, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
+{
+    // FIXME: Although this function completely ignores CSS-imposed clipping, we did already intersect with the
+    // paintDirtyRect, and that should cut down on the amount we have to paint.  Still it
+    // would be better to respect clips.
+    
+    if (rootLayer != l && l->paintsWithTransform(paintBehavior)) {
+        // The best we can do here is to use enclosed bounding boxes to establish a "fuzzy" enough clip to encompass
+        // the transformed layer and all of its children.
+        int x = 0;
+        int y = 0;
+        l->convertToLayerCoords(rootLayer, x, y);
+
+        TransformationMatrix transform;
+        transform.translate(x, y);
+        transform = *l->transform() * transform;
+
+        IntRect clipRect = l->boundingBox(l);
+        expandClipRectForDescendantsAndReflection(clipRect, l, l, paintBehavior);
+        return transform.mapRect(clipRect);
+    }
+    
+    IntRect clipRect = l->boundingBox(rootLayer);
+    expandClipRectForDescendantsAndReflection(clipRect, l, rootLayer, paintBehavior);
+    return clipRect;
 }
 
-void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer)
+void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer* rootLayer, PaintBehavior paintBehavior)
 {
-    if (p->paintingDisabled() || (paintsWithTransparency() && m_usedTransparency))
+    if (p->paintingDisabled() || (paintsWithTransparency(paintBehavior) && m_usedTransparency))
         return;
     
     RenderLayer* ancestor = transparentPaintingAncestor();
     if (ancestor)
-        ancestor->beginTransparencyLayers(p, rootLayer);
+        ancestor->beginTransparencyLayers(p, rootLayer, paintBehavior);
     
-    if (paintsWithTransparency()) {
+    if (paintsWithTransparency(paintBehavior)) {
         m_usedTransparency = true;
         p->save();
-        p->clip(transparencyClipBox(TransformationMatrix(), this, rootLayer));
+        IntRect clipRect = transparencyClipBox(this, rootLayer, paintBehavior);
+        p->clip(clipRect);
         p->beginTransparencyLayer(renderer()->opacity());
+#ifdef REVEAL_TRANSPARENCY_LAYERS
+        p->setFillColor(Color(0.0f, 0.0f, 0.5f, 0.2f));
+        p->fillRect(clipRect);
+#endif
     }
 }
 
@@ -1061,7 +1089,7 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
         int newOffsetX = scrollXOffset() + xDelta;
@@ -1205,7 +1233,7 @@ void RenderLayer::scrollRectToVisible(const IntRect &rect, bool scrollToAnchor,
     bool restrictedByLineClamp = false;
     if (renderer()->parent()) {
         parentLayer = renderer()->parent()->enclosingLayer();
-        restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
+        restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
     }
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
@@ -1921,7 +1949,7 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
         return;
     }
     
-    context->fillRect(absRect, Color::white);
+    context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -1950,7 +1978,7 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
     // Paint the resizer control.
     DEFINE_STATIC_LOCAL(RefPtr<Image>, resizeCornerImage, (Image::loadPlatformResource("textAreaResizeCorner")));
     IntPoint imagePoint(absRect.right() - resizeCornerImage->width(), absRect.bottom() - resizeCornerImage->height());
-    context->drawImage(resizeCornerImage.get(), imagePoint);
+    context->drawImage(resizeCornerImage.get(), box->style()->colorSpace(), imagePoint);
 
     // Draw a frame around the resizer (1px grey line) if there are any scrollbars present.
     // Clipping will exclude the right and bottom edges of this frame.
@@ -1959,9 +1987,9 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
         context->clip(absRect);
         IntRect largerCorner = absRect;
         largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
-        context->setStrokeColor(Color(makeRGB(217, 217, 217)));
+        context->setStrokeColor(Color(makeRGB(217, 217, 217)), DeviceColorSpace);
         context->setStrokeThickness(1.0f);
-        context->setFillColor(Color::transparent);
+        context->setFillColor(Color::transparent, DeviceColorSpace);
         context->drawRect(largerCorner);
         context->restore();
     }
@@ -2044,10 +2072,10 @@ bool RenderLayer::scroll(ScrollDirection direction, ScrollGranularity granularit
     return (didHorizontalScroll || didVerticalScroll);
 }
 
-void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintRestriction paintRestriction, RenderObject *paintingRoot)
+void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
 {
     RenderObject::OverlapTestRequestMap overlapTestRequests;
-    paintLayer(this, p, damageRect, paintRestriction, paintingRoot, &overlapTestRequests);
+    paintLayer(this, p, damageRect, paintBehavior, paintingRoot, &overlapTestRequests);
     RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
     for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
         it->first->setOverlapTestResult(false);
@@ -2091,7 +2119,7 @@ static bool shouldDoSoftwarePaint(const RenderLayer* layer, bool paintingReflect
 #endif
 
 void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
-                        const IntRect& paintDirtyRect, PaintRestriction paintRestriction,
+                        const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
                         RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
                         PaintLayerFlags paintFlags)
 {
@@ -2099,7 +2127,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (isComposited()) {
         // The updatingControlTints() painting pass goes through compositing layers,
         // but we need to ensure that we don't cache clip rects computed with the wrong root in this case.
-        if (p->updatingControlTints())
+        if (p->updatingControlTints() || (paintBehavior & PaintBehaviorFlattenCompositingLayers))
             paintFlags |= PaintLayerTemporaryClipRects;
         else if (!backing()->paintingGoesToWindow() && !shouldDoSoftwarePaint(this, paintFlags & PaintLayerPaintingReflection)) {
             // If this RenderLayer should paint into its backing, that will be done via RenderLayerBacking::paintIntoLayer().
@@ -2118,19 +2146,20 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (!renderer()->opacity())
         return;
 
-    if (paintsWithTransparency())
+    if (paintsWithTransparency(paintBehavior))
         paintFlags |= PaintLayerHaveTransparency;
 
     // Apply a transform if we have one.  A reflection is considered to be a transform, since it is a flip and a translate.
-    if (paintsWithTransform() && !(paintFlags & PaintLayerAppliedTransform)) {
+    if (paintsWithTransform(paintBehavior) && !(paintFlags & PaintLayerAppliedTransform)) {
+        TransformationMatrix layerTransform = renderableTransform(paintBehavior);
         // If the transform can't be inverted, then don't paint anything.
-        if (!m_transform->isInvertible())
+        if (!layerTransform.isInvertible())
             return;
 
         // If we have a transparency layer enclosing us and we are the root of a transform, then we need to establish the transparency
         // layer from the parent now.
         if (paintFlags & PaintLayerHaveTransparency)
-            parent()->beginTransparencyLayers(p, rootLayer);
+            parent()->beginTransparencyLayers(p, rootLayer, paintBehavior);
   
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
@@ -2153,15 +2182,19 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
 #else
         TransformationMatrix transform;
         transform.translate(x, y);
+<<<<<<< HEAD:WebCore/rendering/RenderLayer.cpp
         transform = *m_transform * transform;
 #endif
+=======
+        transform = layerTransform * transform;
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderLayer.cpp
         
         // Apply the transform.
         p->save();
         p->concatCTM(transform);
 
         // Now do a paint with the root layer shifted to be us.
-        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintRestriction, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
+        paintLayer(this, p, transform.inverse().mapRect(paintDirtyRect), paintBehavior, paintingRoot, overlapTestRequests, paintFlags | PaintLayerAppliedTransform);
 
         p->restore();
         
@@ -2178,7 +2211,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (m_reflection && !m_paintingInsideReflection) {
         // Mark that we are now inside replica painting.
         m_paintingInsideReflection = true;
-        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
+        reflectionLayer()->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags | PaintLayerPaintingReflection);
         m_paintingInsideReflection = false;
     }
 
@@ -2193,8 +2226,8 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Ensure our lists are up-to-date.
     updateCompositingAndLayerListsIfNeeded();
 
-    bool selectionOnly = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
     
     // If this layer's renderer is a child of the paintingRoot, we render unconditionally, which
     // is done by passing a nil paintingRoot down to our renderer (as if no paintingRoot was ever set).
@@ -2212,7 +2245,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
         
         // Paint our background first, before painting any child layers.
         // Establish the clip used to paint our background.
@@ -2229,13 +2262,13 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with negative z-indices.
     if (m_negZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_negZOrderList->begin(); it != m_negZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     // Now establish the appropriate clip and paint our child RenderObjects.
     if (shouldPaint && !clipRectToApply.isEmpty()) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
-            beginTransparencyLayers(p, rootLayer);
+            beginTransparencyLayers(p, rootLayer, paintBehavior);
 
         // Set up the clip used when painting our children.
         setClip(p, paintDirtyRect, clipRectToApply);
@@ -2268,12 +2301,12 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Paint any child layers that have overflow.
     if (m_normalFlowList)
         for (Vector<RenderLayer*>::iterator it = m_normalFlowList->begin(); it != m_normalFlowList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
 
     // Now walk the sorted list of children with positive z-indices.
     if (m_posZOrderList)
         for (Vector<RenderLayer*>::iterator it = m_posZOrderList->begin(); it != m_posZOrderList->end(); ++it)
-            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintRestriction, paintingRoot, overlapTestRequests, localPaintFlags);
+            it[0]->paintLayer(rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
     
     if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
         setClip(p, paintDirtyRect, damageRect);
@@ -2813,17 +2846,49 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
 IntRect RenderLayer::childrenClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return foregroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(foregroundRect)).enclosingBoundingBox();
 }
 
 IntRect RenderLayer::selfClipRect() const
 {
     RenderLayer* rootLayer = renderer()->view()->layer();
+    RenderLayer* clippingRootLayer = clippingRoot();
     IntRect layerBounds, backgroundRect, foregroundRect, outlineRect;
-    calculateRects(rootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
-    return backgroundRect;
+    calculateRects(clippingRootLayer, rootLayer->boundingBox(rootLayer), layerBounds, backgroundRect, foregroundRect, outlineRect);
+    return clippingRootLayer->renderer()->localToAbsoluteQuad(FloatQuad(backgroundRect)).enclosingBoundingBox();
+}
+
+void RenderLayer::addBlockSelectionGapsBounds(const IntRect& bounds)
+{
+    m_blockSelectionGapsBounds.unite(bounds);
+}
+
+void RenderLayer::clearBlockSelectionGapsBounds()
+{
+    m_blockSelectionGapsBounds = IntRect();
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->clearBlockSelectionGapsBounds();
+}
+
+void RenderLayer::repaintBlockSelectionGaps()
+{
+    for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
+        child->repaintBlockSelectionGaps();
+
+    if (m_blockSelectionGapsBounds.isEmpty())
+        return;
+
+    IntRect rect = m_blockSelectionGapsBounds;
+    rect.move(-scrolledContentOffset());
+    if (renderer()->hasOverflowClip())
+        rect.intersect(toRenderBox(renderer())->overflowClipRect(0, 0));
+    if (renderer()->hasClip())
+        rect.intersect(toRenderBox(renderer())->clipRect(0, 0));
+    if (!rect.isEmpty())
+        renderer()->repaintRectangle(rect);
 }
 
 bool RenderLayer::intersectsDamageRect(const IntRect& layerBounds, const IntRect& damageRect, const RenderLayer* rootLayer) const
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index a274638..af64fc4 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -202,7 +202,7 @@ public:
 
     bool isTransparent() const;
     RenderLayer* transparentPaintingAncestor();
-    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer);
+    void beginTransparencyLayers(GraphicsContext*, const RenderLayer* rootLayer, PaintBehavior);
 
     bool hasReflection() const { return renderer()->hasReflection(); }
     RenderReplica* reflection() const { return m_reflection; }
@@ -312,6 +312,10 @@ public:
     void clearClipRectsIncludingDescendants();
     void clearClipRects();
 
+    void addBlockSelectionGapsBounds(const IntRect&);
+    void clearBlockSelectionGapsBounds();
+    void repaintBlockSelectionGaps();
+
     // Get the enclosing stacking context for this layer.  A stacking context is a layer
     // that has a non-auto z-index.
     RenderLayer* stackingContext() const;
@@ -336,6 +340,9 @@ public:
     // the <html> layer and the root layer).
     RenderLayer* enclosingPositionedAncestor() const;
 
+    // The layer relative to which clipping rects for this layer are computed.
+    RenderLayer* clippingRoot() const;
+
 #if USE(ACCELERATED_COMPOSITING)
     // Enclosing compositing layer; if includeSelf is true, may return this.
     RenderLayer* enclosingCompositingLayer(bool includeSelf = true) const;
@@ -352,7 +359,7 @@ public:
     // paints the layers that intersect the damage rect from back to
     // front.  The hitTest method looks for mouse events by walking
     // layers that intersect the point from front to back.
-    void paint(GraphicsContext*, const IntRect& damageRect, PaintRestriction = PaintRestrictionNone, RenderObject* paintingRoot = 0);
+    void paint(GraphicsContext*, const IntRect& damageRect, PaintBehavior = PaintBehaviorNormal, RenderObject* paintingRoot = 0);
     bool hitTest(const HitTestRequest&, HitTestResult&);
 
     // This method figures out our layerBounds in coordinates relative to
@@ -390,7 +397,7 @@ public:
     int staticX() const { return m_staticX; }
     int staticY() const { return m_staticY; }
     void setStaticX(int staticX) { m_staticX = staticX; }
-    void setStaticY(int staticY);
+    void setStaticY(int staticY) { m_staticY = staticY; }
 
     bool hasTransform() const { return renderer()->hasTransform(); }
     // Note that this transform has the transform-origin baked in.
@@ -399,6 +406,7 @@ public:
     // resulting transform has transform-origin baked in. If the layer does not have a transform,
     // returns the identity matrix.
     TransformationMatrix currentTransform() const;
+    TransformationMatrix renderableTransform(PaintBehavior) const;
     
     // Get the perspective transform, which is applied to transformed sublayers.
     // Returns true if the layer has a -webkit-perspective.
@@ -426,14 +434,14 @@ public:
     bool hasCompositedMask() const { return false; }
 #endif
 
-    bool paintsWithTransparency() const
+    bool paintsWithTransparency(PaintBehavior paintBehavior) const
     {
-        return isTransparent() && !isComposited();
+        return isTransparent() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
-    bool paintsWithTransform() const
+    bool paintsWithTransform(PaintBehavior paintBehavior) const
     {
-        return transform() && !isComposited();
+        return transform() && ((paintBehavior & PaintBehaviorFlattenCompositingLayers) || !isComposited());
     }
 
 private:
@@ -465,7 +473,7 @@ private:
     typedef unsigned PaintLayerFlags;
 
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
+                    PaintBehavior, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
                     PaintLayerFlags paintFlags = 0);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
@@ -644,6 +652,9 @@ protected:
     RenderScrollbarPart* m_scrollCorner;
     RenderScrollbarPart* m_resizer;
 
+private:
+    IntRect m_blockSelectionGapsBounds;
+
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<RenderLayerBacking> m_backing;
 #endif
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index d7248d4..a62c1be 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,7 +28,9 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
-#include "CanvasRenderingContext3D.h"
+#if ENABLE(3D_CANVAS)    
+#include "WebGLRenderingContext.h"
+#endif
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
@@ -37,11 +39,14 @@
 #include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
+#include "KeyframeList.h"
 #include "RenderBox.h"
 #include "RenderImage.h"
 #include "RenderLayerCompositor.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 #include "RenderLayerBacking.h"
 
@@ -192,7 +197,7 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
         else if (renderer()->isCanvas()) {
             HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
             if (canvas->is3D()) {
-                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
+                WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(canvas->renderingContext());
                 if (context->graphicsContext3D()->platformGraphicsContext3D())
                     m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
             }
@@ -849,7 +854,7 @@ static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const
 // Share this with RenderLayer::paintLayer, which would have to be educated about GraphicsLayerPaintingPhase?
 void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext* context,
                     const IntRect& paintDirtyRect,      // in the coords of rootLayer
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase paintingPhase,
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase paintingPhase,
                     RenderObject* paintingRoot)
 {
     if (paintingGoesToWindow()) {
@@ -863,7 +868,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (m_owningLayer->hasReflection()) {
         // Mark that we are now inside replica painting.
         m_owningLayer->setPaintingInsideReflection(true);
-        m_owningLayer->reflectionLayer()->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot, 0, RenderLayer::PaintLayerPaintingReflection);
+        m_owningLayer->reflectionLayer()->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot, 0, RenderLayer::PaintLayerPaintingReflection);
         m_owningLayer->setPaintingInsideReflection(false);
     }
 
@@ -899,9 +904,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             
             int rw;
             int rh;
-            if (box->view()->frameView()) {
-                rw = box->view()->frameView()->contentsWidth();
-                rh = box->view()->frameView()->contentsHeight();
+            if (FrameView* frameView = box->view()->frameView()) {
+                rw = frameView->contentsWidth();
+                rh = frameView->contentsHeight();
             } else {
                 rw = box->view()->width();
                 rh = box->view()->height();
@@ -930,8 +935,8 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool forceBlackText = paintBehavior & PaintBehaviorForceBlackText;
+    bool selectionOnly  = paintBehavior & PaintBehaviorSelectionOnly;
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
@@ -939,7 +944,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
         if (negZOrderList) {
             for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Set up the clip used when painting our children.
@@ -975,14 +980,14 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
         if (normalFlowList) {
             for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
 
         // Now walk the sorted list of children with positive z-indices.
         Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
         if (posZOrderList) {
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
-                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
+                it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintBehavior, paintingRoot);
         }
     }
     
@@ -1002,9 +1007,25 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
+static InspectorTimelineAgent* inspectorTimelineAgent(RenderObject* renderer)
+{
+    Frame* frame = renderer->document()->frame();
+    if (!frame)
+        return 0;
+    Page* page = frame->page();
+    if (!page)
+        return 0;
+    return page->inspectorTimelineAgent();
+}
+
 // Up-call from compositing layer drawing callback.
 void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->willPaint(clip);
+#endif
+
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
     IntRect enclosingBBox = compositedBounds();
@@ -1021,7 +1042,22 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
+        timelineAgent->didPaint();
+#endif
+}
+
+bool RenderLayerBacking::showDebugBorders() const
+{
+    return compositor() ? compositor()->showDebugBorders() : false;
+}
+
+bool RenderLayerBacking::showRepaintCounter() const
+{
+    return compositor() ? compositor()->showRepaintCounter() : false;
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index 17bcaf7..2bbb37f 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -119,6 +119,9 @@ public:
 
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& clip);
 
+    virtual bool showDebugBorders() const;
+    virtual bool showRepaintCounter() const;
+
     IntRect contentsBox() const;
     
 private:
@@ -160,7 +163,7 @@ private:
     bool hasNonCompositingContent() const;
     
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintRestriction paintRestriction, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
+                    PaintBehavior paintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
     static AnimatedPropertyID cssToGraphicsLayerProperty(int);
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index 5201287..2f5e267 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -79,6 +79,8 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     : m_renderView(renderView)
     , m_rootPlatformLayer(0)
     , m_hasAcceleratedCompositing(true)
+    , m_showDebugBorders(false)
+    , m_showRepaintCounter(false)
     , m_compositingConsultsOverlap(true)
     , m_compositing(false)
     , m_rootLayerAttached(false)
@@ -109,16 +111,24 @@ void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
     }
 }
 
-void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
+void RenderLayerCompositor::cacheAcceleratedCompositingFlags()
 {
     bool hasAcceleratedCompositing = false;
-    if (Settings* settings = m_renderView->document()->settings())
+    bool showDebugBorders = false;
+    bool showRepaintCounter = false;
+    
+    if (Settings* settings = m_renderView->document()->settings()) {
         hasAcceleratedCompositing = settings->acceleratedCompositingEnabled();
+        showDebugBorders = settings->showDebugBorders();
+        showRepaintCounter = settings->showRepaintCounter();
+    }
 
-    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing)
+    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing || showDebugBorders != m_showDebugBorders || showRepaintCounter != m_showRepaintCounter)
         setCompositingLayersNeedRebuild();
         
     m_hasAcceleratedCompositing = hasAcceleratedCompositing;
+    m_showDebugBorders = showDebugBorders;
+    m_showRepaintCounter = showRepaintCounter;
 }
 
 void RenderLayerCompositor::setCompositingLayersNeedRebuild(bool needRebuild)
@@ -175,10 +185,18 @@ void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
         needLayerRebuild |= layersChanged;
     }
 
-    // Now create and parent the compositing layers.
-    {
+    if (needLayerRebuild) {
+        // Now updated and parent the compositing layers.
         CompositingState compState(updateRoot);
-        rebuildCompositingLayerTree(updateRoot, compState, needLayerRebuild);
+        Vector<GraphicsLayer*> childList;
+        rebuildCompositingLayerTree(updateRoot, compState, childList);
+
+        // Host the document layer in the RenderView's root layer.
+        if (updateRoot == rootRenderLayer() && !childList.isEmpty())
+            m_rootPlatformLayer->setChildren(childList);
+    } else {
+        // We just need to do a geometry update.
+        updateLayerTreeGeometry(updateRoot);
     }
     
 #if PROFILE_LAYER_REBUILD
@@ -328,7 +346,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    if (layer->paintsWithTransform()) {
+    if (layer->paintsWithTransform(PaintBehaviorNormal)) {
         TransformationMatrix* affineTrans = layer->transform();
         boundingBoxRect = affineTrans->mapRect(boundingBoxRect);
         unionBounds = affineTrans->mapRect(unionBounds);
@@ -476,7 +494,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
                 // If we have to make a layer for this child, make one now so we can have a contents layer
                 // (since we need to ensure that the -ve z-order child renders underneath our contents).
-                if (childState.m_subtreeIsCompositing) {
+                if (!willBeComposited && childState.m_subtreeIsCompositing) {
                     // make layer compositing
                     layer->setMustOverlapCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
@@ -509,7 +527,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
+    if (!willBeComposited && childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -586,11 +604,12 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 }
 #endif
 
-void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& compositingState, bool updateHierarchy)
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, const CompositingState& compositingState, Vector<GraphicsLayer*>& childLayersOfEnclosingLayer)
 {
     // Make the layer compositing if necessary, and set up clipping and content layers.
     // Note that we can only do work here that is independent of whether the descendant layers
     // have been processed. computeCompositingRequirements() will already have done the repaint if necessary.
+    
     RenderLayerBacking* layerBacking = layer->backing();
     if (layerBacking) {
         // The compositing state of all our children has been updated already, so now
@@ -601,15 +620,12 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
 
         if (!layer->parent())
             updateRootLayerPosition();
-
-        // FIXME: make this more incremental
-        if (updateHierarchy)
-            layerBacking->parentForSublayers()->removeAllChildren();
     }
 
-    // host the document layer in the RenderView's root layer
-    if (updateHierarchy && layer->isRootLayer() && layer->isComposited())
-        parentInRootLayer(layer);
+    // If this layer has backing, then we are collecting its children, otherwise appending
+    // to the compositing child list of an enclosing layer.
+    Vector<GraphicsLayer*> layerChildren;
+    Vector<GraphicsLayer*>& childList = layerBacking ? layerChildren : childLayersOfEnclosingLayer;
 
     CompositingState childState = compositingState;
     if (layer->isComposited())
@@ -630,19 +646,13 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
 
-        if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
-            layerBacking->foregroundLayer()->removeFromParent();
-            
-            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
-            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
-            hostingLayer->addChild(layerBacking->foregroundLayer());
-        }
+        // If a negative z-order child is compositing, we get a foreground layer which needs to get parented.
+        if (layerBacking && layerBacking->foregroundLayer())
+            childList.append(layerBacking->foregroundLayer());
     }
 
     ASSERT(!layer->m_normalFlowListDirty);
@@ -650,9 +660,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-            if (updateHierarchy && curLayer->isComposited())
-                setCompositingParent(curLayer, childState.m_compositingAncestor);
+            rebuildCompositingLayerTree(curLayer, childState, childList);
         }
     }
     
@@ -661,14 +669,60 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                rebuildCompositingLayerTree(curLayer, childState, updateHierarchy);
-                if (updateHierarchy && curLayer->isComposited())
-                    setCompositingParent(curLayer, childState.m_compositingAncestor);
+                rebuildCompositingLayerTree(curLayer, childState, childList);
             }
         }
     }
+    
+    if (layerBacking) {
+        layerBacking->parentForSublayers()->setChildren(layerChildren);
+        childLayersOfEnclosingLayer.append(layerBacking->childForSuperlayers());
+    }
 }
 
+// This just updates layer geometry without changing the hierarchy.
+void RenderLayerCompositor::updateLayerTreeGeometry(RenderLayer* layer)
+{
+    if (RenderLayerBacking* layerBacking = layer->backing()) {
+        // The compositing state of all our children has been updated already, so now
+        // we can compute and cache the composited bounds for this layer.
+        layerBacking->updateCompositedBounds();
+
+        if (layer->reflectionLayer())
+            layer->reflectionLayer()->backing()->updateCompositedBounds();
+
+        layerBacking->updateGraphicsLayerConfiguration();
+        layerBacking->updateGraphicsLayerGeometry();
+
+        if (!layer->parent())
+            updateRootLayerPosition();
+    }
+
+    if (layer->isStackingContext()) {
+        ASSERT(!layer->m_zOrderListsDirty);
+
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(negZOrderList->at(i));
+        }
+    }
+
+    ASSERT(!layer->m_normalFlowListDirty);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i)
+            updateLayerTreeGeometry(normalFlowList->at(i));
+    }
+    
+    if (layer->isStackingContext()) {
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
+                updateLayerTreeGeometry(posZOrderList->at(i));
+        }
+    }
+}
 
 // Recurs down the RenderLayer tree until its finds the compositing descendants of compositingAncestor and updates their geometry.
 void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* compositingAncestor, RenderLayer* layer, RenderLayerBacking::UpdateDepth updateDepth)
@@ -716,6 +770,7 @@ void RenderLayerCompositor::repaintCompositedLayersAbsoluteRect(const IntRect& a
 
 void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const IntRect& rect)
 {
+    // FIXME: This method does not work correctly with transforms.
     if (layer->isComposited())
         layer->setBackingNeedsRepaintInRect(rect);
 
@@ -724,7 +779,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = negZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = negZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -736,7 +792,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             size_t listSize = posZOrderList->size();
             for (size_t i = 0; i < listSize; ++i) {
                 RenderLayer* curLayer = posZOrderList->at(i);
-                int x = 0, y = 0;
+                int x = 0;
+                int y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
                 childRect.move(-x, -y);
@@ -748,7 +805,8 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         size_t listSize = normalFlowList->size();
         for (size_t i = 0; i < listSize; ++i) {
             RenderLayer* curLayer = normalFlowList->at(i);
-            int x = 0, y = 0;
+            int x = 0;
+            int y = 0;
             curLayer->convertToLayerCoords(layer, x, y);
             IntRect childRect(rect);
             childRect.move(-x, -y);
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index a809a70..73683f3 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -61,8 +61,11 @@ public:
     // Returns true if the accelerated compositing is enabled
     bool hasAcceleratedCompositing() const { return m_hasAcceleratedCompositing; }
     
-    // Copy the acceleratedCompositingEnabledFlag from Settings
-    void cacheAcceleratedCompositingEnabledFlag();
+    bool showDebugBorders() const { return m_showDebugBorders; }
+    bool showRepaintCounter() const { return m_showRepaintCounter; }
+    
+    // Copy the accelerated compositing related flags from Settings
+    void cacheAcceleratedCompositingFlags();
 
     // Called when the layer hierarchy needs to be updated (compositing layers have been
     // created, destroyed or re-parented).
@@ -147,8 +150,13 @@ private:
 
     // Returns true if any layer's compositing changed
     void computeCompositingRequirements(RenderLayer*, OverlapMap*, struct CompositingState&, bool& layersChanged);
-    void rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState&, bool updateHierarchy);
+    
+    // Recurses down the tree, parenting descendant compositing layers and collecting an array of child layers for the current compositing layer.
+    void rebuildCompositingLayerTree(RenderLayer* layer, const struct CompositingState&, Vector<GraphicsLayer*>& childGraphicsLayersOfEnclosingLayer);
 
+    // Recurses down the tree, updating layer geometry only.
+    void updateLayerTreeGeometry(RenderLayer*);
+    
     // Hook compositing layers together
     void setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer);
     void removeCompositedChildren(RenderLayer*);
@@ -171,6 +179,8 @@ private:
     RenderView* m_renderView;
     OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
+    bool m_showDebugBorders;
+    bool m_showRepaintCounter;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
     bool m_rootLayerAttached;
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 76a2e2f..57bc26c 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -199,6 +199,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
         int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
+        v->setMinimumColumnHeight(h);
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
             curr->paint(info, tx, ty);
     }
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index 0edfdef..15c652c 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -321,7 +321,8 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
             textColor = theme()->inactiveListBoxSelectionForegroundColor();
     }
 
-    paintInfo.context->setFillColor(textColor);
+    ColorSpace colorSpace = itemStyle->colorSpace();
+    paintInfo.context->setFillColor(textColor, colorSpace);
 
     Font itemFont = style()->font();
     if (isOptionGroupElement(element)) {
@@ -358,9 +359,10 @@ void RenderListBox::paintItemBackground(PaintInfo& paintInfo, int tx, int ty, in
 
     // Draw the background for this list box item
     if (!element->renderStyle() || element->renderStyle()->visibility() != HIDDEN) {
+        ColorSpace colorSpace = element->renderStyle() ? element->renderStyle()->colorSpace() : style()->colorSpace();
         IntRect itemRect = itemBoundingBoxRect(tx, ty, listIndex);
         itemRect.intersect(controlClipRect(tx, ty));
-        paintInfo.context->fillRect(itemRect, backColor);
+        paintInfo.context->fillRect(itemRect, backColor, colorSpace);
     }
 }
 
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index e487c60..539b8c7 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
diff --git a/WebCore/rendering/RenderListMarker.cpp b/WebCore/rendering/RenderListMarker.cpp
index 9627711..eab4404 100644
--- a/WebCore/rendering/RenderListMarker.cpp
+++ b/WebCore/rendering/RenderListMarker.cpp
@@ -48,7 +48,9 @@ static String toRoman(int number, bool upper)
     if (number < 1 || number > 3999)
         return String::number(number);
 
-    const int lettersSize = 12; // big enough for three each of I, X, C, and M
+    // Big enough to store largest roman number less than 3999 which
+    // is 3888 (MMMDCCCLXXXVIII)
+    const int lettersSize = 15;
     UChar letters[lettersSize];
 
     int length = 0;
@@ -543,10 +545,10 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
             paintCustomHighlight(tx, ty, style()->highlight(), true);
 #endif
-        context->drawImage(m_image->image(this, marker.size()), marker.location());
+        context->drawImage(m_image->image(this, marker.size()), style()->colorSpace(), marker.location());
         if (selectionState() != SelectionNone) {
             // FIXME: selectionRect() is in absolute, not painting coordinates.
-            context->fillRect(selectionRect(), selectionBackgroundColor());
+            context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
         }
         return;
     }
@@ -559,21 +561,21 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 
     if (selectionState() != SelectionNone) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        context->fillRect(selectionRect(), selectionBackgroundColor());
+        context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
     }
 
     const Color color(style()->color());
-    context->setStrokeColor(color);
+    context->setStrokeColor(color, style()->colorSpace());
     context->setStrokeStyle(SolidStroke);
     context->setStrokeThickness(1.0f);
-    context->setFillColor(color);
+    context->setFillColor(color, style()->colorSpace());
 
     switch (style()->listStyleType()) {
         case DISC:
             context->drawEllipse(marker);
             return;
         case CIRCLE:
-            context->setFillColor(Color::transparent);
+            context->setFillColor(Color::transparent, DeviceColorSpace);
             context->drawEllipse(marker);
             return;
         case SQUARE:
diff --git a/WebCore/rendering/RenderMarquee.h b/WebCore/rendering/RenderMarquee.h
index 886c343..1651454 100644
--- a/WebCore/rendering/RenderMarquee.h
+++ b/WebCore/rendering/RenderMarquee.h
@@ -53,7 +53,7 @@ namespace WebCore {
 class RenderLayer;
 
 // This class handles the auto-scrolling of layers with overflow: marquee.
-class RenderMarquee {
+class RenderMarquee : public Noncopyable {
 public:
     RenderMarquee(RenderLayer*);
 
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index 1d4da23..2ff50df 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -121,6 +121,8 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_rewindButton->updateStyle();
         if (m_returnToRealtimeButton)
             m_returnToRealtimeButton->updateStyle();
+        if (m_toggleClosedCaptionsButton)
+            m_toggleClosedCaptionsButton->updateStyle();
         if (m_statusDisplay)
             m_statusDisplay->updateStyle();
         if (m_timelineContainer)
@@ -223,6 +225,13 @@ void RenderMedia::createReturnToRealtimeButton()
     m_returnToRealtimeButton->attachToParent(m_panel.get());
 }
 
+void RenderMedia::createToggleClosedCaptionsButton()
+{
+    ASSERT(!m_toggleClosedCaptionsButton);
+    m_toggleClosedCaptionsButton = new MediaControlToggleClosedCaptionsButtonElement(document(), mediaElement());
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+}
+
 void RenderMedia::createStatusDisplay()
 {
     ASSERT(!m_statusDisplay);
@@ -310,6 +319,7 @@ void RenderMedia::updateControls()
             m_volumeSliderContainer = 0;
             m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
+            m_toggleClosedCaptionsButton = 0;
         }
         m_opacityAnimationTo = 1.0f;
         m_opacityAnimationTimer.stop();
@@ -333,6 +343,7 @@ void RenderMedia::updateControls()
             }
             createSeekBackButton();
             createSeekForwardButton();
+            createToggleClosedCaptionsButton();
             createFullscreenButton();
             createMuteButton();
             createVolumeSliderContainer();
@@ -379,6 +390,8 @@ void RenderMedia::updateControls()
         m_rewindButton->update();
     if (m_returnToRealtimeButton)
         m_returnToRealtimeButton->update();
+    if (m_toggleClosedCaptionsButton)
+        m_toggleClosedCaptionsButton->update();
     if (m_statusDisplay)
         m_statusDisplay->update();
     if (m_fullscreenButton)
@@ -535,6 +548,9 @@ void RenderMedia::forwardEvent(Event* event)
         if (m_returnToRealtimeButton && m_returnToRealtimeButton->hitTest(point))
             m_returnToRealtimeButton->defaultEventHandler(event);
 
+       if (m_toggleClosedCaptionsButton && m_toggleClosedCaptionsButton->hitTest(point))
+            m_toggleClosedCaptionsButton->defaultEventHandler(event);
+
         if (m_timeline && m_timeline->hitTest(point))
             m_timeline->defaultEventHandler(event);
 
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 602cd26..066b83d 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -40,6 +40,7 @@ class MediaControlPlayButtonElement;
 class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
+class MediaControlToggleClosedCaptionsButtonElement;
 class MediaControlTimelineElement;
 class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
@@ -96,6 +97,7 @@ private:
     void createSeekForwardButton();
     void createRewindButton();
     void createReturnToRealtimeButton();
+    void createToggleClosedCaptionsButton();
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
@@ -123,6 +125,7 @@ private:
     RefPtr<MediaControlSeekButtonElement> m_seekForwardButton;
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
+    RefPtr<MediaControlToggleClosedCaptionsButtonElement> m_toggleClosedCaptionsButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
     RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 9cc1493..17576ae 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -90,6 +90,15 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaFullscreenButton:
             paintThemePart(SafariTheme::MediaFullscreenButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaShowClosedCaptionsButton:
+        case MediaHideClosedCaptionsButton:
+#if SAFARI_THEME_VERSION >= 4
+            if (MediaControlToggleClosedCaptionsButtonElement* btn = static_cast<MediaControlToggleClosedCaptionsButtonElement*>(o->node())) {
+                bool captionsVisible = btn->displayType() == MediaHideClosedCaptionsButton;
+                paintThemePart(captionsVisible ? SafariTheme::MediaHideClosedCaptionsButtonPart : SafariTheme::MediaShowClosedCaptionsButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+            }
+#endif
+            break;
         case MediaMuteButton:
         case MediaUnMuteButton:
             if (MediaControlMuteButtonElement* btn = static_cast<MediaControlMuteButtonElement*>(o->node())) {
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
index 56fbec4..50feb46 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -63,7 +63,7 @@ static bool hasSource(const HTMLMediaElement* mediaElement)
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
     IntRect imageRect = image->rect();
-    context->drawImage(image, rect);
+    context->drawImage(image, DeviceColorSpace, rect);
     return true;
 }
 
@@ -114,9 +114,9 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
     context->save();
     context->setShouldAntialias(true);
     context->setStrokeStyle(SolidStroke);
-    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeColor(style->borderLeftColor(), DeviceColorSpace);
     context->setStrokeThickness(style->borderLeftWidth());
-    context->setFillColor(style->backgroundColor());
+    context->setFillColor(style->backgroundColor(), DeviceColorSpace);
     context->drawRect(rect);
     context->restore();
 
@@ -172,13 +172,13 @@ static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::Pai
     GraphicsContext* context = paintInfo.context;
     Color originalColor = context->strokeColor();
     if (originalColor != Color::white)
-        context->setStrokeColor(Color::white);
+        context->setStrokeColor(Color::white, DeviceColorSpace);
 
     int x = rect.x() + rect.width() / 2;
     context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
 
     if (originalColor != Color::white)
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
     return true;
 }
 
@@ -207,17 +207,17 @@ static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject
 
         // Draw the left border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderLeftWidth());
-        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + 1, rect.y()),
                           IntPoint(rect.x() + 1, rect.y() + rect.height()));
 
         // Draw the right border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderRightWidth());
-        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->setStrokeColor(object->style()->borderRightColor().rgb(), DeviceColorSpace);
         context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
                           IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
 
-        context->setStrokeColor(originalColor);
+        context->setStrokeColor(originalColor, DeviceColorSpace);
         context->setStrokeThickness(originalThickness);
         context->setStrokeStyle(originalStyle);
     }
@@ -275,6 +275,8 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaRewindButton:
     case MediaReturnToRealtimeButton:
     case MediaStatusDisplay:
+    case MediaShowClosedCaptionsButton:
+    case MediaHideClosedCaptionsButton:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 21ced26..712519b 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -41,6 +42,8 @@
 #include "RenderImageGeneratedContent.h"
 #include "RenderInline.h"
 #include "RenderListItem.h"
+#include "RenderRuby.h"
+#include "RenderRubyText.h"
 #include "RenderTableCell.h"
 #include "RenderTableCol.h"
 #include "RenderTableRow.h"
@@ -106,46 +109,42 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         return image;
     }
 
-    RenderObject* o = 0;
+    if (node->hasTagName(rubyTag)) {
+        if (style->display() == INLINE)
+            return new (arena) RenderRubyAsInline(node);
+        else
+            return new (arena) RenderRubyAsBlock(node);
+    }
+    // treat <rt> as ruby text ONLY if it still has its default treatment of block
+    if (node->hasTagName(rtTag) && style->display() == BLOCK)
+        return new (arena) RenderRubyText(node); 
 
     switch (style->display()) {
         case NONE:
-            break;
+            return 0;
         case INLINE:
-            o = new (arena) RenderInline(node);
-            break;
+            return new (arena) RenderInline(node);
         case BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
         case INLINE_BLOCK:
-            o = new (arena) RenderBlock(node);
-            break;
-        case LIST_ITEM:
-            o = new (arena) RenderListItem(node);
-            break;
         case RUN_IN:
         case COMPACT:
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
+        case LIST_ITEM:
+            return new (arena) RenderListItem(node);
         case TABLE:
         case INLINE_TABLE:
-            o = new (arena) RenderTable(node);
-            break;
+            return new (arena) RenderTable(node);
         case TABLE_ROW_GROUP:
         case TABLE_HEADER_GROUP:
         case TABLE_FOOTER_GROUP:
-            o = new (arena) RenderTableSection(node);
-            break;
+            return new (arena) RenderTableSection(node);
         case TABLE_ROW:
-            o = new (arena) RenderTableRow(node);
-            break;
+            return new (arena) RenderTableRow(node);
         case TABLE_COLUMN_GROUP:
         case TABLE_COLUMN:
-            o = new (arena) RenderTableCol(node);
-            break;
+            return new (arena) RenderTableCol(node);
         case TABLE_CELL:
-            o = new (arena) RenderTableCell(node);
-            break;
+            return new (arena) RenderTableCell(node);
         case TABLE_CAPTION:
 #if ENABLE(WCSS)
         // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
@@ -153,15 +152,13 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         // principal block box ([CSS2] section 9.2.1).
         case WAP_MARQUEE:
 #endif
-            o = new (arena) RenderBlock(node);
-            break;
+            return new (arena) RenderBlock(node);
         case BOX:
         case INLINE_BOX:
-            o = new (arena) RenderFlexibleBox(node);
-            break;
+            return new (arena) RenderFlexibleBox(node);
     }
 
-    return o;
+    return 0;
 }
 
 #ifndef NDEBUG 
@@ -646,7 +643,7 @@ RenderBlock* RenderObject::containingBlock() const
     }
 
     if (!o || !o->isRenderBlock())
-        return 0; // Probably doesn't happen any more, but leave just in case. -dwh
+        return 0; // This can still happen in case of an orphaned tree
 
     return toRenderBlock(o);
 }
@@ -722,7 +719,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(width);
             graphicsContext->setStrokeStyle(style == DASHED ? DashedStroke : DottedStroke);
 
@@ -743,7 +740,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
 
             if (adjbw1 == 0 && adjbw2 == 0) {
                 graphicsContext->setStrokeStyle(NoStroke);
-                graphicsContext->setFillColor(c);
+                graphicsContext->setFillColor(c, m_style->colorSpace());
                 switch (s) {
                     case BSTop:
                     case BSBottom:
@@ -856,7 +853,7 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
             // fall through
         case SOLID: {
             graphicsContext->setStrokeStyle(NoStroke);
-            graphicsContext->setFillColor(c);
+            graphicsContext->setFillColor(c, m_style->colorSpace());
             ASSERT(x2 >= x1);
             ASSERT(y2 >= y1);
             if (!adjbw1 && !adjbw2) {
@@ -916,7 +913,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             return;
         case DOTTED:
         case DASHED:
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeStyle(style == DOTTED ? DottedStroke : DashedStroke);
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
@@ -938,7 +935,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(third);
             graphicsContext->strokeArc(IntRect(x, outerY, radius.width() * 2, outerHeight), angleStart, angleSpan);
             graphicsContext->setStrokeThickness(innerThird > 2 ? innerThird - 1 : innerThird);
@@ -957,13 +954,13 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             }
 
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
 
             float halfThickness = (thickness + 1.0f) / 4.0f;
             int shiftForInner = static_cast<int>(halfThickness * 1.5f);
-            graphicsContext->setStrokeColor(c2);
+            graphicsContext->setStrokeColor(c2, m_style->colorSpace());
             graphicsContext->setStrokeThickness(halfThickness > 2 ? halfThickness - 1 : halfThickness);
             graphicsContext->strokeArc(IntRect(x + shiftForInner, y + shiftForInner, (radius.width() - shiftForInner) * 2,
                                        (radius.height() - shiftForInner) * 2), angleStart, angleSpan);
@@ -977,7 +974,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
                 c = c.dark();
         case SOLID:
             graphicsContext->setStrokeStyle(SolidStroke);
-            graphicsContext->setStrokeColor(c);
+            graphicsContext->setStrokeColor(c, m_style->colorSpace());
             graphicsContext->setStrokeThickness(thickness);
             graphicsContext->strokeArc(IntRect(x, y, radius.width() * 2, radius.height() * 2), angleStart, angleSpan);
             break;
@@ -1341,6 +1338,50 @@ void RenderObject::showTreeForThis() const
         node()->showTreeForThis();
 }
 
+void RenderObject::showRenderObject() const
+{
+    showRenderObject(0);
+}
+
+void RenderObject::showRenderObject(int printedCharacters) const
+{
+    // As this function is intended to be used when debugging, the
+    // this pointer may be 0.
+    if (!this) {
+        fputs("(null)\n", stderr);
+        return;
+    }
+
+    printedCharacters += fprintf(stderr, "%s %p", renderName(), this);
+
+    if (node()) {
+        if (printedCharacters)
+            for (; printedCharacters < 39; printedCharacters++)
+                fputc(' ', stderr);
+        fputc('\t', stderr);
+        node()->showNode();
+    } else
+        fputc('\n', stderr);
+}
+
+void RenderObject::showRenderTreeAndMark(const RenderObject* markedObject1, const char* markedLabel1, const RenderObject* markedObject2, const char* markedLabel2, int depth) const
+{
+    int printedCharacters = 0;
+    if (markedObject1 == this && markedLabel1)
+        printedCharacters += fprintf(stderr, "%s", markedLabel1);
+    if (markedObject2 == this && markedLabel2)
+        printedCharacters += fprintf(stderr, "%s", markedLabel2);
+    for (; printedCharacters < depth * 2; printedCharacters++)
+        fputc(' ', stderr);
+
+    showRenderObject(printedCharacters);
+    if (!this)
+        return;
+
+    for (const RenderObject* child = firstChild(); child; child = child->nextSibling())
+        child->showRenderTreeAndMark(markedObject1, markedLabel1, markedObject2, markedLabel2, depth + 1);
+}
+
 #endif // NDEBUG
 
 Color RenderObject::selectionBackgroundColor() const
@@ -2372,9 +2413,20 @@ RenderBoxModelObject* RenderObject::offsetParent() const
 
 VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affinity)
 {
-    // If this is a non-anonymous renderer, then it's simple.
-    if (Node* node = this->node())
+    // If this is a non-anonymous renderer in an editable area, then it's simple.
+    if (Node* node = this->node()) {
+        if (!node->isContentEditable()) {
+            // If it can be found, we prefer a visually equivalent position that is editable. 
+            Position position(node, offset);
+            Position candidate = position.downstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+            candidate = position.upstream(Position::CanCrossEditingBoundary);
+            if (candidate.node()->isContentEditable())
+                return VisiblePosition(candidate, affinity);
+        }
         return VisiblePosition(node, offset, affinity);
+    }
 
     // We don't want to cross the boundary between editable and non-editable
     // regions of the document, but that is either impossible or at least
@@ -2476,4 +2528,19 @@ void showTree(const WebCore::RenderObject* ro)
         ro->showTreeForThis();
 }
 
+void showRenderTree(const WebCore::RenderObject* object1)
+{
+    showRenderTree(object1, 0);
+}
+
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2)
+{
+    if (object1) {
+        const WebCore::RenderObject* root = object1;
+        while (root->parent())
+            root = root->parent();
+        root->showRenderTreeAndMark(object1, "*", object2, "-", 0);
+    }
+}
+
 #endif
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index e358c98..d40ae6d 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -76,11 +77,13 @@ enum PaintPhase {
     PaintPhaseMask
 };
 
-enum PaintRestriction {
-    PaintRestrictionNone,
-    PaintRestrictionSelectionOnly,
-    PaintRestrictionSelectionOnlyBlackText
+enum PaintBehaviorFlags {
+    PaintBehaviorNormal = 0,
+    PaintBehaviorSelectionOnly = 1 << 0,
+    PaintBehaviorForceBlackText = 1 << 1,
+    PaintBehaviorFlattenCompositingLayers = 1 << 2
 };
+typedef unsigned PaintBehavior;
 
 enum HitTestFilter {
     HitTestAll,
@@ -228,6 +231,12 @@ private:
 public:
 #ifndef NDEBUG
     void showTreeForThis() const;
+
+    void showRenderObject() const;
+    // We don't make printedCharacters an optional parameter so that
+    // showRenderObject can be called from gdb easily.
+    void showRenderObject(int printedCharacters) const;
+    void showRenderTreeAndMark(const RenderObject* markedObject1 = 0, const char* markedLabel1 = 0, const RenderObject* markedObject2 = 0, const char* markedLabel2 = 0, int depth = 0) const;
 #endif
 
     static RenderObject* createObject(Node*, RenderStyle*);
@@ -252,6 +261,7 @@ public:
     virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
     virtual bool isFieldset() const { return false; }
+    virtual bool isFileUploadControl() const { return false; }
     virtual bool isFrame() const { return false; }
     virtual bool isFrameSet() const { return false; }
     virtual bool isImage() const { return false; }
@@ -267,6 +277,10 @@ public:
     virtual bool isRenderInline() const { return false; }
     virtual bool isRenderPart() const { return false; }
     virtual bool isRenderView() const { return false; }
+    virtual bool isRuby() const { return false; }
+    virtual bool isRubyBase() const { return false; }
+    virtual bool isRubyRun() const { return false; }
+    virtual bool isRubyText() const { return false; }
     virtual bool isSlider() const { return false; }
     virtual bool isTable() const { return false; }
     virtual bool isTableCell() const { return false; }
@@ -1028,6 +1042,10 @@ inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* render
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::RenderObject*);
+void showRenderTree(const WebCore::RenderObject* object1);
+// We don't make object2 an optional parameter so that showRenderTree
+// can be called from gdb easily.
+void showRenderTree(const WebCore::RenderObject* object1, const WebCore::RenderObject* object2);
 #endif
 
 #endif // RenderObject_h
diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 23ab98f..d56a015 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -271,24 +271,29 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     return beforeAfterParent;
 }
 
-static void invalidateCountersInContainer(RenderObject* container)
+static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
 {
     if (!container)
         return;
     container = findBeforeAfterParent(container);
     if (!container)
         return;
+    // Sometimes the counter is attached directly on the container.
+    if (container->isCounter()) {
+        toRenderCounter(container)->invalidate(identifier);
+        return;
+    }
     for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
         if (content->isCounter())
-            toRenderCounter(content)->invalidate();
+            toRenderCounter(content)->invalidate(identifier);
     }
 }
 
-void RenderObjectChildList::invalidateCounters(RenderObject* owner)
+void RenderObjectChildList::invalidateCounters(RenderObject* owner, const AtomicString& identifier)
 {
     ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE));
-    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER));
+    invalidateCountersInContainer(beforeAfterContainer(owner, BEFORE), identifier);
+    invalidateCountersInContainer(beforeAfterContainer(owner, AFTER), identifier);
 }
 
 void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject)
@@ -369,9 +374,11 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                     RefPtr<RenderStyle> style = RenderStyle::create();
                     style->inheritFrom(pseudoElementStyle);
                     genChild->setStyle(style.release());
-                } else
-                    // Must be a first-letter container. updateFirstLetter() will take care of it.
-                    ASSERT(genChild->style()->styleType() == FIRST_LETTER);
+                } else {
+                    // RenderListItem may insert a list marker here. We do not need to care about this case.
+                    // Otherwise, genChild must be a first-letter container. updateFirstLetter() will take care of it.
+                    ASSERT(genChild->isListMarker() || genChild->style()->styleType() == FIRST_LETTER);
+                }
             }
         }
         return; // We've updated the generated content. That's all we needed to do.
diff --git a/WebCore/rendering/RenderObjectChildList.h b/WebCore/rendering/RenderObjectChildList.h
index bf8800a..ba73c50 100644
--- a/WebCore/rendering/RenderObjectChildList.h
+++ b/WebCore/rendering/RenderObjectChildList.h
@@ -30,6 +30,7 @@
 
 namespace WebCore {
 
+class AtomicString;
 class RenderObject;
 
 class RenderObjectChildList {
@@ -55,7 +56,7 @@ public:
     void insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* before, bool fullInsert = true);
 
     void updateBeforeAfterContent(RenderObject* owner, PseudoId type, RenderObject* styledObject = 0);
-    void invalidateCounters(RenderObject* owner);
+    void invalidateCounters(RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/WebCore/rendering/RenderOverflow.h b/WebCore/rendering/RenderOverflow.h
index ed8976a..253a672 100644
--- a/WebCore/rendering/RenderOverflow.h
+++ b/WebCore/rendering/RenderOverflow.h
@@ -37,7 +37,7 @@ namespace WebCore
 // Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
 
 // This object is allocated only when some of these fields have non-default values in the owning box.
-class RenderOverflow {
+class RenderOverflow : public Noncopyable {
 public:
     RenderOverflow(const IntRect& defaultRect = IntRect()) 
         : m_topLayoutOverflow(defaultRect.y())
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 27d2e72..ba579df 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -153,7 +153,7 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
     if (drawSelectionTint) {
         IntRect selectionPaintingRect = localSelectionRect();
         selectionPaintingRect.move(tx, ty);
-        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionPaintingRect, selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
diff --git a/WebCore/rendering/RenderReplica.cpp b/WebCore/rendering/RenderReplica.cpp
index 5fa3c62..1d589ae 100644
--- a/WebCore/rendering/RenderReplica.cpp
+++ b/WebCore/rendering/RenderReplica.cpp
@@ -72,7 +72,7 @@ void RenderReplica::paint(PaintInfo& paintInfo, int tx, int ty)
         // computing using the wrong rootLayer
         layer()->parent()->paintLayer(layer()->transform() ? layer()->parent() : layer()->enclosingTransformedAncestor(),
                                       paintInfo.context, paintInfo.rect,
-                                      PaintRestrictionNone, 0, 0,
+                                      PaintBehaviorNormal, 0, 0,
                                       RenderLayer::PaintLayerHaveTransparency | RenderLayer::PaintLayerAppliedTransform | RenderLayer::PaintLayerTemporaryClipRects | RenderLayer::PaintLayerPaintingReflection);
     else if (paintInfo.phase == PaintPhaseMask)
         paintMask(paintInfo, tx, ty);
diff --git a/WebCore/rendering/RenderRuby.cpp b/WebCore/rendering/RenderRuby.cpp
new file mode 100644
index 0000000..8d113f9
--- /dev/null
+++ b/WebCore/rendering/RenderRuby.cpp
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRuby.h"
+
+#include "RenderRubyRun.h"
+
+namespace WebCore {
+
+//=== generic helper functions to avoid excessive code duplication ===
+
+static RenderRubyRun* lastRubyRun(const RenderObject* ruby)
+{
+    RenderObject* child = ruby->lastChild();
+    if (child && ruby->isAfterContent(child))
+        child = child->previousSibling();
+    ASSERT(!child || child->isRubyRun());
+    return static_cast<RenderRubyRun*>(child);
+}
+
+static inline RenderRubyRun* findRubyRunParent(RenderObject* child)
+{
+    while (child && !child->isRubyRun())
+        child = child->parent();
+    return static_cast<RenderRubyRun*>(child);
+}
+
+//=== ruby as inline object ===
+
+RenderRubyAsInline::RenderRubyAsInline(Node* node)
+    : RenderInline(node)
+{
+}
+
+RenderRubyAsInline::~RenderRubyAsInline()
+{
+}
+
+bool RenderRubyAsInline::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderInline::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderRubyRun* run = findRubyRunParent(beforeChild);
+        ASSERT(run); // beforeChild should always have a run as parent
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderInline::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsInline::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, i.e. a ruby run or ':after' content,
+    // just use the normal remove method.
+    if (child->parent() == this) {
+        ASSERT(child->isRubyRun() || child->isAfterContent());
+        RenderInline::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+
+//=== ruby as block object ===
+
+RenderRubyAsBlock::RenderRubyAsBlock(Node* node)
+    : RenderBlock(node)
+{
+}
+
+RenderRubyAsBlock::~RenderRubyAsBlock()
+{
+}
+
+bool RenderRubyAsBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText()
+        || child->isRubyRun()
+        || child->isInline();
+}
+
+void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    // Note: ':after' content is handled implicitely below
+
+    // if child is a ruby run, just add it normally
+    if (child->isRubyRun()) {
+        RenderBlock::addChild(child, beforeChild);
+        return;
+    }
+
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderObject* run = beforeChild;
+        while (run && !run->isRubyRun())
+            run = run->parent();
+        if (run) {
+            run->addChild(child, beforeChild);
+            return;
+        }
+        ASSERT(false); // beforeChild should always have a run as parent!
+        // Emergency fallback: fall through and just append.
+    }
+
+    // If the new child would be appended, try to add the child to the previous run
+    // if possible, or create a new run otherwise.
+    // (The RenderRubyRun object will handle the details)
+    RenderRubyRun* lastRun = lastRubyRun(this);
+    if (!lastRun || lastRun->hasRubyText()) {
+        lastRun = RenderRubyRun::staticCreateRubyRun(this);
+        RenderBlock::addChild(lastRun);
+    }
+    lastRun->addChild(child);
+}
+
+void RenderRubyAsBlock::removeChild(RenderObject* child)
+{
+    // If the child's parent is *this, just use the normal remove method.
+    if (child->parent() == this) {
+        // This should happen only during destruction of the whole ruby element, though.
+        RenderBlock::removeChild(child);
+        return;
+    }
+
+    // Find the containing run
+    RenderRubyRun* run = findRubyRunParent(child);
+    ASSERT(run);
+    run->removeChild(child);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/rendering/RenderRuby.h b/WebCore/rendering/RenderRuby.h
new file mode 100644
index 0000000..a74150c
--- /dev/null
+++ b/WebCore/rendering/RenderRuby.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRuby_h
+#define RenderRuby_h
+
+#include "RenderBlock.h"
+#include "RenderInline.h"
+
+namespace WebCore {
+
+// Following the HTML 5 spec, the box object model for a <ruby> element allows several runs of ruby
+// bases with their respective ruby texts looks as follows:
+//
+// 1 RenderRuby object, corresponding to the whole <ruby> HTML element
+//      1+ RenderRubyRun (anonymous)
+//          0 or 1 RenderRubyText - shuffled to the front in order to re-use existing block layouting
+//              0-n inline object(s)
+//          0 or 1 RenderRubyBase - contains the inline objects that make up the ruby base
+//              1-n inline object(s)
+//
+// Note: <rp> elements are defined as having 'display:none' and thus normally are not assigned a renderer.
+
+// <ruby> when used as 'display:inline'
+class RenderRubyAsInline : public RenderInline {
+public:
+    RenderRubyAsInline(Node*);
+    virtual ~RenderRubyAsInline();
+
+    virtual const char* renderName() const { return "RenderRuby (inline)"; }
+
+    virtual bool isRuby() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+};
+
+// <ruby> when used as 'display:block' or 'display:inline-block'
+class RenderRubyAsBlock : public RenderBlock {
+public:
+    RenderRubyAsBlock(Node*);
+    virtual ~RenderRubyAsBlock();
+
+    virtual const char* renderName() const { return "RenderRuby (block)"; }
+
+    virtual bool isRuby() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+};
+
+} // namespace WebCore
+
+#endif // RenderRuby_h
diff --git a/WebCore/rendering/RenderRubyBase.cpp b/WebCore/rendering/RenderRubyBase.cpp
new file mode 100644
index 0000000..5cb25f4
--- /dev/null
+++ b/WebCore/rendering/RenderRubyBase.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyBase.h"
+
+namespace WebCore {
+
+RenderRubyBase::RenderRubyBase(Node* node)
+    : RenderBlock(node)
+{
+    setInline(false);
+}
+
+RenderRubyBase::~RenderRubyBase()
+{
+}
+
+bool RenderRubyBase::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
+void RenderRubyBase::splitToLeft(RenderBlock* leftBase, RenderObject* beforeChild)
+{
+    // This function removes all children that are before (!) beforeChild
+    // and appends them to leftBase.
+    ASSERT(leftBase);
+
+    // First make sure that beforeChild (if set) is indeed a direct child of this.
+    // Fallback: climb up the tree to make sure. This may result in somewhat incorrect rendering.
+    // FIXME: Can this happen? Is there a better/more correct way to solve this?
+    ASSERT(!beforeChild || beforeChild->parent() == this);
+    while (beforeChild && beforeChild->parent() != this)
+        beforeChild = beforeChild->parent();
+
+    RenderObject* child = firstChild();
+    while (child != beforeChild) {
+        RenderObject* nextChild = child->nextSibling();
+        moveChildTo(leftBase, leftBase->children(), child);
+        child = nextChild;
+    }
+}
+
+void RenderRubyBase::mergeWithRight(RenderBlock* rightBase)
+{
+    // This function removes all children and prepends (!) them to rightBase.
+    ASSERT(rightBase);
+
+    RenderObject* firstPos = rightBase->firstChild();
+    RenderObject* child = lastChild();
+    while (child) {
+        moveChildTo(rightBase, rightBase->children(), firstPos, child);
+        firstPos = child;
+        child = lastChild();
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyBase.h b/WebCore/rendering/RenderRubyBase.h
new file mode 100644
index 0000000..57baf99
--- /dev/null
+++ b/WebCore/rendering/RenderRubyBase.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyBase_h
+#define RenderRubyBase_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase : public RenderBlock {
+public:
+    RenderRubyBase(Node*);
+    virtual ~RenderRubyBase();
+
+    virtual const char* renderName() const { return "RenderRubyBase (anonymous)"; }
+
+    virtual bool isRubyBase() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+
+    void splitToLeft(RenderBlock* leftBase, RenderObject* beforeChild);
+    void mergeWithRight(RenderBlock* rightBase);
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyBase_h
diff --git a/WebCore/rendering/RenderRubyRun.cpp b/WebCore/rendering/RenderRubyRun.cpp
new file mode 100644
index 0000000..8578c55
--- /dev/null
+++ b/WebCore/rendering/RenderRubyRun.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyRun.h"
+
+#include "RenderRubyBase.h"
+#include "RenderRubyText.h"
+#include "RenderView.h"
+
+using namespace std;
+
+namespace WebCore {
+
+RenderRubyRun::RenderRubyRun(Node* node)
+    : RenderBlock(node)
+    , m_beingDestroyed(false)
+{
+    setReplaced(true);
+    setInline(true);
+}
+
+RenderRubyRun::~RenderRubyRun()
+{
+}
+
+void RenderRubyRun::destroy()
+{
+    // Mark if the run is being destroyed to avoid trouble in removeChild().
+    m_beingDestroyed = true;
+    RenderBlock::destroy();
+}
+
+bool RenderRubyRun::hasRubyText() const
+{
+    // The only place where a ruby text can be is in the first position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return firstChild() && firstChild()->isRubyText();
+}
+
+bool RenderRubyRun::hasRubyBase() const
+{
+    // The only place where a ruby base can be is in the last position
+    // Note: As anonymous blocks, ruby runs do not have ':before' or ':after' content themselves.
+    return lastChild() && lastChild()->isRubyBase();
+}
+
+bool RenderRubyRun::isEmpty() const
+{
+    return !hasRubyText() && !hasRubyBase();
+}
+
+RenderRubyText* RenderRubyRun::rubyText() const
+{
+    RenderObject* child = firstChild();
+    return child && child->isRubyText() ? static_cast<RenderRubyText*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBase() const
+{
+    RenderObject* child = lastChild();
+    return child && child->isRubyBase() ? static_cast<RenderRubyBase*>(child) : 0;
+}
+
+RenderRubyBase* RenderRubyRun::rubyBaseSafe()
+{
+    RenderRubyBase* base = rubyBase();
+    if (!base) {
+        base = createRubyBase();
+        RenderBlock::addChild(base);
+    }
+    return base;
+}
+
+RenderBlock* RenderRubyRun::firstLineBlock() const
+{
+    return 0;
+}
+
+void RenderRubyRun::updateFirstLetter()
+{
+}
+
+bool RenderRubyRun::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isRubyText() || child->isInline();
+}
+
+void RenderRubyRun::addChild(RenderObject* child, RenderObject* beforeChild)
+{
+    ASSERT(child);
+
+    // If child is a ruby text
+    if (child->isRubyText()) {
+        if (!beforeChild) {
+            // RenderRuby has already ascertained that we can add the child here.
+            ASSERT(!hasRubyText());
+            // prepend ruby texts as first child
+            RenderBlock::addChild(child, firstChild());
+        }  else if (beforeChild->isRubyText()) {
+            // New text is inserted just before another.
+            // In this case the new text takes the place of the old one, and
+            // the old text goes into a new run that is inserted as next sibling.
+            ASSERT(beforeChild->parent() == this);
+            RenderObject* ruby = parent();
+            ASSERT(ruby->isRuby());
+            RenderBlock* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, nextSibling());
+            // Add the new ruby text and move the old one to the new run
+            // Note: Doing it in this order and not using RenderRubyRun's methods,
+            // in order to avoid automatic removal of the ruby run in case there is no
+            // other child besides the old ruby text.
+            RenderBlock::addChild(child, beforeChild);
+            RenderBlock::removeChild(beforeChild);
+            newRun->addChild(beforeChild);
+        } else {
+            ASSERT(hasRubyBase()); // Otherwise beforeChild would be borked.
+            // Insertion before a ruby base object.
+            // In this case we need insert a new run before the current one and split the base.
+            RenderObject* ruby = parent();
+            RenderRubyRun* newRun = staticCreateRubyRun(ruby);
+            ruby->addChild(newRun, this);
+            newRun->addChild(child);
+            rubyBaseSafe()->splitToLeft(newRun->rubyBaseSafe(), beforeChild);
+        }
+    } else {
+        // child is not a text -> insert it into the base
+        // (append it instead if beforeChild is the ruby text)
+        if (beforeChild && beforeChild->isRubyText())
+            beforeChild = 0;
+        rubyBaseSafe()->addChild(child, beforeChild);
+    }
+}
+
+void RenderRubyRun::removeChild(RenderObject* child)
+{
+    // If the child is a ruby text, then merge the ruby base with the base of
+    // the right sibling run, if possible.
+    if (!m_beingDestroyed && !documentBeingDestroyed() && child->isRubyText()) {
+        RenderRubyBase* base = rubyBase();
+        RenderObject* rightNeighbour = nextSibling();
+        if (base && rightNeighbour && rightNeighbour->isRubyRun()) {
+            // Ruby run without a base can happen only at the first run.
+            RenderRubyRun* rightRun = static_cast<RenderRubyRun*>(rightNeighbour);
+            ASSERT(rightRun->hasRubyBase());
+            base->mergeWithRight(rightRun->rubyBaseSafe());
+            // The now empty ruby base will be removed below.
+        }
+    }
+
+    RenderBlock::removeChild(child);
+
+    if (!m_beingDestroyed && !documentBeingDestroyed()) {
+        // Check if our base (if any) is now empty. If so, destroy it.
+        RenderBlock* base = rubyBase();
+        if (base && !base->firstChild()) {
+            RenderBlock::removeChild(base);
+            base->deleteLineBoxTree();
+            base->destroy();
+        }
+
+        // If any of the above leaves the run empty, destroy it as well.
+        if (isEmpty()) {
+            parent()->removeChild(this);
+            deleteLineBoxTree();
+            destroy();
+        }
+    }
+}
+
+RenderRubyBase* RenderRubyRun::createRubyBase() const
+{
+    RenderRubyBase* rb = new (renderArena()) RenderRubyBase(document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(style());
+    newStyle->setDisplay(BLOCK);
+    newStyle->setTextAlign(CENTER); // FIXME: use WEBKIT_CENTER?
+    rb->setStyle(newStyle.release());
+    return rb;
+}
+
+RenderRubyRun* RenderRubyRun::staticCreateRubyRun(const RenderObject* parentRuby)
+{
+    ASSERT(parentRuby && parentRuby->isRuby());
+    RenderRubyRun* rr = new (parentRuby->renderArena()) RenderRubyRun(parentRuby->document() /* anonymous */);
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(parentRuby->style());
+    newStyle->setDisplay(INLINE_BLOCK);
+    rr->setStyle(newStyle.release());
+    return rr;
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyRun.h b/WebCore/rendering/RenderRubyRun.h
new file mode 100644
index 0000000..361dfe5
--- /dev/null
+++ b/WebCore/rendering/RenderRubyRun.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyRun_h
+#define RenderRubyRun_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyBase;
+class RenderRubyText;
+
+// RenderRubyRun are 'inline-block/table' like objects,and wrap a single pairing of a ruby base with its ruby text(s).
+// See RenderRuby.h for further comments on the structure
+
+class RenderRubyRun : public RenderBlock {
+public:
+    RenderRubyRun(Node*);
+    virtual ~RenderRubyRun();
+
+    virtual void destroy();
+
+    virtual const char* renderName() const { return "RenderRubyRun (anonymous)"; }
+
+    virtual bool isRubyRun() const { return true; }
+
+    bool hasRubyText() const;
+    bool hasRubyBase() const;
+    bool isEmpty() const;
+    RenderRubyText* rubyText() const;
+    RenderRubyBase* rubyBase() const;
+    RenderRubyBase* rubyBaseSafe(); // creates the base if it doesn't already exist
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+    virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
+    virtual void removeChild(RenderObject* child);
+
+    virtual RenderBlock* firstLineBlock() const;
+    virtual void updateFirstLetter();
+
+    static RenderRubyRun* staticCreateRubyRun(const RenderObject* parentRuby);
+
+protected:
+    RenderRubyBase* createRubyBase() const;
+    
+private:
+    bool m_beingDestroyed;
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyRun_h
diff --git a/WebCore/rendering/RenderRubyText.cpp b/WebCore/rendering/RenderRubyText.cpp
new file mode 100644
index 0000000..cfe3b5c
--- /dev/null
+++ b/WebCore/rendering/RenderRubyText.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderRubyText.h"
+
+namespace WebCore {
+
+RenderRubyText::RenderRubyText(Node* node)
+    : RenderBlock(node)
+{
+}
+
+RenderRubyText::~RenderRubyText()
+{
+}
+
+bool RenderRubyText::isChildAllowed(RenderObject* child, RenderStyle*) const
+{
+    return child->isInline();
+}
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderRubyText.h b/WebCore/rendering/RenderRubyText.h
new file mode 100644
index 0000000..e475914
--- /dev/null
+++ b/WebCore/rendering/RenderRubyText.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderRubyText_h
+#define RenderRubyText_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderRubyText : public RenderBlock {
+public:
+    RenderRubyText(Node*);
+    virtual ~RenderRubyText();
+
+    virtual const char* renderName() const { return "RenderRubyText"; }
+
+    virtual bool isRubyText() const { return true; }
+
+    virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
+};
+
+} // namespace WebCore
+
+#endif // RenderRubyText_h
diff --git a/WebCore/rendering/RenderSVGImage.cpp b/WebCore/rendering/RenderSVGImage.cpp
index 7e0b40d..41a1a10 100644
--- a/WebCore/rendering/RenderSVGImage.cpp
+++ b/WebCore/rendering/RenderSVGImage.cpp
@@ -166,7 +166,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
         if (imageElt->preserveAspectRatio()->align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
             adjustRectsForAspectRatio(destRect, srcRect, imageElt->preserveAspectRatio());
 
-        paintInfo.context->drawImage(image(), destRect, srcRect);
+        paintInfo.context->drawImage(image(), DeviceColorSpace, destRect, srcRect);
         finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
     }
 
diff --git a/WebCore/rendering/RenderScrollbarTheme.cpp b/WebCore/rendering/RenderScrollbarTheme.cpp
index 06ca32a..19143cc 100644
--- a/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -109,7 +109,7 @@ IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollb
 void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect)
 {
     // FIXME: Implement.
-    context->fillRect(cornerRect, Color::white);
+    context->fillRect(cornerRect, Color::white, DeviceColorSpace);
 }
 
 void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
diff --git a/WebCore/rendering/RenderSelectionInfo.h b/WebCore/rendering/RenderSelectionInfo.h
index e7b7b78..c06a9ae 100644
--- a/WebCore/rendering/RenderSelectionInfo.h
+++ b/WebCore/rendering/RenderSelectionInfo.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class RenderSelectionInfoBase {
+class RenderSelectionInfoBase : public Noncopyable {
 public:
     RenderSelectionInfoBase()
         : m_object(0)
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index c8b60fd..7398a2f 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -52,7 +52,8 @@ static const int defaultTrackLength = 129;
 // FIXME: The SliderRange class and functions are entirely based on the DOM,
 // and could be put with HTMLInputElement (possibly with a new name) instead of here.
 struct SliderRange {
-    bool isIntegral;
+    bool hasStep;
+    double step;
     double minimum;
     double maximum;  // maximum must be >= minimum.
 
@@ -79,19 +80,28 @@ struct SliderRange {
 
 SliderRange::SliderRange(HTMLInputElement* element)
 {
-    // FIXME: What's the right way to handle an integral range with non-integral minimum and maximum?
-    // Currently values are guaranteed to be integral but could be outside the range in that case.
-
-    isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
-
-    maximum = element->rangeMaximum();
-    minimum = element->rangeMinimum();
+    if (element->hasAttribute(precisionAttr)) {
+        step = 1.0;
+        hasStep = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
+    } else
+        hasStep = element->getAllowedValueStep(&step);
+
+    maximum = element->maximum();
+    minimum = element->minimum();
 }
 
 double SliderRange::clampValue(double value)
 {
     double clampedValue = max(minimum, min(value, maximum));
-    return isIntegral ? round(clampedValue) : clampedValue;
+    if (!hasStep)
+        return clampedValue;
+    // Rounds clampedValue to minimum + N * step.
+    clampedValue = minimum + round((clampedValue - minimum) / step) * step;
+    if (clampedValue > maximum)
+       clampedValue -= step;
+    ASSERT(clampedValue >= minimum);
+    ASSERT(clampedValue <= maximum);
+    return clampedValue;
 }
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
@@ -356,10 +366,9 @@ void RenderSlider::layout()
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
+        addOverflowFromChild(thumb);
     }
 
-    addOverflowFromChild(thumb);
-
     repainter.repaintAfterLayout();    
 
     setNeedsLayout(false);
@@ -374,7 +383,7 @@ void RenderSlider::updateFromElement()
     bool clamped;
     double value = range.valueFromElement(element, &clamped);
     if (clamped)
-        element->setValueFromRenderer(String::number(value));
+        element->setValueFromRenderer(HTMLInputElement::formStringFromDouble(value));
 
     // Layout will take care of the thumb's size and position.
     if (!m_thumb) {
@@ -430,7 +439,7 @@ void RenderSlider::setValueForPosition(int position)
     if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
-    element->setValueFromRenderer(String::number(value));
+    element->setValueFromRenderer(HTMLInputElement::formStringFromDouble(value));
 
     // Also update the position if appropriate.
     if (position != currentPosition()) {
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 8e0b613..4e7036e 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -168,6 +168,17 @@ void RenderTableCell::setOverrideSize(int size)
     RenderBlock::setOverrideSize(size);
 }
 
+IntSize RenderTableCell::offsetFromContainer(RenderObject* o) const
+{
+    ASSERT(o == container());
+
+    IntSize offset = RenderBlock::offsetFromContainer(o);
+    if (parent())
+        offset.expand(-parentBox()->x(), -parentBox()->y());
+
+    return offset;
+}
+
 IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // If the table grid is dirty, we cannot get reliable information about adjoining cells,
@@ -231,30 +242,6 @@ void RenderTableCell::computeRectForRepaint(RenderBoxModelObject* repaintContain
     RenderBlock::computeRectForRepaint(repaintContainer, r, fixed);
 }
 
-void RenderTableCell::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    if (repaintContainer == this)
-        return;
-
-    RenderView* v = view();
-    if ((!v || !v->layoutStateEnabled()) && parent()) {
-        // Rows are in the same coordinate space, so don't add their offset in.
-        // FIXME: this is wrong with transforms
-        transformState.move(-parentBox()->x(), -parentBox()->y());
-    }
-    RenderBlock::mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
-}
-
-void RenderTableCell::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
-{
-    RenderBlock::mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
-    if (parent()) {
-        // Rows are in the same coordinate space, so add their offset back in.
-        // FIXME: this is wrong with transforms
-        transformState.move(parentBox()->x(), parentBox()->y());
-    }
-}
-
 int RenderTableCell::baselinePosition(bool firstLine, bool isRootLineBox) const
 {
     if (isRootLineBox)
diff --git a/WebCore/rendering/RenderTableCell.h b/WebCore/rendering/RenderTableCell.h
index 9532bb6..f285198 100644
--- a/WebCore/rendering/RenderTableCell.h
+++ b/WebCore/rendering/RenderTableCell.h
@@ -110,9 +110,6 @@ protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
-    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
-
 private:
     virtual const char* renderName() const { return isAnonymous() ? "RenderTableCell (anonymous)" : "RenderTableCell"; }
 
@@ -127,6 +124,7 @@ private:
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo&, int tx, int ty);
 
+    virtual IntSize offsetFromContainer(RenderObject*) const;
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
 
diff --git a/WebCore/rendering/RenderTableRow.cpp b/WebCore/rendering/RenderTableRow.cpp
index bafadfc..a11a14b 100644
--- a/WebCore/rendering/RenderTableRow.cpp
+++ b/WebCore/rendering/RenderTableRow.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 5052c3a..b627afe 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -46,6 +46,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void setRowHeightToRowStyleHeightIfNotRelative(RenderTableSection::RowStruct* row)
+{
+    ASSERT(row && row->rowRenderer);
+    row->height = row->rowRenderer->style()->height();
+    if (row->height.isRelative())
+        row->height = Length();
+}
+
 RenderTableSection::RenderTableSection(Node* node)
     : RenderBox(node)
     , m_gridRows(0)
@@ -126,11 +134,8 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
 
     m_grid[m_cRow].rowRenderer = toRenderTableRow(child);
 
-    if (!beforeChild) {
-        m_grid[m_cRow].height = child->style()->height();
-        if (m_grid[m_cRow].height.isRelative())
-            m_grid[m_cRow].height = Length();
-    }
+    if (!beforeChild)
+        setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
     // If the next renderer is actually wrapped in an anonymous table row, we need to go up and find that.
     while (beforeChild && beforeChild->parent() != this)
@@ -1190,6 +1195,7 @@ void RenderTableSection::recalcCells()
             
             RenderTableRow* tableRow = toRenderTableRow(row);
             m_grid[m_cRow].rowRenderer = tableRow;
+            setRowHeightToRowStyleHeightIfNotRelative(&m_grid[m_cRow]);
 
             for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) {
                 if (cell->isTableCell())
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index 40c3d75..95aa277 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -757,6 +757,17 @@ void RenderText::calcPrefWidths(int leadWidth, HashSet<const SimpleFontData*>& f
     setPrefWidthsDirty(false);
 }
 
+bool RenderText::isAllCollapsibleWhitespace()
+{
+    int length = textLength();
+    const UChar* text = characters();
+    for (int i = 0; i < length; i++) {
+        if (!style()->isCollapsibleWhiteSpace(text[i]))
+            return false;
+    }
+    return true;
+}
+    
 bool RenderText::containsOnlyWhitespace(unsigned from, unsigned len) const
 {
     unsigned currPos;
@@ -813,7 +824,9 @@ void RenderText::setSelectionState(SelectionState state)
         }
     }
 
-    containingBlock()->setSelectionState(state);
+    // The returned value can be null in case of an orphaned tree.
+    if (RenderBlock* cb = containingBlock())
+        cb->setSelectionState(state);
 }
 
 void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset, unsigned len, bool force)
diff --git a/WebCore/rendering/RenderText.h b/WebCore/rendering/RenderText.h
index 915ff40..d46bce9 100644
--- a/WebCore/rendering/RenderText.h
+++ b/WebCore/rendering/RenderText.h
@@ -121,7 +121,8 @@ public:
     void checkConsistency() const;
 
     virtual void calcPrefWidths(int leadWidth);
-
+    bool isAllCollapsibleWhitespace();
+    
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index f430399..b258597 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -70,8 +70,8 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
 RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
     , m_placeholderVisible(placeholderVisible)
-    , m_edited(false)
-    , m_userEdited(false)
+    , m_wasChangedSinceLastChangeEvent(false)
+    , m_lastChangeWasUserEdit(false)
 {
 }
 
@@ -195,17 +195,17 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
             ASSERT(!ec);
         }
 
-        m_edited = false;
-        m_userEdited = false;
+        // We set m_lastChangeWasUserEdit to false since this change was not explicty made by the user (say, via typing on the keyboard), see <rdar://problem/5359921>.
+        m_lastChangeWasUserEdit = false;
     }
 
     static_cast<Element*>(node())->setFormControlValueMatchesRenderer(true);
 }
 
-void RenderTextControl::setUserEdited(bool isUserEdited)
+void RenderTextControl::setLastChangeWasUserEdit(bool lastChangeWasUserEdit)
 {
-    m_userEdited = isUserEdited;
-    document()->setIgnoreAutofocus(isUserEdited);
+    m_lastChangeWasUserEdit = lastChangeWasUserEdit;
+    document()->setIgnoreAutofocus(lastChangeWasUserEdit);
 }
 
 int RenderTextControl::selectionStart()
@@ -312,8 +312,8 @@ int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos)
 
 void RenderTextControl::subtreeHasChanged()
 {
-    m_edited = true;
-    m_userEdited = true;
+    m_wasChangedSinceLastChangeEvent = true;
+    m_lastChangeWasUserEdit = true;
 }
 
 String RenderTextControl::finishText(Vector<UChar>& result) const
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index cdd8716..394eb9c 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -34,11 +34,11 @@ class RenderTextControl : public RenderBlock {
 public:
     virtual ~RenderTextControl();
 
-    bool isEdited() const { return m_edited; }
-    void setEdited(bool isEdited) { m_edited = isEdited; }
+    bool wasChangedSinceLastChangeEvent() const { return m_wasChangedSinceLastChangeEvent; }
+    void setChangedSinceLastChangeEvent(bool wasChangedSinceLastChangeEvent) { m_wasChangedSinceLastChangeEvent = wasChangedSinceLastChangeEvent; }
 
-    bool isUserEdited() const { return m_userEdited; }
-    void setUserEdited(bool isUserEdited);
+    bool lastChangeWasUserEdit() const { return m_lastChangeWasUserEdit; }
+    void setLastChangeWasUserEdit(bool lastChangeWasUserEdit);
 
     int selectionStart();
     int selectionEnd();
@@ -105,8 +105,8 @@ private:
 
     String finishText(Vector<UChar>&) const;
 
-    bool m_edited;
-    bool m_userEdited;
+    bool m_wasChangedSinceLastChangeEvent;
+    bool m_lastChangeWasUserEdit;
     RefPtr<TextControlInnerTextElement> m_innerText;
 };
 
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index 6ff9235..afc3edd 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -67,8 +67,8 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
         return false;
 
     bool resultIsTextValueOrPlaceholder
-        = !m_placeholderVisible && result.innerNode() == innerTextElement()
-        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+        = (!m_placeholderVisible && result.innerNode() == innerTextElement())
+        || (m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement()));
     if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index dd1c24c..56d4363 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -150,7 +150,7 @@ void RenderTextControlSingleLine::hidePopup()
 
 void RenderTextControlSingleLine::subtreeHasChanged()
 {
-    bool wasEdited = isEdited();
+    bool wasChanged = wasChangedSinceLastChangeEvent();
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
@@ -167,7 +167,7 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     if (input->searchEventsShouldBeDispatched())
         startSearchEventTimer();
 
-    if (!wasEdited && node()->focused()) {
+    if (!wasChanged && node()->focused()) {
         if (Frame* frame = document()->frame())
             frame->textFieldDidBeginEditing(static_cast<Element*>(node()));
     }
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index 238279a..f6afb77 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -1,7 +1,7 @@
 /**
  * This file is part of the theme implementation for form controls in WebCore.
  *
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -282,6 +282,8 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintMediaRewindButton(o, paintInfo, r);
         case MediaReturnToRealtimeButtonPart:
             return paintMediaReturnToRealtimeButton(o, paintInfo, r);
+        case MediaToggleClosedCaptionsButtonPart:
+            return paintMediaToggleClosedCaptionsButton(o, paintInfo, r);
         case MediaSliderPart:
             return paintMediaSliderTrack(o, paintInfo, r);
         case MediaSliderThumbPart:
@@ -420,6 +422,8 @@ bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
         return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
     case MediaFullscreenButtonPart:
         return mediaElement->supportsFullscreen();
+    case MediaToggleClosedCaptionsButtonPart:
+        return mediaElement->hasClosedCaptions();
     default:
         return true;
     }
@@ -705,6 +709,10 @@ bool RenderTheme::isHovered(const RenderObject* o) const
 
 bool RenderTheme::isDefault(const RenderObject* o) const
 {
+    // A button should only have the default appearance if the page is active
+    if (!isActive(o))
+        return false;
+
     if (!o->document())
         return false;
 
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 68e2eba..ee359d7 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -253,6 +253,7 @@ protected:
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 9048ce3..4b09174 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -32,6 +32,10 @@
 
 namespace WebCore {
 
+unsigned RenderThemeChromiumLinux::m_thumbInactiveColor = 0xf0ebe5;
+unsigned RenderThemeChromiumLinux::m_thumbActiveColor = 0xfaf8f5;
+unsigned RenderThemeChromiumLinux::m_trackColor = 0xe3ddd8;
+
 PassRefPtr<RenderTheme> RenderThemeChromiumLinux::create()
 {
     return adoptRef(new RenderThemeChromiumLinux());
@@ -122,4 +126,12 @@ double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
     return m_caretBlinkInterval;
 }
 
+void RenderThemeChromiumLinux::setScrollbarColors(
+    SkColor inactiveColor, SkColor activeColor, SkColor trackColor)
+{
+    m_thumbInactiveColor = inactiveColor;
+    m_thumbActiveColor = activeColor;
+    m_trackColor = trackColor;
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.h b/WebCore/rendering/RenderThemeChromiumLinux.h
index e137ad5..8736b0d 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -54,6 +54,13 @@ namespace WebCore {
         void setCaretBlinkInterval(double interval);
         virtual double caretBlinkIntervalInternal() const;
 
+        static void setScrollbarColors(unsigned inactive_color,
+                                       unsigned active_color,
+                                       unsigned track_color);
+        static unsigned thumbInactiveColor() { return m_thumbInactiveColor; }
+        static unsigned thumbActiveColor() { return m_thumbActiveColor; }
+        static unsigned trackColor() { return m_trackColor; }
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
@@ -62,6 +69,10 @@ namespace WebCore {
         virtual bool supportsControlTints() const;
 
         double m_caretBlinkInterval;
+
+        static unsigned m_thumbInactiveColor;
+        static unsigned m_thumbActiveColor;
+        static unsigned m_trackColor;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index bcfcd57..4e57cb5 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -983,7 +983,7 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setFillColor(o->style()->color(), DeviceColorSpace);
     paintInfo.context->setStrokeStyle(NoStroke);
 
     FloatPoint arrow1[3];
@@ -1012,11 +1012,11 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index fb42bb7..016a264 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -231,7 +231,7 @@ bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const RenderObject:
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), rect);
     return false;
 }
 
@@ -263,7 +263,7 @@ bool RenderThemeChromiumSkia::paintRadio(RenderObject* o, const RenderObject::Pa
     else
         image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
 
-    i.context->drawImage(image, rect);
+    i.context->drawImage(image, o->style()->colorSpace(), rect);
     return false;
 }
 
@@ -348,6 +348,15 @@ bool RenderThemeChromiumSkia::paintButton(RenderObject* o, const RenderObject::P
     return false;
 }
 
+void RenderThemeChromiumSkia::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    if (style->appearance() == PushButtonPart) {
+        // Ignore line-height.
+        style->setLineHeight(RenderStyle::initialLineHeight());
+    }
+}
+
+
 bool RenderThemeChromiumSkia::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
 {
     return true;
@@ -358,6 +367,12 @@ bool RenderThemeChromiumSkia::paintTextArea(RenderObject* o, const RenderObject:
     return paintTextField(o, i, r);
 }
 
+void RenderThemeChromiumSkia::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+     // Ignore line-height.
+     style->setLineHeight(RenderStyle::initialLineHeight());
+}
+
 bool RenderThemeChromiumSkia::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
@@ -393,7 +408,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* o, cons
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    i.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -433,7 +448,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* o,
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    i.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -469,7 +484,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    i.context->drawImage(magnifierImage, bounds);
+    i.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
index 98e3a35..18fa859 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -71,11 +71,13 @@ namespace WebCore {
         virtual void setRadioSize(RenderStyle*) const;
 
         virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
         virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 1d68c63..48c6c42 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -126,6 +126,7 @@ protected:
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 03e39a0..6304947 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -913,7 +913,7 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
+    paintInfo.context->setFillColor(o->style()->color(), o->style()->colorSpace());
     paintInfo.context->setStrokeStyle(NoStroke);
 
     FloatPoint arrow1[3];
@@ -942,11 +942,11 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
@@ -1427,8 +1427,6 @@ typedef enum {
 
 static int mediaControllerTheme()
 {
-    static const long minimumQuickTimeVersion = 0x07630000; // 7.6.3
-    static SInt32 quickTimeVersion = 0;
     static int controllerTheme = -1;
     
     if (controllerTheme != -1)
@@ -1436,23 +1434,17 @@ static int mediaControllerTheme()
 
     controllerTheme = MediaControllerThemeClassic;
 
-    if (!quickTimeVersion) {
-        OSErr err;
-        err = Gestalt(gestaltQuickTime, &quickTimeVersion);
-        if (err != noErr)
-            return controllerTheme;
-    }
-    if (quickTimeVersion < minimumQuickTimeVersion)
+    if (!wkMediaControllerThemeAvailable(MediaControllerThemeQuickTime))
         return controllerTheme;
 
     Boolean validKey;
-    Boolean useQTMediaUI = CFPreferencesGetAppBooleanValue(CFSTR("UseQuickTimeMediaUI"), CFSTR("com.apple.WebCore"), &validKey);
+    Boolean useQTMediaUIPref = CFPreferencesGetAppBooleanValue(CFSTR("UseQuickTimeMediaUI"), CFSTR("com.apple.WebCore"), &validKey);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    if (validKey && !useQTMediaUI)
+    if (validKey && !useQTMediaUIPref)
         return controllerTheme;
 #else
-    if (!validKey || !useQTMediaUI)
+    if (!validKey || !useQTMediaUIPref)
         return controllerTheme;
 #endif
 
@@ -1652,7 +1644,22 @@ bool RenderThemeMac::paintMediaReturnToRealtimeButton(RenderObject* o, const Ren
     return false;
 }
 
+bool RenderThemeMac::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    HTMLInputElement* node = static_cast<HTMLInputElement*>(o->node());
+    if (!node)
+        return false;
+    
+    MediaControlToggleClosedCaptionsButtonElement* btn = static_cast<MediaControlToggleClosedCaptionsButtonElement*>(node);
+    if (!btn)
+        return false;
 
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(btn->displayType(), mediaControllerTheme(), paintInfo.context->platformContext(), r, getMediaUIPartStateFlags(node));
+
+    return false;
+}
+ 
 bool RenderThemeMac::paintMediaControlsBackground(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
@@ -1698,12 +1705,16 @@ String RenderThemeMac::extraMediaControlsStyleSheet()
         return String();
 }
 
-bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
+bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* element)
 {
-    if (part == MediaFullscreenButtonPart)
-        return mediaControllerTheme() == MediaControllerThemeQuickTime;
+    if (part == MediaToggleClosedCaptionsButtonPart) {
+
+        // We rely on QTKit to render captions so don't enable the button unless it will be able to do so.
+        if (!element->hasTagName(videoTag))
+            return false;
+    }
 
-    return RenderTheme::shouldRenderMediaControlPart(part, e);
+    return RenderTheme::shouldRenderMediaControlPart(part, element);
 }
 
 #endif // ENABLE(VIDEO)
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 2ea3b8b..9e97079 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -830,8 +830,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
 
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->color());
-    paintInfo.context->setStrokeColor(NoStroke);
+    paintInfo.context->setFillColor(o->style()->color(), DeviceColorSpace);
+    paintInfo.context->setStrokeColor(NoStroke, DeviceColorSpace);
 
     FloatPoint arrow[3];
     arrow[0] = FloatPoint(leftEdge, centerY - arrowHeight / 2.0f);
@@ -851,11 +851,11 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f);
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeWin.cpp b/WebCore/rendering/RenderThemeWin.cpp
index 92bfd03..52afbd6 100644
--- a/WebCore/rendering/RenderThemeWin.cpp
+++ b/WebCore/rendering/RenderThemeWin.cpp
@@ -819,7 +819,7 @@ bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderO
 
     static Image* cancelImage = Image::loadPlatformResource("searchCancel").releaseRef();
     static Image* cancelPressedImage = Image::loadPlatformResource("searchCancelPressed").releaseRef();
-    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, bounds);
+    paintInfo.context->drawImage(isPressed(o) ? cancelPressedImage : cancelImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -868,7 +868,7 @@ bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const Re
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
     
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifier").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -904,7 +904,7 @@ bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const Render
     bounds.setY(parentBox.y() + (parentBox.height() - bounds.height() + 1) / 2);
 
     static Image* magnifierImage = Image::loadPlatformResource("searchMagnifierResults").releaseRef();
-    paintInfo.context->drawImage(magnifierImage, bounds);
+    paintInfo.context->drawImage(magnifierImage, o->style()->colorSpace(), bounds);
     return false;
 }
 
@@ -955,6 +955,23 @@ Color RenderThemeWin::systemColor(int cssValueId) const
 }
 
 #if ENABLE(VIDEO)
+
+bool RenderThemeWin::shouldRenderMediaControlPart(ControlPart part, Element* element)
+{
+    if (part == MediaToggleClosedCaptionsButtonPart) {
+        // We rely on QuickTime to render captions so only enable the button for a video element.
+#if SAFARI_THEME_VERSION >= 4
+        if (!element->hasTagName(videoTag))
+            return false;
+#else
+        return false;
+#endif
+    }
+
+    return RenderTheme::shouldRenderMediaControlPart(part, element);
+}
+
+
 bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
@@ -989,6 +1006,12 @@ bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
+
+bool RenderThemeWin::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+{
+    return RenderMediaControls::paintMediaControlsPart(MediaShowClosedCaptionsButton, o, paintInfo, r);
+}
+
 #endif
 
 }
diff --git a/WebCore/rendering/RenderThemeWin.h b/WebCore/rendering/RenderThemeWin.h
index 99c2004..a9fa5e6 100644
--- a/WebCore/rendering/RenderThemeWin.h
+++ b/WebCore/rendering/RenderThemeWin.h
@@ -125,6 +125,7 @@ public:
     virtual bool supportsFocusRing(const RenderStyle*) const;
 
 #if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
@@ -132,6 +133,7 @@ public:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 #endif
 
 private:
diff --git a/WebCore/rendering/RenderTreeAsText.cpp b/WebCore/rendering/RenderTreeAsText.cpp
index b7ab191..a6f5144 100644
--- a/WebCore/rendering/RenderTreeAsText.cpp
+++ b/WebCore/rendering/RenderTreeAsText.cpp
@@ -36,8 +36,10 @@
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "RenderBR.h"
+#include "RenderFileUploadControl.h"
 #include "RenderInline.h"
 #include "RenderListMarker.h"
+#include "RenderPart.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
@@ -55,6 +57,10 @@
 #include "SVGRenderTreeAsText.h"
 #endif
 
+#if PLATFORM(QT)
+#include <QWidget>
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -217,6 +223,9 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
     ts << " " << r;
 
     if (!(o.isText() && !o.isBR())) {
+        if (o.isFileUploadControl()) {
+            ts << " " << quoteAndEscapeNonPrintables(toRenderFileUploadControl(&o)->fileTextValue());
+        }
         if (o.parent() && (o.parent()->style()->color() != o.style()->color()))
             ts << " [color=" << o.style()->color().name() << "]";
 
@@ -336,6 +345,24 @@ static TextStream &operator<<(TextStream& ts, const RenderObject& o)
         }
     }
 
+#if PLATFORM(QT)
+    // Print attributes of embedded QWidgets. E.g. when the WebCore::Widget
+    // is invisible the QWidget should be invisible too.
+    if (o.isRenderPart()) {
+        const RenderPart* part = toRenderPart(const_cast<RenderObject*>(&o));
+        if (part->widget() && part->widget()->platformWidget()) {
+            QWidget* wid = part->widget()->platformWidget();
+
+            ts << " [QT: ";
+            ts << "geometry: {" << wid->geometry() << "} ";
+            ts << "isHidden: " << wid->isHidden() << " ";
+            ts << "isSelfVisible: " << part->widget()->isSelfVisible() << " ";
+            ts << "isParentVisible: " << part->widget()->isParentVisible() << " ";
+            ts << "mask: {" << wid->mask().boundingRect() << "} ] ";
+        }
+    }
+#endif
+
     return ts;
 }
 
@@ -535,8 +562,11 @@ static void writeSelection(TextStream& ts, const RenderObject* o)
            << "selection end:   position " << selection.end().deprecatedEditingOffset() << " of " << nodePosition(selection.end().node()) << "\n";
 }
 
-String externalRepresentation(RenderObject* o)
+String externalRepresentation(Frame* frame)
 {
+    frame->document()->updateLayout();
+
+    RenderObject* o = frame->contentRenderer();
     if (!o)
         return String();
 
@@ -544,8 +574,6 @@ String externalRepresentation(RenderObject* o)
 #if ENABLE(SVG)
     writeRenderResources(ts, o->document());
 #endif
-    if (o->view()->frameView())
-        o->view()->frameView()->layout();
     if (o->hasLayer()) {
         RenderLayer* l = toRenderBox(o)->layer();
         writeLayers(ts, l, l, IntRect(l->x(), l->y(), l->width(), l->height()));
@@ -554,10 +582,13 @@ String externalRepresentation(RenderObject* o)
     return ts.release();
 }
 
-static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent)
+static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent, bool& isFirstCounter)
 {
     for (RenderObject* child = parent->firstChild(); child; child = child->nextSibling()) {
         if (child->isCounter()) {
+            if (!isFirstCounter)
+                stream << " ";
+            isFirstCounter = false;
             String str(toRenderText(child)->text());
             stream << str;
         }
@@ -570,12 +601,13 @@ String counterValueForElement(Element* element)
     RefPtr<Element> elementRef(element);
     element->document()->updateLayout();
     TextStream stream;
+    bool isFirstCounter = true;
     // The counter renderers should be children of anonymous children
     // (i.e., :before or :after pseudo-elements).
     if (RenderObject* renderer = element->renderer()) {
         for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
             if (child->isAnonymous())
-                writeCounterValuesFromChildren(stream, child);
+                writeCounterValuesFromChildren(stream, child, isFirstCounter);
         }
     }
     return stream.release();
diff --git a/WebCore/rendering/RenderTreeAsText.h b/WebCore/rendering/RenderTreeAsText.h
index 325f109..b00f7c9 100644
--- a/WebCore/rendering/RenderTreeAsText.h
+++ b/WebCore/rendering/RenderTreeAsText.h
@@ -29,11 +29,12 @@
 namespace WebCore {
 
 class Element;
+class Frame;
 class RenderObject;
 class String;
 class TextStream;
 
-String externalRepresentation(RenderObject*);
+String externalRepresentation(Frame*);
 void write(TextStream&, const RenderObject&, int indent = 0);
 
 // Helper function shared with SVGRenderTreeAsText
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index c4a666f..753afe4 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -210,7 +210,7 @@ void RenderView::paintBoxDecorations(PaintInfo& paintInfo, int, int)
         if (baseColor.alpha() > 0) {
             paintInfo.context->save();
             paintInfo.context->setCompositeOperation(CompositeCopy);
-            paintInfo.context->fillRect(paintInfo.rect, baseColor);
+            paintInfo.context->fillRect(paintInfo.rect, baseColor, style()->colorSpace());
             paintInfo.context->restore();
         } else
             paintInfo.context->clearRect(paintInfo.rect);
@@ -338,7 +338,13 @@ IntRect RenderView::selectionBounds(bool clipToVisibleContent) const
     SelectionMap::iterator end = selectedObjects.end();
     for (SelectionMap::iterator i = selectedObjects.begin(); i != end; ++i) {
         RenderSelectionInfo* info = i->second;
-        selRect.unite(info->rect());
+        // RenderSelectionInfo::rect() is in the coordinates of the repaintContainer, so map to page coordinates.
+        IntRect currRect = info->rect();
+        if (RenderBoxModelObject* repaintContainer = info->repaintContainer()) {
+            FloatQuad absQuad = repaintContainer->localToAbsoluteQuad(FloatRect(currRect));
+            currRect = absQuad.enclosingBoundingBox(); 
+        }
+        selRect.unite(currRect);
         delete info;
     }
     return selRect;
@@ -437,7 +443,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         o = o->nextInPreOrder();
     }
 
-    m_cachedSelectionBounds = IntRect();
+    m_layer->clearBlockSelectionGapsBounds();
 
     // Now that the selection state has been updated for the new objects, walk them again and
     // put them in the new objects list.
@@ -450,9 +456,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
                 RenderBlockSelectionInfo* blockInfo = newSelectedBlocks.get(cb);
                 if (blockInfo)
                     break;
-                blockInfo = new RenderBlockSelectionInfo(cb);
-                newSelectedBlocks.set(cb, blockInfo);
-                m_cachedSelectionBounds.unite(blockInfo->rects());
+                newSelectedBlocks.set(cb, new RenderBlockSelectionInfo(cb));
                 cb = cb->containingBlock();
             }
         }
@@ -529,7 +533,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
 void RenderView::clearSelection()
 {
-    repaintViewRectangle(m_cachedSelectionBounds);
+    m_layer->repaintBlockSelectionGaps();
     setSelection(0, -1, 0, -1, RepaintNewMinusOld);
 }
 
diff --git a/WebCore/rendering/RenderView.h b/WebCore/rendering/RenderView.h
index a486b34..37b3f01 100644
--- a/WebCore/rendering/RenderView.h
+++ b/WebCore/rendering/RenderView.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML widget for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2006 Apple Computer, Inc.
  *
@@ -77,9 +75,11 @@ public:
     bool printing() const;
     void setPrintImages(bool enable) { m_printImages = enable; }
     bool printImages() const { return m_printImages; }
-    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_forcedPageBreak = false; }
+    void setTruncatedAt(int y) { m_truncatedAt = y; m_bestTruncatedAt = m_truncatorWidth = 0; m_minimumColumnHeight = 0; m_forcedPageBreak = false; }
     void setBestTruncatedAt(int y, RenderBoxModelObject* forRenderer, bool forcedBreak = false);
+    void setMinimumColumnHeight(int height) { m_minimumColumnHeight = height; }
     int bestTruncatedAt() const { return m_bestTruncatedAt; }
+    int minimumColumnHeight() const { return m_minimumColumnHeight; }
 
     int truncatedAt() const { return m_truncatedAt; }
 
@@ -196,10 +196,9 @@ protected:
     RenderWidgetSet m_widgets;
 
 private:
-    IntRect m_cachedSelectionBounds;
-
     int m_bestTruncatedAt;
     int m_truncatorWidth;
+    int m_minimumColumnHeight;
     bool m_forcedPageBreak;
     LayoutState* m_layoutState;
     unsigned m_layoutStateDisableCount;
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 5a5c9f1..33f03e2 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -23,8 +23,8 @@
 #include "config.h"
 #include "RenderWidget.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
@@ -40,18 +40,65 @@ static HashMap<const Widget*, RenderWidget*>& widgetRendererMap()
     return *staticWidgetRendererMap;
 }
 
+static size_t widgetHierarchyUpdateSuspendCount;
+
+typedef HashMap<RefPtr<Widget>, FrameView*> WidgetToParentMap;
+
+static WidgetToParentMap& widgetNewParentMap()
+{
+    DEFINE_STATIC_LOCAL(WidgetToParentMap, map, ());
+    return map;
+}
+
+void RenderWidget::suspendWidgetHierarchyUpdates()
+{
+    widgetHierarchyUpdateSuspendCount++;
+}
+
+void RenderWidget::resumeWidgetHierarchyUpdates()
+{
+    ASSERT(widgetHierarchyUpdateSuspendCount);
+    if (widgetHierarchyUpdateSuspendCount == 1) {
+        WidgetToParentMap map = widgetNewParentMap();
+        widgetNewParentMap().clear();
+        WidgetToParentMap::iterator end = map.end();
+        for (WidgetToParentMap::iterator it = map.begin(); it != end; ++it) {
+            Widget* child = it->first.get();
+            ScrollView* currentParent = child->parent();
+            FrameView* newParent = it->second;
+            if (newParent != currentParent) {
+                if (currentParent)
+                    currentParent->removeChild(child);
+                if (newParent)
+                    newParent->addChild(child);
+            }
+        }
+    }
+    widgetHierarchyUpdateSuspendCount--;
+}
+
+static void moveWidgetToParentSoon(Widget* child, FrameView* parent)
+{
+    if (!widgetHierarchyUpdateSuspendCount) {
+        if (parent)
+            parent->addChild(child);
+        else
+            child->removeFromParent();
+        return;
+    }
+    widgetNewParentMap().set(child, parent);
+}
+
 RenderWidget::RenderWidget(Node* node)
     : RenderReplaced(node)
     , m_widget(0)
     , m_frameView(node->document()->view())
-    , m_refCount(0)
-{
-    view()->addWidget(this);
-
     // Reference counting is used to prevent the widget from being
     // destroyed while inside the Widget code, which might not be
     // able to handle that.
-    ref();
+    , m_refCount(1)
+{
+    view()->addWidget(this);
 }
 
 void RenderWidget::destroy()
@@ -62,14 +109,6 @@ void RenderWidget::destroy()
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
 
-    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
-    // in the end of this function. One way this might happen is if this function was invoked twice
-    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
-    // in release builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -81,12 +120,8 @@ void RenderWidget::destroy()
     }
     remove();
 
-    if (m_widget) {
-        if (m_frameView)
-            m_frameView->removeChild(m_widget.get());
-        widgetRendererMap().remove(m_widget.get());
-    }
-    
+    setWidget(0);
+
     // removes from override size map
     if (hasOverrideSize())
         setOverrideSize(-1);
@@ -100,14 +135,6 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
-    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
-    // if this function was re-entered (and therefore the null check at the beginning did not fail),
-    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
-    // builds.
-    ASSERT(node());
-    if (!node())
-        return;
-
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -121,39 +148,43 @@ RenderWidget::~RenderWidget()
     clearWidget();
 }
 
-void RenderWidget::setWidgetGeometry(const IntRect& frame)
+bool RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
-    if (node() && m_widget->frameRect() != frame) {
-        RenderWidgetProtector protector(this);
-        RefPtr<Node> protectedNode(node());
-        m_widget->setFrameRect(frame);
-    }
+    ASSERT(!widgetHierarchyUpdateSuspendCount);
+    if (!node() || m_widget->frameRect() == frame)
+        return false;
+
+    RenderWidgetProtector protector(this);
+    RefPtr<Node> protectedNode(node());
+    m_widget->setFrameRect(frame);
+    return true;
 }
 
 void RenderWidget::setWidget(PassRefPtr<Widget> widget)
 {
-    if (widget != m_widget) {
-        if (m_widget) {
-            m_widget->removeFromParent();
-            widgetRendererMap().remove(m_widget.get());
-            clearWidget();
-        }
-        m_widget = widget;
-        if (m_widget) {
-            widgetRendererMap().add(m_widget.get(), this);
-            // if we've already received a layout, apply the calculated space to the
-            // widget immediately, but we have to have really been full constructed (with a non-null
-            // style pointer).
-            if (style()) {
-                if (!needsLayout())
-                    setWidgetGeometry(absoluteContentBox());
-                if (style()->visibility() != VISIBLE)
-                    m_widget->hide();
-                else
-                    m_widget->show();
-            }
-            m_frameView->addChild(m_widget.get());
+    if (widget == m_widget)
+        return;
+
+    if (m_widget) {
+        moveWidgetToParentSoon(m_widget.get(), 0);
+        widgetRendererMap().remove(m_widget.get());
+        clearWidget();
+    }
+    m_widget = widget;
+    if (m_widget) {
+        widgetRendererMap().add(m_widget.get(), this);
+        // If we've already received a layout, apply the calculated space to the
+        // widget immediately, but we have to have really been fully constructed (with a non-null
+        // style pointer).
+        if (style()) {
+            if (!needsLayout())
+                setWidgetGeometry(absoluteContentBox());
+            if (style()->visibility() != VISIBLE)
+                m_widget->hide();
+            else
+                m_widget->show();
         }
+        moveWidgetToParentSoon(m_widget.get(), m_frameView);
     }
 }
 
@@ -229,11 +260,11 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
         if (m_substituteImage)
-            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+            paintInfo.context->drawImage(m_substituteImage.get(), style()->colorSpace(), m_widget->frameRect());
         else
             m_widget->paint(paintInfo.context, paintInfo.rect);
 
-        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
+        if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaintsIfNotOverlapped()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
             paintInfo.overlapTestRequests->set(this, m_widget->frameRect());
         }
@@ -245,7 +276,7 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
     // Paint a partially transparent wash over selected widgets.
     if (isSelected() && !document()->printing()) {
         // FIXME: selectionRect() is in absolute, not painting coordinates.
-        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor());
+        paintInfo.context->fillRect(selectionRect(), selectionBackgroundColor(), style()->colorSpace());
     }
 }
 
@@ -274,6 +305,7 @@ void RenderWidget::updateWidgetPosition()
     int w = width() - borderLeft() - borderRight() - paddingLeft() - paddingRight();
     int h = height() - borderTop() - borderBottom() - paddingTop() - paddingBottom();
 
+<<<<<<< HEAD:WebCore/rendering/RenderWidget.cpp
     IntRect newBounds(absPos.x(), absPos.y(), w, h);
     IntRect oldBounds(m_widget->frameRect());
     bool boundsChanged = newBounds != oldBounds;
@@ -284,6 +316,10 @@ void RenderWidget::updateWidgetPosition()
     }
     
 #ifndef FLATTEN_IFRAME
+=======
+    bool boundsChanged = setWidgetGeometry(IntRect(absPos.x(), absPos.y(), w, h));
+
+>>>>>>> webkit.org at r51976:WebCore/rendering/RenderWidget.cpp
     // if the frame bounds got changed, or if view needs layout (possibly indicating
     // content size is wrong) we have to do a layout to set the right widget size
     if (m_widget->isFrameView()) {
diff --git a/WebCore/rendering/RenderWidget.h b/WebCore/rendering/RenderWidget.h
index 78537fd..6cad04a 100644
--- a/WebCore/rendering/RenderWidget.h
+++ b/WebCore/rendering/RenderWidget.h
@@ -42,6 +42,9 @@ public:
 
     void showSubstituteImage(PassRefPtr<Image>);
 
+    static void suspendWidgetHierarchyUpdates();
+    static void resumeWidgetHierarchyUpdates();
+
 protected:
     RenderWidget(Node*);
 
@@ -61,7 +64,7 @@ private:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual void setOverlapTestResult(bool);
 
-    void setWidgetGeometry(const IntRect&);
+    bool setWidgetGeometry(const IntRect&);
 
     friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index b0b0e15..7fce1d3 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the line box implementation for KDE.
- *
  * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/SVGInlineTextBox.cpp b/WebCore/rendering/SVGInlineTextBox.cpp
index d0fa9ae..cf8464e 100644
--- a/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/WebCore/rendering/SVGInlineTextBox.cpp
@@ -1,6 +1,4 @@
 /**
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
@@ -384,7 +382,8 @@ void SVGInlineTextBox::paintCharacters(RenderObject::PaintInfo& paintInfo, int t
     bool setShadow = false;
     if (styleToUse->textShadow()) {
         paintInfo.context->setShadow(IntSize(styleToUse->textShadow()->x, styleToUse->textShadow()->y),
-                                     styleToUse->textShadow()->blur, styleToUse->textShadow()->color);
+                                     styleToUse->textShadow()->blur, styleToUse->textShadow()->color,
+                                     styleToUse->colorSpace());
         setShadow = true;
     }
 
@@ -477,7 +476,7 @@ void SVGInlineTextBox::paintSelection(int boxStartOffset, const SVGChar& svgChar
     int adjust = startPos >= boxStartOffset ? boxStartOffset : 0;
     p->drawHighlightForText(font, svgTextRunForInlineTextBox(textRenderer()->text()->characters() + start() + boxStartOffset, length, style, this, svgChar.x),
                             IntPoint((int) svgChar.x, (int) svgChar.y - font.ascent()),
-                            font.ascent() + font.descent(), color, startPos - adjust, endPos - adjust);
+                            font.ascent() + font.descent(), color, style->colorSpace(), startPos - adjust, endPos - adjust);
 
     p->restore();
 }
diff --git a/WebCore/rendering/SVGInlineTextBox.h b/WebCore/rendering/SVGInlineTextBox.h
index 76837cc..ad39aab 100644
--- a/WebCore/rendering/SVGInlineTextBox.h
+++ b/WebCore/rendering/SVGInlineTextBox.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index ea087f9..a594410 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -94,8 +94,17 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
-    if (ShadowData* shadow = svgStyle->shadow())
-        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color); 
+    if (ShadowData* shadow = svgStyle->shadow()) {
+        int xShift = shadow->x < 0 ? shadow->x : 0;
+        int yShift = shadow->y < 0 ? shadow->y :0;
+        int widthShift = shadow->x < 0 ? 0 : shadow->x;
+        int heightShift = shadow->y < 0 ? 0 : shadow->y;
+        FloatRect shadowRect = FloatRect(boundingBox.x() + xShift, boundingBox.y() + yShift,
+            boundingBox.width() + widthShift, boundingBox.height() + heightShift);
+        paintInfo.context->clip(enclosingIntRect(shadowRect));
+        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color, style->colorSpace());
+        paintInfo.context->beginTransparencyLayer(1.0f);
+    }
 
 #if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
@@ -163,6 +172,11 @@ void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::P
     float opacity = style->opacity();    
     if (opacity < 1.0f)
         paintInfo.context->endTransparencyLayer();
+
+    // This needs to be done separately from opacity, because if both properties are set,
+    // then the transparency layers are nested. 
+    if (style->svgStyle()->shadow())
+        paintInfo.context->endTransparencyLayer();
 }
 
 void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
diff --git a/WebCore/rendering/TableLayout.h b/WebCore/rendering/TableLayout.h
index 8ae0ce7..10d6e26 100644
--- a/WebCore/rendering/TableLayout.h
+++ b/WebCore/rendering/TableLayout.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the HTML rendering engine for KDE.
- *
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  *
@@ -23,11 +21,13 @@
 #ifndef TableLayout_h
 #define TableLayout_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
 class RenderTable;
 
-class TableLayout {
+class TableLayout : public Noncopyable {
 public:
     TableLayout(RenderTable* table)
         : m_table(table)
diff --git a/WebCore/rendering/break_lines.h b/WebCore/rendering/break_lines.h
index 14f740f..4d6b8dc 100644
--- a/WebCore/rendering/break_lines.h
+++ b/WebCore/rendering/break_lines.h
@@ -1,6 +1,4 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2005 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/WebCore/rendering/style/ContentData.h b/WebCore/rendering/style/ContentData.h
index 24d5f86..2c261f8 100644
--- a/WebCore/rendering/style/ContentData.h
+++ b/WebCore/rendering/style/ContentData.h
@@ -25,15 +25,15 @@
 #ifndef ContentData_h
 #define ContentData_h
 
-#include "PlatformString.h"
 #include "RenderStyleConstants.h"
-#include "StringImpl.h"
-#include "StyleImage.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
 class CounterContent;
+class StringImpl;
+class StyleImage;
 
 struct ContentData : Noncopyable {
 public:
diff --git a/WebCore/rendering/style/CounterContent.h b/WebCore/rendering/style/CounterContent.h
index cf11813..702d9c2 100644
--- a/WebCore/rendering/style/CounterContent.h
+++ b/WebCore/rendering/style/CounterContent.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class CounterContent {
+class CounterContent : public FastAllocBase {
 public:
     CounterContent(const AtomicString& identifier, EListStyleType style, const AtomicString& separator)
         : m_identifier(identifier)
diff --git a/WebCore/rendering/style/FillLayer.h b/WebCore/rendering/style/FillLayer.h
index fb928b6..9c615b4 100644
--- a/WebCore/rendering/style/FillLayer.h
+++ b/WebCore/rendering/style/FillLayer.h
@@ -59,7 +59,7 @@ struct FillSize {
     LengthSize size;
 };
 
-struct FillLayer {
+struct FillLayer : FastAllocBase {
 public:
     FillLayer(EFillLayerType);
     ~FillLayer();
diff --git a/WebCore/rendering/style/LineClampValue.h b/WebCore/rendering/style/LineClampValue.h
new file mode 100644
index 0000000..2119ca2
--- /dev/null
+++ b/WebCore/rendering/style/LineClampValue.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LineClampValue_h
+#define LineClampValue_h
+
+#include "RenderStyleConstants.h"
+
+namespace WebCore {
+    
+class LineClampValue {
+public:
+    LineClampValue()
+        : m_type(LineClampLineCount)
+        , m_value(-1)
+    {
+    }
+    
+    LineClampValue(int value, ELineClampType type)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+    
+    int value() const { return m_value; }
+    
+    bool isPercentage() const { return m_type == LineClampPercentage; }
+
+    bool isNone() const { return m_value == -1; }
+
+    bool operator==(const LineClampValue& o) const
+    {
+        return value() == o.value() && isPercentage() == o.isPercentage();
+    }
+    
+    bool operator!=(const LineClampValue& o) const
+    {
+        return !(*this == o);
+    }
+    
+private:
+    ELineClampType m_type;
+    int m_value;
+};
+    
+} // namespace WebCore
+
+#endif // LineClampValue_h
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index a861fea..59d40b4 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -454,8 +454,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
-    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
-        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+    if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
+        (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
         // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         return StyleDifferenceLayout;
     }
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 674f062..a72b66d 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -37,6 +37,7 @@
 #include "CachedImage.h"
 #include "CollapsedBorderValue.h"
 #include "Color.h"
+#include "ColorSpace.h"
 #include "ContentData.h"
 #include "CounterDirectives.h"
 #include "CursorList.h"
@@ -49,6 +50,7 @@
 #include "Length.h"
 #include "LengthBox.h"
 #include "LengthSize.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "OutlineValue.h"
 #include "Pair.h"
@@ -599,6 +601,7 @@ public:
     const Color& textStrokeColor() const { return rareInheritedData->textStrokeColor; }
     float textStrokeWidth() const { return rareInheritedData->textStrokeWidth; }
     const Color& textFillColor() const { return rareInheritedData->textFillColor; }
+    ColorSpace colorSpace() const { return static_cast<ColorSpace>(rareInheritedData->colorSpace); }
     float opacity() const { return rareNonInheritedData->opacity; }
     ControlPart appearance() const { return static_cast<ControlPart>(rareNonInheritedData->m_appearance); }
     EBoxAlignment boxAlign() const { return static_cast<EBoxAlignment>(rareNonInheritedData->flexibleBox->align); }
@@ -693,7 +696,7 @@ public:
     bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
 #endif
 
-    int lineClamp() const { return rareNonInheritedData->lineClamp; }
+    const LineClampValue& lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
@@ -934,6 +937,7 @@ public:
     void setTextStrokeColor(const Color& c) { SET_VAR(rareInheritedData, textStrokeColor, c) }
     void setTextStrokeWidth(float w) { SET_VAR(rareInheritedData, textStrokeWidth, w) }
     void setTextFillColor(const Color& c) { SET_VAR(rareInheritedData, textFillColor, c) }
+    void setColorSpace(ColorSpace space) { SET_VAR(rareInheritedData, colorSpace, space) }
     void setOpacity(float f) { SET_VAR(rareNonInheritedData, opacity, f); }
     void setAppearance(ControlPart a) { SET_VAR(rareNonInheritedData, m_appearance, a); }
     void setBoxAlign(EBoxAlignment a) { SET_VAR(rareNonInheritedData.access()->flexibleBox, align, a); }
@@ -1013,7 +1017,7 @@ public:
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
 #endif
 
-    void setLineClamp(int c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
+    void setLineClamp(LineClampValue c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
 
@@ -1186,9 +1190,10 @@ public:
     static float initialPerspective() { return 0; }
     static Length initialPerspectiveOriginX() { return Length(50.0, Percent); }
     static Length initialPerspectiveOriginY() { return Length(50.0, Percent); }
+    static Color initialBackgroundColor() { return Color::transparent; }
 
     // Keep these at the end.
-    static int initialLineClamp() { return -1; }
+    static LineClampValue initialLineClamp() { return LineClampValue(); }
     static bool initialTextSizeAdjust() { return true; }
     static ETextSecurity initialTextSecurity() { return TSNONE; }
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index 3010947..92cd3d5 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ -69,8 +69,9 @@ enum PseudoId {
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, 
+    MEDIA_CONTROLS_SEEK_BACK_BUTTON, MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, 
+    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_TOGGLE_CLOSED_CAPTIONS_BUTTON,
     MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
     INPUT_LIST_BUTTON,
 
@@ -321,6 +322,8 @@ enum ETransformStyle3D {
 enum EBackfaceVisibility {
     BackfaceVisibilityVisible, BackfaceVisibilityHidden
 };
+    
+enum ELineClampType { LineClampLineCount, LineClampPercentage };
 
 } // namespace WebCore
 
diff --git a/WebCore/rendering/style/SVGRenderStyle.cpp b/WebCore/rendering/style/SVGRenderStyle.cpp
index e8827c4..728738b 100644
--- a/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index 12477d7..c65be97 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2005, 2006 Apple Computer, Inc.
 
-     This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
index 2ed1d8f..093f1f1 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.cpp
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
@@ -8,8 +8,6 @@
     Copyright (C) 2002-2003 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index f4cf932..8f01d9f 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -8,8 +8,6 @@
               (C) 2000-2003 Dirk Mueller (mueller@kde.org)
               (C) 2002-2003 Apple Computer, Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/rendering/style/ShadowData.h b/WebCore/rendering/style/ShadowData.h
index f4061f2..089cf77 100644
--- a/WebCore/rendering/style/ShadowData.h
+++ b/WebCore/rendering/style/ShadowData.h
@@ -26,6 +26,7 @@
 #define ShadowData_h
 
 #include "Color.h"
+#include <wtf/FastAllocBase.h>
 
 namespace WebCore {
 
@@ -33,7 +34,7 @@ enum ShadowStyle { Normal, Inset };
 
 // This struct holds information about shadows for the text-shadow and box-shadow properties.
 
-struct ShadowData {
+struct ShadowData : FastAllocBase {
     ShadowData()
         : x(0)
         , y(0)
diff --git a/WebCore/rendering/style/StyleBackgroundData.cpp b/WebCore/rendering/style/StyleBackgroundData.cpp
index 68a9ddd..08f5527 100644
--- a/WebCore/rendering/style/StyleBackgroundData.cpp
+++ b/WebCore/rendering/style/StyleBackgroundData.cpp
@@ -22,12 +22,14 @@
 #include "config.h"
 #include "StyleBackgroundData.h"
 
+#include "RenderStyle.h"
 #include "RenderStyleConstants.h"
 
 namespace WebCore {
 
 StyleBackgroundData::StyleBackgroundData()
     : m_background(BackgroundFillLayer)
+    , m_color(RenderStyle::initialBackgroundColor())
 {
 }
 
diff --git a/WebCore/rendering/style/StyleRareInheritedData.cpp b/WebCore/rendering/style/StyleRareInheritedData.cpp
index 0f3b7e7..ff626b7 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -42,6 +42,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textSizeAdjust(RenderStyle::initialTextSizeAdjust())
     , resize(RenderStyle::initialResize())
     , userSelect(RenderStyle::initialUserSelect())
+    , colorSpace(DeviceColorSpace)
 {
 }
 
@@ -64,6 +65,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textSizeAdjust(o.textSizeAdjust)
     , resize(o.resize)
     , userSelect(o.userSelect)
+    , colorSpace(o.colorSpace)
 {
 }
 
@@ -90,7 +92,8 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && tapHighlightColor == o.tapHighlightColor
 #endif
         && resize == o.resize
-        && userSelect == o.userSelect;
+        && userSelect == o.userSelect
+        && colorSpace == o.colorSpace;
 }
 
 bool StyleRareInheritedData::shadowDataEquivalent(const StyleRareInheritedData& o) const
diff --git a/WebCore/rendering/style/StyleRareInheritedData.h b/WebCore/rendering/style/StyleRareInheritedData.h
index 4abd3cf..1aa7b05 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/WebCore/rendering/style/StyleRareInheritedData.h
@@ -68,6 +68,7 @@ public:
     bool textSizeAdjust : 1; // An Apple extension.
     unsigned resize : 2; // EResize
     unsigned userSelect : 1;  // EUserSelect
+    unsigned colorSpace : 1; // ColorSpace
     
 private:
     StyleRareInheritedData();
diff --git a/WebCore/rendering/style/StyleRareNonInheritedData.h b/WebCore/rendering/style/StyleRareNonInheritedData.h
index 8dd22b3..452b273 100644
--- a/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -29,6 +29,7 @@
 #include "CursorData.h"
 #include "DataRef.h"
 #include "FillLayer.h"
+#include "LineClampValue.h"
 #include "NinePieceImage.h"
 #include "StyleTransformData.h"
 #include <wtf/OwnPtr.h>
@@ -77,7 +78,7 @@ public:
     bool animationDataEquivalent(const StyleRareNonInheritedData&) const;
     bool transitionDataEquivalent(const StyleRareNonInheritedData&) const;
 
-    int lineClamp; // An Apple extension.
+    LineClampValue lineClamp; // An Apple extension.
 #if ENABLE(DASHBOARD_SUPPORT)
     Vector<StyleDashboardRegion> m_dashboardRegions;
 #endif
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index 5aaa26f..29dec26 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -149,11 +149,12 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 
 Database::Database(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
     : m_transactionInProgress(false)
+    , m_isTransactionQueueEnabled(true)
     , m_document(document)
     , m_name(name.crossThreadString())
     , m_guid(0)
-    , m_expectedVersion(expectedVersion)
-    , m_displayName(displayName)
+    , m_expectedVersion(expectedVersion.crossThreadString())
+    , m_displayName(displayName.crossThreadString())
     , m_estimatedSize(estimatedSize)
     , m_deleted(false)
     , m_stopped(false)
@@ -190,6 +191,11 @@ Database::Database(Document* document, const String& name, const String& expecte
     m_document->addOpenDatabase(this);
 }
 
+static void derefDocument(void* document)
+{
+    static_cast<Document*>(document)->deref();
+}
+
 Database::~Database()
 {
     if (m_document->databaseThread())
@@ -197,6 +203,9 @@ Database::~Database()
 
     DatabaseTracker::tracker().removeOpenDatabase(this);
     m_document->removeOpenDatabase(this);
+
+    // Deref m_document on the main thread.
+    callOnMainThread(derefDocument, m_document.release().releaseRef());
 }
 
 bool Database::openAndVerifyVersion(ExceptionCode& e)
@@ -205,15 +214,14 @@ bool Database::openAndVerifyVersion(ExceptionCode& e)
         return false;
     m_databaseAuthorizer = DatabaseAuthorizer::create();
 
-    RefPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this);
+    bool success = false;
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, &synchronizer, e, success);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    ASSERT(task->isComplete());
-    e = task->exceptionCode();
-    return task->openSuccessful();
+    return success;
 }
 
 
@@ -318,11 +326,11 @@ void Database::markAsDeletedAndClose()
 
     m_document->databaseThread()->unscheduleDatabaseTasks(this);
 
-    RefPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this);
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 }
 
 void Database::close()
@@ -362,7 +370,7 @@ void Database::stop()
 
     {
         MutexLocker locker(m_transactionInProgressMutex);
-        m_transactionQueue.kill();
+        m_isTransactionQueueEnabled = false;
         m_transactionInProgress = false;
     }
 }
@@ -497,15 +505,13 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         currentVersion = "";
     }
 
-    // FIXME: For now, the spec says that if the database has no version, it is valid for any "Expected version" string.  That seems silly and I think it should be
-    // changed, and here's where we would change it
-    if (m_expectedVersion.length()) {
-        if (currentVersion.length() && m_expectedVersion != currentVersion) {
-            LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
-                databaseDebugName().ascii().data(), currentVersion.ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
+    // If the expected version isn't the empty string, ensure that the current database version we have matches that version. Otherwise, set an exception.
+    // If the expected version is the empty string, then we always return with whatever version of the database we have.
+    if (m_expectedVersion.length() && m_expectedVersion != currentVersion) {
+        LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
+            databaseDebugName().ascii().data(), currentVersion.ascii().data());
+        e = INVALID_STATE_ERR;
+        return false;
     }
 
     return true;
@@ -534,8 +540,14 @@ void Database::scheduleTransaction()
 {
     ASSERT(!m_transactionInProgressMutex.tryLock()); // Locked by caller.
     RefPtr<SQLTransaction> transaction;
-    if (m_transactionQueue.tryGetMessage(transaction) && m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+
+    if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty()) {
+        transaction = m_transactionQueue.first();
+        m_transactionQueue.removeFirst();
+    }
+
+    if (transaction && m_document->databaseThread()) {
+        OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
         LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for transaction %p\n", task.get(), task->transaction());
         m_transactionInProgress = true;
         m_document->databaseThread()->scheduleTask(task.release());
@@ -548,7 +560,7 @@ void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immedia
     if (!m_document->databaseThread())
         return;
 
-    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
     LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
     if (immediately)
         m_document->databaseThread()->scheduleImmediateTask(task.release());
@@ -618,15 +630,19 @@ void Database::deliverPendingCallback(void* context)
 
 Vector<String> Database::tableNames()
 {
+    // FIXME: Not using threadsafeCopy on these strings looks ok since threads take strict turns
+    // in dealing with them. However, if the code changes, this may not be true anymore.
+    Vector<String> result;
     if (!m_document->databaseThread())
-        return Vector<String>();
-    RefPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this);
+        return result;
+
+    DatabaseTaskSynchronizer synchronizer;
+    OwnPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this, &synchronizer, result);
 
-    task->lockForSynchronousScheduling();
-    m_document->databaseThread()->scheduleImmediateTask(task);
-    task->waitForSynchronousCompletion();
+    m_document->databaseThread()->scheduleImmediateTask(task.release());
+    synchronizer.waitForTaskCompletion();
 
-    return task->tableNames();
+    return result;
 }
 
 void Database::setExpectedVersion(const String& version)
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index f275027..61c9b66 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -30,7 +30,6 @@
 #define Database_h
 
 #if ENABLE(DATABASE)
-#include <wtf/MessageQueue.h>
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
 #include "SQLiteDatabase.h"
@@ -133,9 +132,10 @@ private:
     void scheduleTransactionCallback(SQLTransaction*);
     void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
 
-    MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
+    Deque<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
+    bool m_isTransactionQueueEnabled;
 
     static void deliverPendingCallback(void*);
 
diff --git a/WebCore/storage/DatabaseTask.cpp b/WebCore/storage/DatabaseTask.cpp
index 755da7c..702c96b 100644
--- a/WebCore/storage/DatabaseTask.cpp
+++ b/WebCore/storage/DatabaseTask.cpp
@@ -35,9 +35,33 @@
 
 namespace WebCore {
 
-DatabaseTask::DatabaseTask(Database* database)
+DatabaseTaskSynchronizer::DatabaseTaskSynchronizer()
+    : m_taskCompleted(false)
+{
+}
+
+void DatabaseTaskSynchronizer::waitForTaskCompletion()
+{
+    m_synchronousMutex.lock();
+    if (!m_taskCompleted)
+        m_synchronousCondition.wait(m_synchronousMutex);
+    m_synchronousMutex.unlock();
+}
+
+void DatabaseTaskSynchronizer::taskCompleted()
+{
+    m_synchronousMutex.lock();
+    m_taskCompleted = true;
+    m_synchronousCondition.signal();
+    m_synchronousMutex.unlock();
+}
+
+DatabaseTask::DatabaseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
     : m_database(database)
+    , m_synchronizer(synchronizer)
+#ifndef NDEBUG
     , m_complete(false)
+#endif
 {
 }
 
@@ -56,43 +80,19 @@ void DatabaseTask::performTask()
     doPerformTask();
     m_database->performPolicyChecks();
 
-    if (m_synchronousMutex)
-        m_synchronousMutex->lock();
-
-    m_complete = true;
-
-    if (m_synchronousMutex) {
-        m_synchronousCondition->signal();
-        m_synchronousMutex->unlock();
-    }
-}
-
-void DatabaseTask::lockForSynchronousScheduling()
-{
-    // Called from main thread.
-    ASSERT(!m_synchronousMutex);
-    ASSERT(!m_synchronousCondition);
-    m_synchronousMutex.set(new Mutex);
-    m_synchronousCondition.set(new ThreadCondition);
-}
-
-void DatabaseTask::waitForSynchronousCompletion()
-{
-    // Called from main thread.
-    m_synchronousMutex->lock();
-    if (!m_complete)
-        m_synchronousCondition->wait(*m_synchronousMutex);
-    m_synchronousMutex->unlock();
+    if (m_synchronizer)
+        m_synchronizer->taskCompleted();
 }
 
 // *** DatabaseOpenTask ***
 // Opens the database file and verifies the version matches the expected version.
 
-DatabaseOpenTask::DatabaseOpenTask(Database* database)
-    : DatabaseTask(database)
-    , m_code(0)
-    , m_success(false)
+DatabaseOpenTask::DatabaseOpenTask(Database* database, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    : DatabaseTask(database, synchronizer)
+    , m_code(code)
+    , m_success(success)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseOpenTask::doPerformTask()
@@ -110,8 +110,8 @@ const char* DatabaseOpenTask::debugTaskName() const
 // *** DatabaseCloseTask ***
 // Closes the database.
 
-DatabaseCloseTask::DatabaseCloseTask(Database* database)
-    : DatabaseTask(database)
+DatabaseCloseTask::DatabaseCloseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
+    : DatabaseTask(database, synchronizer)
 {
 }
 
@@ -131,7 +131,7 @@ const char* DatabaseCloseTask::debugTaskName() const
 // Starts a transaction that will report its results via a callback.
 
 DatabaseTransactionTask::DatabaseTransactionTask(PassRefPtr<SQLTransaction> transaction)
-    : DatabaseTask(transaction->database())
+    : DatabaseTask(transaction->database(), 0)
     , m_transaction(transaction)
 {
 }
@@ -159,9 +159,11 @@ const char* DatabaseTransactionTask::debugTaskName() const
 // *** DatabaseTableNamesTask ***
 // Retrieves a list of all tables in the database - for WebInspector support.
 
-DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database)
-    : DatabaseTask(database)
+DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    : DatabaseTask(database, synchronizer)
+    , m_tableNames(names)
 {
+    ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
 void DatabaseTableNamesTask::doPerformTask()
diff --git a/WebCore/storage/DatabaseTask.h b/WebCore/storage/DatabaseTask.h
index 4aef892..97a23c7 100644
--- a/WebCore/storage/DatabaseTask.h
+++ b/WebCore/storage/DatabaseTask.h
@@ -32,6 +32,7 @@
 #include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -39,13 +40,33 @@
 namespace WebCore {
 
 class Database;
+class DatabaseTask;
 class DatabaseThread;
 class SQLValue;
 class SQLCallback;
 class SQLTransaction;
 class VersionChangeCallback;
 
-class DatabaseTask : public ThreadSafeShared<DatabaseTask> {
+// Can be used to wait until DatabaseTask is completed.
+// Has to be passed into DatabaseTask::create to be associated with the task.
+class DatabaseTaskSynchronizer : public Noncopyable {
+    friend class DatabaseTask;
+public:
+    DatabaseTaskSynchronizer();
+
+    // Called from main thread to wait until task is completed.
+    void waitForTaskCompletion();
+
+private:
+    // Called by the task.
+    void taskCompleted();
+
+    bool m_taskCompleted;
+    Mutex m_synchronousMutex;
+    ThreadCondition m_synchronousCondition;
+};
+
+class DatabaseTask : public Noncopyable {
     friend class Database;
 public:
     virtual ~DatabaseTask();
@@ -53,53 +74,50 @@ public:
     void performTask();
 
     Database* database() const { return m_database; }
-    bool isComplete() const { return m_complete; }
 
 protected:
-    DatabaseTask(Database*);
+    DatabaseTask(Database*, DatabaseTaskSynchronizer*);
 
 private:
     virtual void doPerformTask() = 0;
-#ifndef NDEBUG
-    virtual const char* debugTaskName() const = 0;
-#endif
-
-    void lockForSynchronousScheduling();
-    void waitForSynchronousCompletion();
 
     Database* m_database;
+    DatabaseTaskSynchronizer* m_synchronizer;
 
-    bool m_complete;
-
-    OwnPtr<Mutex> m_synchronousMutex;
-    OwnPtr<ThreadCondition> m_synchronousCondition;
+#ifndef NDEBUG
+     virtual const char* debugTaskName() const = 0;
+     bool m_complete;
+#endif
 };
 
 class DatabaseOpenTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseOpenTask> create(Database* db) { return adoptRef(new DatabaseOpenTask(db)); }
-
-    ExceptionCode exceptionCode() const { return m_code; }
-    bool openSuccessful() const { return m_success; }
+    static PassOwnPtr<DatabaseOpenTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    {
+        return new DatabaseOpenTask(db, synchronizer, code, success);
+    }
 
 private:
-    DatabaseOpenTask(Database*);
+    DatabaseOpenTask(Database*, DatabaseTaskSynchronizer*, ExceptionCode&, bool& success);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    ExceptionCode m_code;
-    bool m_success;
+    ExceptionCode& m_code;
+    bool& m_success;
 };
 
 class DatabaseCloseTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseCloseTask> create(Database* db) { return adoptRef(new DatabaseCloseTask(db)); }
+    static PassOwnPtr<DatabaseCloseTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer)
+    { 
+        return new DatabaseCloseTask(db, synchronizer);
+    }
 
 private:
-    DatabaseCloseTask(Database*);
+    DatabaseCloseTask(Database*, DatabaseTaskSynchronizer*);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
@@ -109,7 +127,11 @@ private:
 
 class DatabaseTransactionTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction) { return adoptRef(new DatabaseTransactionTask(transaction)); }
+    // Transaction task is never synchronous, so no 'synchronizer' parameter.
+    static PassOwnPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction)
+    {
+        return new DatabaseTransactionTask(transaction);
+    }
 
     SQLTransaction* transaction() const { return m_transaction.get(); }
 
@@ -127,19 +149,20 @@ private:
 
 class DatabaseTableNamesTask : public DatabaseTask {
 public:
-    static PassRefPtr<DatabaseTableNamesTask> create(Database* db) { return adoptRef(new DatabaseTableNamesTask(db)); }
-
-    Vector<String>& tableNames() { return m_tableNames; }
+    static PassOwnPtr<DatabaseTableNamesTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+    {
+        return new DatabaseTableNamesTask(db, synchronizer, names);
+    }
 
 private:
-    DatabaseTableNamesTask(Database*);
+    DatabaseTableNamesTask(Database*, DatabaseTaskSynchronizer*, Vector<String>& names);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
-    Vector<String> m_tableNames;
+    Vector<String>& m_tableNames;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index 40c83ee..12e9251 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -91,13 +91,8 @@ void* DatabaseThread::databaseThread()
     }
 
     AutodrainedPool pool;
-    while (true) {
-        RefPtr<DatabaseTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    while (OwnPtr<DatabaseTask> task = m_queue.waitForMessage()) {
         task->performTask();
-
         pool.cycle();
     }
 
@@ -142,12 +137,12 @@ void DatabaseThread::recordDatabaseClosed(Database* database)
     m_openDatabaseSet.remove(database);
 }
 
-void DatabaseThread::scheduleTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.append(task);
 }
 
-void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
+void DatabaseThread::scheduleImmediateTask(PassOwnPtr<DatabaseTask> task)
 {
     m_queue.prepend(task);
 }
@@ -155,7 +150,7 @@ void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
 class SameDatabasePredicate {
 public:
     SameDatabasePredicate(const Database* database) : m_database(database) { }
-    bool operator()(RefPtr<DatabaseTask>& task) const { return task->database() == m_database; }
+    bool operator()(DatabaseTask* task) const { return task->database() == m_database; }
 private:
     const Database* m_database;
 };
diff --git a/WebCore/storage/DatabaseThread.h b/WebCore/storage/DatabaseThread.h
index 83b1baf..269a633 100644
--- a/WebCore/storage/DatabaseThread.h
+++ b/WebCore/storage/DatabaseThread.h
@@ -34,6 +34,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -55,8 +56,8 @@ public:
     void requestTermination();
     bool terminationRequested() const;
 
-    void scheduleTask(PassRefPtr<DatabaseTask>);
-    void scheduleImmediateTask(PassRefPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
+    void scheduleTask(PassOwnPtr<DatabaseTask>);
+    void scheduleImmediateTask(PassOwnPtr<DatabaseTask>); // This just adds the task to the front of the queue - the caller needs to be extremely careful not to create deadlocks when waiting for completion.
     void unscheduleDatabaseTasks(Database*);
 
     void recordDatabaseOpen(Database*);
@@ -76,7 +77,7 @@ private:
     ThreadIdentifier m_threadID;
     RefPtr<DatabaseThread> m_selfRef;
 
-    MessageQueue<RefPtr<DatabaseTask> > m_queue;
+    MessageQueue<DatabaseTask> m_queue;
 
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index 85e4858..c87b26a 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -31,41 +31,56 @@
 
 #if ENABLE(DATABASE)
 
-#include "DatabaseDetails.h"
 #include "PlatformString.h"
+
+#if !PLATFORM(CHROMIUM)
+#include "DatabaseDetails.h"
 #include "SQLiteDatabase.h"
 #include "StringHash.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
+#endif // !PLATFORM(CHROMIUM)
 
 namespace WebCore {
 
 class Database;
-class DatabaseTrackerClient;
 class Document;
-class OriginQuotaManager;
 class SecurityOrigin;
 
+#if !PLATFORM(CHROMIUM)
+class DatabaseTrackerClient;
+class OriginQuotaManager;
+
 struct SecurityOriginHash;
 struct SecurityOriginTraits;
+#endif // !PLATFORM(CHROMIUM)
 
-class DatabaseTracker {
+class DatabaseTracker : public Noncopyable {
 public:
-    void setDatabaseDirectoryPath(const String&);
-    const String& databaseDirectoryPath() const;
+    static DatabaseTracker& tracker();
 
     bool canEstablishDatabase(Document*, const String& name, const String& displayName, unsigned long estimatedSize);
     void setDatabaseDetails(SecurityOrigin*, const String& name, const String& displayName, unsigned long estimatedSize);
     String fullPathForDatabase(SecurityOrigin*, const String& name, bool createIfDoesNotExist = true);
 
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+
+    unsigned long long getMaxSizeForDatabase(const Database*);
+
+private:
+    DatabaseTracker();
+
+#if !PLATFORM(CHROMIUM)
+public:
+    void setDatabaseDirectoryPath(const String&);
+    const String& databaseDirectoryPath() const;
+
     void origins(Vector<RefPtr<SecurityOrigin> >& result);
     bool databaseNamesForOrigin(SecurityOrigin*, Vector<String>& result);
 
     DatabaseDetails detailsForNameAndOrigin(const String&, SecurityOrigin*);
 
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-
     unsigned long long usageForDatabase(const String&, SecurityOrigin*);
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
@@ -82,15 +97,10 @@ public:
 
     OriginQuotaManager& originQuotaManager();
 
-    static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
 
-    unsigned long long getMaxSizeForDatabase(const Database*);
-
 private:
-    DatabaseTracker();
-
     String trackerDatabasePath() const;
     void openTrackerDatabase(bool createIfDoesNotExist);
 
@@ -130,6 +140,7 @@ private:
 
     static void scheduleForNotification();
     static void notifyDatabasesChanged(void*);
+#endif // !PLATFORM(CHROMIUM)
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageTask.h b/WebCore/storage/LocalStorageTask.h
index f03d851..dc3e7e2 100644
--- a/WebCore/storage/LocalStorageTask.h
+++ b/WebCore/storage/LocalStorageTask.h
@@ -28,8 +28,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
@@ -38,15 +37,15 @@ namespace WebCore {
     class LocalStorageThread;
 
     // FIXME: Rename this class to StorageTask
-    class LocalStorageTask : public ThreadSafeShared<LocalStorageTask> {
+    class LocalStorageTask : public Noncopyable {
     public:
         enum Type { AreaImport, AreaSync, TerminateThread };
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return new LocalStorageTask(AreaImport, area); }
+        static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return new LocalStorageTask(AreaSync, area); }
+        static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return new LocalStorageTask(TerminateThread, thread); }
 
         void performTask();
 
diff --git a/WebCore/storage/LocalStorageThread.cpp b/WebCore/storage/LocalStorageThread.cpp
index 78640a9..d4a7b4c 100644
--- a/WebCore/storage/LocalStorageThread.cpp
+++ b/WebCore/storage/LocalStorageThread.cpp
@@ -33,96 +33,70 @@
 
 namespace WebCore {
 
-PassRefPtr<LocalStorageThread> LocalStorageThread::create()
+PassOwnPtr<LocalStorageThread> LocalStorageThread::create()
 {
-    return adoptRef(new LocalStorageThread);
+    return new LocalStorageThread;
 }
 
 LocalStorageThread::LocalStorageThread()
     : m_threadID(0)
 {
-    m_selfRef = this;
 }
 
-bool LocalStorageThread::start()
+LocalStorageThread::~LocalStorageThread()
 {
-    MutexLocker lock(m_threadCreationMutex);
-
-    if (m_threadID)
-        return true;
-
-    m_threadID = createThread(LocalStorageThread::localStorageThreadStart, this, "WebCore: LocalStorage");
+    ASSERT(isMainThread());
+    ASSERT(!m_threadID);
+}
 
+bool LocalStorageThread::start()
+{
+    ASSERT(isMainThread());
+    if (!m_threadID)
+        m_threadID = createThread(LocalStorageThread::threadEntryPointCallback, this, "WebCore: LocalStorage");
     return m_threadID;
 }
 
-void* LocalStorageThread::localStorageThreadStart(void* thread)
+void* LocalStorageThread::threadEntryPointCallback(void* thread)
 {
-    return static_cast<LocalStorageThread*>(thread)->localStorageThread();
+    return static_cast<LocalStorageThread*>(thread)->threadEntryPoint();
 }
 
-void* LocalStorageThread::localStorageThread()
+void* LocalStorageThread::threadEntryPoint()
 {
-    {
-        // Wait for LocalStorageThread::start() to complete.
-        MutexLocker lock(m_threadCreationMutex);
-    }
-
-    while (true) {
-        RefPtr<LocalStorageTask> task;
-        if (!m_queue.waitForMessage(task))
-            break;
-
+    ASSERT(!isMainThread());
+    while (OwnPtr<LocalStorageTask> task = m_queue.waitForMessage())
         task->performTask();
-    }
-
-    // Detach the thread so its resources are no longer of any concern to anyone else
-    detachThread(m_threadID);
-    m_threadID = 0;
-
-    // Clear the self refptr, possibly resulting in deletion
-    m_selfRef = 0;
 
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(StorageAreaSync* area)
-{
-    ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createImport(area));
-}
-
-void LocalStorageThread::scheduleSync(StorageAreaSync* area)
+void LocalStorageThread::scheduleTask(PassOwnPtr<LocalStorageTask> task)
 {
+    ASSERT(isMainThread());
     ASSERT(!m_queue.killed() && m_threadID);
-    m_queue.append(LocalStorageTask::createSync(area));
+    m_queue.append(task);
 }
 
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-
-    // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
-    // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
+    // Even in weird, exceptional cases, don't wait on a nonexistent thread to terminate.
     if (!m_threadID)
         return;
 
-    MutexLocker locker(m_terminateLock);
-
+    void* returnValue;
     m_queue.append(LocalStorageTask::createTerminate(this));
-
-    m_terminateCondition.wait(m_terminateLock);
+    waitForThreadCompletion(m_threadID, &returnValue);
+    ASSERT(m_queue.killed());
+    m_threadID = 0;
 }
 
 void LocalStorageThread::performTerminate()
 {
     ASSERT(!isMainThread());
-
     m_queue.kill();
-
-    MutexLocker locker(m_terminateLock);
-    m_terminateCondition.signal();
 }
 
 }
diff --git a/WebCore/storage/LocalStorageThread.h b/WebCore/storage/LocalStorageThread.h
index e9e2b58..6f05911 100644
--- a/WebCore/storage/LocalStorageThread.h
+++ b/WebCore/storage/LocalStorageThread.h
@@ -30,6 +30,7 @@
 
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
@@ -39,34 +40,27 @@ namespace WebCore {
     class LocalStorageTask;
 
     // FIXME: Rename this class to StorageThread
-    class LocalStorageThread : public ThreadSafeShared<LocalStorageThread> {
+    class LocalStorageThread : public Noncopyable {
     public:
-        static PassRefPtr<LocalStorageThread> create();
+        static PassOwnPtr<LocalStorageThread> create();
+        ~LocalStorageThread();
 
         bool start();
-
-        void scheduleImport(StorageAreaSync*);
-        void scheduleSync(StorageAreaSync*);
-
-        // Called from the main thread to synchronously shut down this thread
         void terminate();
-        // Background thread part of the terminate procedure
+        void scheduleTask(PassOwnPtr<LocalStorageTask>);
+
+        // Background thread part of the terminate procedure.
         void performTerminate();
 
     private:
         LocalStorageThread();
 
-        static void* localStorageThreadStart(void*);
-        void* localStorageThread();
+        // Called on background thread.
+        static void* threadEntryPointCallback(void*);
+        void* threadEntryPoint();
 
-        Mutex m_threadCreationMutex;
         ThreadIdentifier m_threadID;
-        RefPtr<LocalStorageThread> m_selfRef;
-
-        MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-
-        Mutex m_terminateLock;
-        ThreadCondition m_terminateCondition;
+        MessageQueue<LocalStorageTask> m_queue;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/OriginUsageRecord.h b/WebCore/storage/OriginUsageRecord.h
index 609a793..25bddf2 100644
--- a/WebCore/storage/OriginUsageRecord.h
+++ b/WebCore/storage/OriginUsageRecord.h
@@ -40,7 +40,7 @@ namespace WebCore {
 
 // Objects of this class can be used from multiple threads with external synchronization.
 // String arguments are also supposed to be deeply copied by the caller when necessary.
-class OriginUsageRecord {
+class OriginUsageRecord : public Noncopyable {
 public:
     OriginUsageRecord();
 
diff --git a/WebCore/storage/SQLTransactionClient.h b/WebCore/storage/SQLTransactionClient.h
index 941c163..e822594 100644
--- a/WebCore/storage/SQLTransactionClient.h
+++ b/WebCore/storage/SQLTransactionClient.h
@@ -31,13 +31,15 @@
 #ifndef SQLTransactionClient_h
 #define SQLTransactionClient_h
 
+#include <wtf/Noncopyable.h>
+
 namespace WebCore {
 
     class SQLTransaction;
 
     // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
     // parties that certain things have happened in a transaction.
-    class SQLTransactionClient {
+    class SQLTransactionClient : public Noncopyable {
     public:
         void didCommitTransaction(SQLTransaction*);
         void didExecuteStatement(SQLTransaction*);
diff --git a/WebCore/storage/SQLTransactionCoordinator.h b/WebCore/storage/SQLTransactionCoordinator.h
index 20cc863..ae5674b 100644
--- a/WebCore/storage/SQLTransactionCoordinator.h
+++ b/WebCore/storage/SQLTransactionCoordinator.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
     class SQLTransaction;
 
-    class SQLTransactionCoordinator {
+    class SQLTransactionCoordinator : public Noncopyable {
     public:
         void acquireLock(SQLTransaction*);
         void releaseLock(SQLTransaction*);
diff --git a/WebCore/storage/StorageAreaImpl.cpp b/WebCore/storage/StorageAreaImpl.cpp
index 612cb5f..8c2a29c 100644
--- a/WebCore/storage/StorageAreaImpl.cpp
+++ b/WebCore/storage/StorageAreaImpl.cpp
@@ -30,6 +30,7 @@
 
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "Page.h"
 #include "Settings.h"
 #include "StorageAreaSync.h"
 #include "StorageEventDispatcher.h"
@@ -64,7 +65,7 @@ StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOri
     // FIXME: If there's no backing storage for LocalStorage, the default WebKit behavior should be that of private browsing,
     // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
     if (m_storageSyncManager) {
-        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this);
+        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this, m_securityOrigin->databaseIdentifier());
         ASSERT(m_storageAreaSync);
     }
 }
@@ -106,6 +107,8 @@ static bool privateBrowsingEnabled(Frame* frame)
 unsigned StorageAreaImpl::length() const
 {
     ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+
     return m_storageMap->length();
 }
 
@@ -113,6 +116,7 @@ String StorageAreaImpl::key(unsigned index) const
 {
     ASSERT(!m_isShutdown);
     blockUntilImportComplete();
+
     return m_storageMap->key(index);
 }
 
@@ -138,21 +142,20 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     String oldValue;
     bool quotaException;
     RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+    if (newMap)
+        m_storageMap = newMap.release();
 
     if (quotaException) {
         ec = QUOTA_EXCEEDED_ERR;
         return;
     }
 
-    if (newMap)
-        m_storageMap = newMap.release();
+    if (oldValue == value)
+        return;
 
-    // Only notify the client if an item was actually changed
-    if (oldValue != value) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, value);
-        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, value);
+    StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
 }
 
 void StorageAreaImpl::removeItem(const String& key, Frame* frame)
@@ -168,12 +171,12 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (newMap)
         m_storageMap = newMap.release();
 
-    // Only notify the client if an item was actually removed
-    if (!oldValue.isNull()) {
-        if (m_storageAreaSync)
-            m_storageAreaSync->scheduleItemForSync(key, String());
-        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
-    }
+    if (oldValue.isNull())
+        return;
+
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleItemForSync(key, String());
+    StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 void StorageAreaImpl::clear(Frame* frame)
@@ -184,6 +187,9 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
+    if (!m_storageMap->length())
+        return;
+
     unsigned quota = m_storageMap->quota();
     m_storageMap = StorageMap::create(quota);
 
@@ -206,11 +212,6 @@ void StorageAreaImpl::importItem(const String& key, const String& value)
     m_storageMap->importItem(key, value);
 }
 
-SecurityOrigin* StorageAreaImpl::securityOrigin()
-{
-    return m_securityOrigin.get();
-}
-
 void StorageAreaImpl::close()
 {
     if (m_storageAreaSync)
diff --git a/WebCore/storage/StorageAreaImpl.h b/WebCore/storage/StorageAreaImpl.h
index fe21a45..0b2d34d 100644
--- a/WebCore/storage/StorageAreaImpl.h
+++ b/WebCore/storage/StorageAreaImpl.h
@@ -56,9 +56,8 @@ namespace WebCore {
         PassRefPtr<StorageAreaImpl> copy();
         void close();
 
-        // Could be called from a background thread.
+        // Only called from a background thread.
         void importItem(const String& key, const String& value);
-        SecurityOrigin* securityOrigin();
 
     private:
         StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
diff --git a/WebCore/storage/StorageAreaSync.cpp b/WebCore/storage/StorageAreaSync.cpp
index ad41e28..d4eba76 100644
--- a/WebCore/storage/StorageAreaSync.cpp
+++ b/WebCore/storage/StorageAreaSync.cpp
@@ -31,6 +31,7 @@
 #include "CString.h"
 #include "EventNames.h"
 #include "HTMLElement.h"
+#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
 #include "StorageAreaImpl.h"
 #include "StorageSyncManager.h"
@@ -42,17 +43,18 @@ namespace WebCore {
 // Instead, queue up a batch of items to sync and actually do the sync at the following interval.
 static const double StorageSyncInterval = 1.0;
 
-PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
 {
-    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea));
+    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea, databaseIdentifier));
 }
 
-StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea)
+StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier)
     : m_syncTimer(this, &StorageAreaSync::syncTimerFired)
     , m_itemsCleared(false)
     , m_finalSyncScheduled(false)
     , m_storageArea(storageArea)
     , m_syncManager(storageSyncManager)
+    , m_databaseIdentifier(databaseIdentifier.crossThreadString())
     , m_clearItemsWhileSyncing(false)
     , m_syncScheduled(false)
     , m_importComplete(false)
@@ -71,6 +73,7 @@ StorageAreaSync::~StorageAreaSync()
 {
     ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
+    ASSERT(m_finalSyncScheduled);
 }
 
 void StorageAreaSync::scheduleFinalSync()
@@ -78,6 +81,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
+    m_storageArea = 0;  // This is done in blockUntilImportComplete() but this is here as a form of documentation that we must be absolutely sure the ref count cycle is broken.
 
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
@@ -165,7 +169,7 @@ void StorageAreaSync::performImport()
     ASSERT(!isMainThread());
     ASSERT(!m_database.isOpen());
 
-    String databaseFilename = m_syncManager->fullDatabaseFilename(m_storageArea->securityOrigin());
+    String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
 
     if (databaseFilename.isEmpty()) {
         LOG_ERROR("Filename for local storage database is empty - cannot open for persistent storage");
@@ -206,27 +210,18 @@ void StorageAreaSync::performImport()
         return;
     }
 
-    MutexLocker locker(m_importLock);
-
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
 
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
 
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
-    m_importComplete = true;
-    m_importCondition.signal();
+    markImported();
 }
 
 void StorageAreaSync::markImported()
 {
-    ASSERT(!isMainThread());
-
     MutexLocker locker(m_importLock);
-    // Break the (ref count) cycle.
-    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
@@ -238,19 +233,18 @@ void StorageAreaSync::markImported()
 // item currently in the map. Get/remove can work whether or not it's in the map, but we'll need a list
 // of items the import should not overwrite. Clear can also work, but it'll need to kill the import
 // job first.
-void StorageAreaSync::blockUntilImportComplete() const
+void StorageAreaSync::blockUntilImportComplete()
 {
     ASSERT(isMainThread());
 
-    // Fast path to avoid locking.
-    if (m_importComplete)
+    // Fast path.  We set m_storageArea to 0 only after m_importComplete being true.
+    if (!m_storageArea)
         return;
 
     MutexLocker locker(m_importLock);
     while (!m_importComplete)
         m_importCondition.wait(m_importLock);
-    ASSERT(m_importComplete);
-    ASSERT(!m_storageArea);
+    m_storageArea = 0;
 }
 
 void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items)
diff --git a/WebCore/storage/StorageAreaSync.h b/WebCore/storage/StorageAreaSync.h
index 9d6436f..9afdfde 100644
--- a/WebCore/storage/StorageAreaSync.h
+++ b/WebCore/storage/StorageAreaSync.h
@@ -42,17 +42,17 @@ namespace WebCore {
 
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
-        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
         ~StorageAreaSync();
 
         void scheduleFinalSync();
-        void blockUntilImportComplete() const;
+        void blockUntilImportComplete();
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
 
     private:
-        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
+        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea, String databaseIdentifier);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
@@ -78,6 +78,8 @@ namespace WebCore {
         void syncTimerFired(Timer<StorageAreaSync>*);
         void sync(bool clearItems, const HashMap<String, String>& items);
 
+        const String m_databaseIdentifier;
+
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
         bool m_clearItemsWhileSyncing;
diff --git a/WebCore/storage/StorageMap.cpp b/WebCore/storage/StorageMap.cpp
index 5498d9e..bb08671 100644
--- a/WebCore/storage/StorageMap.cpp
+++ b/WebCore/storage/StorageMap.cpp
@@ -111,12 +111,21 @@ PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& valu
         return newStorageMap.release();
     }
 
-    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    // Quota tracking.  This is done in a couple of steps to keep the overflow tracking simple.
+    unsigned newLength = m_currentLength;
+    bool overflow = newLength + value.length() < newLength;
+    newLength += value.length();
+
     oldValue = m_map.get(key);
-    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    overflow |= newLength - oldValue.length() > newLength;
+    newLength -= oldValue.length();
+
+    unsigned adjustedKeyLength = oldValue.isNull() ? key.length() : 0;
+    overflow |= newLength + adjustedKeyLength < newLength;
+    newLength += adjustedKeyLength;
+
+    ASSERT(!overflow);  // Overflow is bad...even if quotas are off.
     bool overQuota = newLength > m_quotaSize / sizeof(UChar);
-    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
-    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
     if (m_quotaSize != noQuota && (overflow || overQuota)) {
         quotaException = true;
         return 0;
@@ -143,10 +152,11 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     }
 
     oldValue = m_map.take(key);
-    if (!oldValue.isNull())
+    if (!oldValue.isNull()) {
         invalidateIterator();
-
-    // Update quota.
+        ASSERT(m_currentLength - key.length() <= m_currentLength);
+        m_currentLength -= key.length();
+    }
     ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
     m_currentLength -= oldValue.length();
 
@@ -162,12 +172,11 @@ void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
-
-    if (result.second)
-        result.first->second = value.threadsafeCopy();
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), value.threadsafeCopy());
+    ASSERT(result.second);  // True if the key didn't exist previously.
 
-    // Update quota.
+    ASSERT(m_currentLength + key.length() >= m_currentLength);
+    m_currentLength += key.length();
     ASSERT(m_currentLength + value.length() >= m_currentLength);
     m_currentLength += value.length();
 }
diff --git a/WebCore/storage/StorageSyncManager.cpp b/WebCore/storage/StorageSyncManager.cpp
index f9276dd..d9641b7 100644
--- a/WebCore/storage/StorageSyncManager.cpp
+++ b/WebCore/storage/StorageSyncManager.cpp
@@ -48,28 +48,29 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.crossThreadString())
+    : m_thread(LocalStorageThread::create())
+    , m_path(path.crossThreadString())
 {
     ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
-    m_thread = LocalStorageThread::create();
     m_thread->start();
 }
 
 StorageSyncManager::~StorageSyncManager()
 {
     ASSERT(isMainThread());
+    ASSERT(!m_thread);
 }
 
-String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
+// Called on a background thread.
+String StorageSyncManager::fullDatabaseFilename(const String& databaseIdentifier)
 {
-    ASSERT(origin);
     if (!makeAllDirectories(m_path)) {
         LOG_ERROR("Unabled to create LocalStorage database path %s", m_path.utf8().data());
         return String();
     }
 
-    return pathByAppendingComponent(m_path, origin->databaseIdentifier() + ".localstorage");
+    return pathByAppendingComponent(m_path, databaseIdentifier + ".localstorage");
 }
 
 void StorageSyncManager::close()
@@ -85,19 +86,18 @@ void StorageSyncManager::close()
 bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleImport(area.get());
-
+        m_thread->scheduleTask(LocalStorageTask::createImport(area.get()));
     return m_thread;
 }
 
 void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
-
+    ASSERT(m_thread);
     if (m_thread)
-        m_thread->scheduleSync(area.get());
+        m_thread->scheduleTask(LocalStorageTask::createSync(area.get()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageSyncManager.h b/WebCore/storage/StorageSyncManager.h
index fe35e3d..e2dfa76 100644
--- a/WebCore/storage/StorageSyncManager.h
+++ b/WebCore/storage/StorageSyncManager.h
@@ -32,7 +32,7 @@
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -53,12 +53,12 @@ namespace WebCore {
     private:
         StorageSyncManager(const String& path);
 
-        RefPtr<LocalStorageThread> m_thread;
+        OwnPtr<LocalStorageThread> m_thread;
 
     // The following members are subject to thread synchronization issues
     public:
         // To be called from the background thread:
-        String fullDatabaseFilename(SecurityOrigin*);
+        String fullDatabaseFilename(const String& databaseIdentifier);
 
     private:
         String m_path;
diff --git a/WebCore/storage/chromium/DatabaseObserver.h b/WebCore/storage/chromium/DatabaseObserver.h
new file mode 100644
index 0000000..535c0d2
--- /dev/null
+++ b/WebCore/storage/chromium/DatabaseObserver.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DatabaseObserver_h
+#define DatabaseObserver_h
+
+namespace WebCore {
+
+class Database;
+
+// The implementation of this class is in the WebKit API (Chromium source tree)
+// in webkit/api/src/DatabaseObserver.cpp.
+class DatabaseObserver {
+public:
+    static void databaseOpened(Database*);
+    static void databaseModified(Database*);
+    static void databaseClosed(Database*);
+};
+
+}
+
+#endif // DatabaseObserver_h
diff --git a/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
new file mode 100644
index 0000000..e4b8178
--- /dev/null
+++ b/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DatabaseTracker.h"
+
+#include "CString.h"
+#include "Database.h"
+#include "DatabaseObserver.h"
+#include "DatabaseThread.h"
+#include "Document.h"
+#include "QuotaTracker.h"
+#include "SecurityOrigin.h"
+#include "SQLiteFileSystem.h"
+#include <wtf/HashSet.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+DatabaseTracker& DatabaseTracker::tracker()
+{
+    DEFINE_STATIC_LOCAL(DatabaseTracker, tracker, ());
+    return tracker;
+}
+
+DatabaseTracker::DatabaseTracker()
+{
+    SQLiteFileSystem::registerSQLiteVFS();
+}
+
+bool DatabaseTracker::canEstablishDatabase(Document*, const String&, const String&, unsigned long)
+{
+    // In Chromium, a database can always be established (even though we might not
+    // be able to write anything to it if the quota for this origin was exceeded)
+    return true;
+}
+
+void DatabaseTracker::setDatabaseDetails(SecurityOrigin*, const String&, const String&, unsigned long)
+{
+    // Chromium sets the database details when the database is opened
+}
+
+String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String& name, bool)
+{
+    return origin->databaseIdentifier() + "/" + name + "#";
+}
+
+void DatabaseTracker::addOpenDatabase(Database* database)
+{
+    ASSERT(isMainThread());
+    DatabaseObserver::databaseOpened(database);
+}
+
+void DatabaseTracker::removeOpenDatabase(Database* database)
+{
+    // FIXME: once we know how to use this information, figure out
+    //        how to get this method called on the main thread
+    //ASSERT(isMainThread());
+    //DatabaseObserver::databaseClosed(database);
+}
+
+unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* database)
+{
+    ASSERT(currentThread() == database->document()->databaseThread()->getThreadID());
+    unsigned long long spaceAvailable = 0;
+    unsigned long long databaseSize = 0;
+    QuotaTracker::instance().getDatabaseSizeAndSpaceAvailableToOrigin(
+        database->securityOrigin()->databaseIdentifier(),
+        database->stringIdentifier(), &databaseSize, &spaceAvailable);
+    return databaseSize + spaceAvailable;
+}
+
+}
diff --git a/WebCore/storage/chromium/QuotaTracker.cpp b/WebCore/storage/chromium/QuotaTracker.cpp
new file mode 100644
index 0000000..b49639d
--- /dev/null
+++ b/WebCore/storage/chromium/QuotaTracker.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "QuotaTracker.h"
+
+#include "CString.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+QuotaTracker& QuotaTracker::instance()
+{
+    DEFINE_STATIC_LOCAL(QuotaTracker, tracker, ());
+    return tracker;
+}
+
+void QuotaTracker::getDatabaseSizeAndSpaceAvailableToOrigin(
+    const String& originIdentifier, const String& databaseName,
+    unsigned long long* databaseSize, unsigned long long* spaceAvailable)
+{
+    MutexLocker lockData(m_dataGuard);
+    ASSERT(m_databaseSizes.contains(originIdentifier));
+    HashMap<String, SizeMap>::const_iterator it = m_databaseSizes.find(originIdentifier);
+    ASSERT(it->second.contains(databaseName));
+    *databaseSize = it->second.get(databaseName);
+
+    ASSERT(m_spaceAvailableToOrigins.contains(originIdentifier));
+    *spaceAvailable = m_spaceAvailableToOrigins.get(originIdentifier);
+}
+
+void QuotaTracker::updateDatabaseSizeAndSpaceAvailableToOrigin(
+    const String& originIdentifier, const String& databaseName,
+    unsigned long long databaseSize, unsigned long long spaceAvailable)
+{
+    MutexLocker lockData(m_dataGuard);
+    m_spaceAvailableToOrigins.set(originIdentifier, spaceAvailable);
+    HashMap<String, SizeMap>::iterator it = m_databaseSizes.add(originIdentifier, SizeMap()).first;
+    it->second.set(databaseName, databaseSize);
+}
+
+}
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.h b/WebCore/storage/chromium/QuotaTracker.h
index 712dd9b..9146910 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.h
+++ b/WebCore/storage/chromium/QuotaTracker.h
@@ -28,32 +28,36 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// ScriptObjectQuarantine is used in JSC for wrapping DOM objects of the page
-// before they are passed to Inspector's front-end. The wrapping prevents
-// malicious scripts from gaining privileges. For V8, we are currently just
-// passing the object itself, without any wrapping.
+#ifndef QuotaTracker_h
+#define QuotaTracker_h
 
-#ifndef ScriptObjectQuarantine_h
-#define ScriptObjectQuarantine_h
-
-#include "ScriptState.h"
+#include "CString.h"
+#include "SecurityOrigin.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
-    class Database;
-    class DOMWindow;
-    class Node;
-    class ScriptObject;
-    class ScriptValue;
-    class Storage;
+class QuotaTracker {
+public:
+    static QuotaTracker& instance();
+
+    void getDatabaseSizeAndSpaceAvailableToOrigin(
+        const String& originIdentifier, const String& databaseName,
+        unsigned long long* databaseSize, unsigned long long* spaceAvailable);
+    void updateDatabaseSizeAndSpaceAvailableToOrigin(
+        const String& originIdentifier, const String& databaseName,
+        unsigned long long databaseSize, unsigned long long spaceAvailable);
 
-    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+private:
+    QuotaTracker() { }
 
-    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+    typedef HashMap<String, unsigned long long> SizeMap;
+    SizeMap m_spaceAvailableToOrigins;
+    HashMap<String, SizeMap> m_databaseSizes;
+    Mutex m_dataGuard;
+};
 
 }
 
-#endif // ScriptObjectQuarantine_h
+#endif // QuotaTracker_h
diff --git a/WebCore/storage/chromium/SQLTransactionClientChromium.cpp b/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
new file mode 100644
index 0000000..46d73ba
--- /dev/null
+++ b/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionClient.h"
+
+#include "Database.h"
+#include "DatabaseObserver.h"
+#include "DatabaseThread.h"
+#include "Document.h"
+#include "SQLTransaction.h"
+#include <wtf/MainThread.h>
+
+static void notifyDatabaseChanged(void* context) {
+    WebCore::Database* database = static_cast<WebCore::Database*>(context);
+    WebCore::DatabaseObserver::databaseModified(database);
+    database->deref();  // ref()'d in didCommitTransaction()
+}
+
+namespace WebCore {
+
+void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    if (!transaction->isReadOnly()) {
+        transaction->database()->ref();  // deref()'d in notifyDatabaseChanged()
+        callOnMainThread(notifyDatabaseChanged, transaction->database());
+    }
+}
+
+void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
+{
+    // This method is called after executing every statement that changes the DB.
+    // Chromium doesn't need to do anything at that point.
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+}
+
+bool SQLTransactionClient::didExceedQuota(SQLTransaction*)
+{
+    // Chromium does not allow users to manually change the quota for an origin (for now, at least).
+    // Don't do anything.
+    ASSERT(isMainThread());
+    return false;
+}
+
+}
diff --git a/WebCore/svg/GradientAttributes.h b/WebCore/svg/GradientAttributes.h
index 6b3408e..941e816 100644
--- a/WebCore/svg/GradientAttributes.h
+++ b/WebCore/svg/GradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/LinearGradientAttributes.h b/WebCore/svg/LinearGradientAttributes.h
index 0aefbac..b71dc22 100644
--- a/WebCore/svg/LinearGradientAttributes.h
+++ b/WebCore/svg/LinearGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/PatternAttributes.h b/WebCore/svg/PatternAttributes.h
index b43d87e..36d1765 100644
--- a/WebCore/svg/PatternAttributes.h
+++ b/WebCore/svg/PatternAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/RadialGradientAttributes.h b/WebCore/svg/RadialGradientAttributes.h
index 7645721..76a78ec 100644
--- a/WebCore/svg/RadialGradientAttributes.h
+++ b/WebCore/svg/RadialGradientAttributes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index 7cb7b3e..d0d3613 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAngle.idl b/WebCore/svg/SVGAngle.idl
index fc7c1e1..1a05646 100644
--- a/WebCore/svg/SVGAngle.idl
+++ b/WebCore/svg/SVGAngle.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateColorElement.cpp b/WebCore/svg/SVGAnimateColorElement.cpp
index 1555f5e..ab48f18 100644
--- a/WebCore/svg/SVGAnimateColorElement.cpp
+++ b/WebCore/svg/SVGAnimateColorElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateColorElement.h b/WebCore/svg/SVGAnimateColorElement.h
index 595f0a9..9071185 100644
--- a/WebCore/svg/SVGAnimateColorElement.h
+++ b/WebCore/svg/SVGAnimateColorElement.h
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateElement.cpp b/WebCore/svg/SVGAnimateElement.cpp
index c2a83c0..31d681b 100644
--- a/WebCore/svg/SVGAnimateElement.cpp
+++ b/WebCore/svg/SVGAnimateElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,7 +62,7 @@ static bool parseNumberValueAndUnit(const String& in, double& value, String& uni
         unitLength = 4;
     String newUnit = parse.right(unitLength);
     String number = parse.left(parse.length() - unitLength);
-    if (!unit.isEmpty() && newUnit != unit || number.isEmpty())
+    if ((!unit.isEmpty() && newUnit != unit) || number.isEmpty())
         return false;
     UChar last = number[number.length() - 1];
     if (last < '0' || last > '9')
diff --git a/WebCore/svg/SVGAnimateElement.h b/WebCore/svg/SVGAnimateElement.h
index b90e5c8..ac5883c 100644
--- a/WebCore/svg/SVGAnimateElement.h
+++ b/WebCore/svg/SVGAnimateElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimateTransformElement.h b/WebCore/svg/SVGAnimateTransformElement.h
index 9b1f192..c9139c4 100644
--- a/WebCore/svg/SVGAnimateTransformElement.h
+++ b/WebCore/svg/SVGAnimateTransformElement.h
@@ -4,8 +4,6 @@
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All Rights Reserved.
     
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPathData.cpp b/WebCore/svg/SVGAnimatedPathData.cpp
index be75809..0f43f2c 100644
--- a/WebCore/svg/SVGAnimatedPathData.cpp
+++ b/WebCore/svg/SVGAnimatedPathData.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPathData.h b/WebCore/svg/SVGAnimatedPathData.h
index 88b994b..79bd586 100644
--- a/WebCore/svg/SVGAnimatedPathData.h
+++ b/WebCore/svg/SVGAnimatedPathData.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPoints.cpp b/WebCore/svg/SVGAnimatedPoints.cpp
index 584f875..57101b3 100644
--- a/WebCore/svg/SVGAnimatedPoints.cpp
+++ b/WebCore/svg/SVGAnimatedPoints.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedPoints.h b/WebCore/svg/SVGAnimatedPoints.h
index 1e61057..9f44e1f 100644
--- a/WebCore/svg/SVGAnimatedPoints.h
+++ b/WebCore/svg/SVGAnimatedPoints.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGAnimatedTemplate.h b/WebCore/svg/SVGAnimatedTemplate.h
index e7c49c1..d65fe0b 100644
--- a/WebCore/svg/SVGAnimatedTemplate.h
+++ b/WebCore/svg/SVGAnimatedTemplate.h
@@ -172,7 +172,7 @@ namespace WebCore {
         typedef Type* DecoratedType;
 
         static Type null() { return 0; }
-        static AtomicString toString(Type type) { return type ? AtomicString(type->valueAsString()) : nullAtom; }
+        static String toString(Type type) { return type ? type->valueAsString() : String(); }
     };
 
     template<>
@@ -181,7 +181,7 @@ namespace WebCore {
         typedef bool DecoratedType;
 
         static bool null() { return false; }
-        static AtomicString toString(bool type) { return type ? "true" : "false"; }
+        static String toString(bool type) { return type ? "true" : "false"; }
     };
 
     template<>
@@ -190,7 +190,7 @@ namespace WebCore {
         typedef int DecoratedType;
 
         static int null() { return 0; }
-        static AtomicString toString(int type) { return String::number(type); }
+        static String toString(int type) { return String::number(type); }
     };
 
     template<>
@@ -199,7 +199,7 @@ namespace WebCore {
         typedef long DecoratedType;
 
         static long null() { return 0l; }
-        static AtomicString toString(long type) { return String::number(type); }
+        static String toString(long type) { return String::number(type); }
     };
 
     template<>
@@ -208,7 +208,7 @@ namespace WebCore {
         typedef SVGLength DecoratedType;
 
         static SVGLength null() { return SVGLength(); }
-        static AtomicString toString(const SVGLength& type) { return type.valueAsString(); }
+        static String toString(const SVGLength& type) { return type.valueAsString(); }
     };
 
     template<>
@@ -217,7 +217,7 @@ namespace WebCore {
         typedef float DecoratedType;
 
         static float null() { return 0.0f; }
-        static AtomicString toString(float type) { return String::number(type); }
+        static String toString(float type) { return String::number(type); }
     };
 
     template<>
@@ -226,7 +226,7 @@ namespace WebCore {
         typedef FloatRect DecoratedType;
 
         static FloatRect null() { return FloatRect(); }
-        static AtomicString toString(const FloatRect& type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
+        static String toString(const FloatRect& type) { return String::format("%f %f %f %f", type.x(), type.y(), type.width(), type.height()); }
     };
 
     template<>
@@ -235,7 +235,7 @@ namespace WebCore {
         typedef String DecoratedType;
 
         static String null() { return String(); }
-        static AtomicString toString(const String& type) { return type; }
+        static String toString(const String& type) { return type; }
     };
 
     // Common type definitions, to ease IDL generation.
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index 67e32e0..ce3670d 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -5,8 +5,6 @@
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -489,7 +487,7 @@ void SVGAnimationElement::startedActiveInterval()
         m_animationValid = m_values.size() > 1
             && (calcMode == CalcModePaced || !hasAttribute(SVGNames::keyTimesAttr) || hasAttribute(SVGNames::keyPointsAttr) || (m_values.size() == m_keyTimes.size()))
             && (calcMode == CalcModeDiscrete || !m_keyTimes.size() || m_keyTimes.last() == 1.0)
-            && (calcMode != CalcModeSpline || (m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1) || m_keySplines.size() == m_keyPoints.size() - 1))
+            && (calcMode != CalcModeSpline || ((m_keySplines.size() && (m_keySplines.size() == m_values.size() - 1)) || m_keySplines.size() == m_keyPoints.size() - 1))
             && (!hasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size()));
         if (calcMode == CalcModePaced && m_animationValid)
             calculateKeyTimesForCalcModePaced();
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index 2329299..d96842a 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGClipPathElement.cpp b/WebCore/svg/SVGClipPathElement.cpp
index bbeac91..d5df29c 100644
--- a/WebCore/svg/SVGClipPathElement.cpp
+++ b/WebCore/svg/SVGClipPathElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGColor.cpp b/WebCore/svg/SVGColor.cpp
index d819ebf..ede0b0a 100644
--- a/WebCore/svg/SVGColor.cpp
+++ b/WebCore/svg/SVGColor.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGColor.idl b/WebCore/svg/SVGColor.idl
index 320a9b7..43bcb70 100644
--- a/WebCore/svg/SVGColor.idl
+++ b/WebCore/svg/SVGColor.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index e479fae..bb08ebb 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.h b/WebCore/svg/SVGComponentTransferFunctionElement.h
index a26c953..c955df5 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index b282aa3..f5aa615 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDefsElement.cpp b/WebCore/svg/SVGDefsElement.cpp
index c03c09b..051edeb 100644
--- a/WebCore/svg/SVGDefsElement.cpp
+++ b/WebCore/svg/SVGDefsElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDescElement.cpp b/WebCore/svg/SVGDescElement.cpp
index 0297ad2..319dfda 100644
--- a/WebCore/svg/SVGDescElement.cpp
+++ b/WebCore/svg/SVGDescElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDescElement.h b/WebCore/svg/SVGDescElement.h
index c8bc501..846a23e 100644
--- a/WebCore/svg/SVGDescElement.h
+++ b/WebCore/svg/SVGDescElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDocument.idl b/WebCore/svg/SVGDocument.idl
index 61f4e2e..26b70d1 100644
--- a/WebCore/svg/SVGDocument.idl
+++ b/WebCore/svg/SVGDocument.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGDocumentExtensions.cpp b/WebCore/svg/SVGDocumentExtensions.cpp
index 61645f4..b2492b4 100644
--- a/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/WebCore/svg/SVGDocumentExtensions.cpp
@@ -34,6 +34,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Page.h"
+#include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
 #include "SMILTimeContainer.h"
 #include "XMLTokenizer.h"
@@ -86,6 +87,17 @@ void SVGDocumentExtensions::unpauseAnimations()
         (*itr)->unpauseAnimations();
 }
 
+bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSMILElement* element, double time)
+{
+    ASSERT(element);
+    SMILTimeContainer* container = element->timeContainer();
+    if (!container || container->isPaused())
+        return false;
+
+    container->sampleAnimationAtTime(elementId, time);
+    return true;
+}
+
 void SVGDocumentExtensions::reportWarning(const String& message)
 {
     if (Frame* frame = m_doc->frame())
diff --git a/WebCore/svg/SVGDocumentExtensions.h b/WebCore/svg/SVGDocumentExtensions.h
index cd20a30..b66e2dc 100644
--- a/WebCore/svg/SVGDocumentExtensions.h
+++ b/WebCore/svg/SVGDocumentExtensions.h
@@ -41,9 +41,10 @@ class Node;
 class String;
 class SVGElementInstance;
 class SVGStyledElement;
+class SVGSMILElement;
 class SVGSVGElement;
 
-class SVGDocumentExtensions {
+class SVGDocumentExtensions : public Noncopyable {
 public:
     SVGDocumentExtensions(Document*);
     ~SVGDocumentExtensions();
@@ -54,6 +55,7 @@ public:
     void startAnimations();
     void pauseAnimations();
     void unpauseAnimations();
+    bool sampleAnimationAtTime(const String& elementId, SVGSMILElement*, double time);
 
     void reportWarning(const String&);
     void reportError(const String&);
diff --git a/WebCore/svg/SVGElement.idl b/WebCore/svg/SVGElement.idl
index e4112c1..27fcb8d 100644
--- a/WebCore/svg/SVGElement.idl
+++ b/WebCore/svg/SVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGElementInstanceList.cpp b/WebCore/svg/SVGElementInstanceList.cpp
index f039d44..9404734 100644
--- a/WebCore/svg/SVGElementInstanceList.cpp
+++ b/WebCore/svg/SVGElementInstanceList.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGElementInstanceList.h b/WebCore/svg/SVGElementInstanceList.h
index ef4c73c..9da4cdc 100644
--- a/WebCore/svg/SVGElementInstanceList.h
+++ b/WebCore/svg/SVGElementInstanceList.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index 4c67ff3..3946fb9 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGExternalResourcesRequired.cpp b/WebCore/svg/SVGExternalResourcesRequired.cpp
index 201ecbf..b6b62d1 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEBlendElement.cpp b/WebCore/svg/SVGFEBlendElement.cpp
index 0497ea9..03c5795 100644
--- a/WebCore/svg/SVGFEBlendElement.cpp
+++ b/WebCore/svg/SVGFEBlendElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEBlendElement.h b/WebCore/svg/SVGFEBlendElement.h
index bed649f..c32eabd 100644
--- a/WebCore/svg/SVGFEBlendElement.h
+++ b/WebCore/svg/SVGFEBlendElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEColorMatrixElement.cpp b/WebCore/svg/SVGFEColorMatrixElement.cpp
index c2d605b..88a0d66 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEColorMatrixElement.h b/WebCore/svg/SVGFEColorMatrixElement.h
index 5b7a9ae..f3329e4 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/WebCore/svg/SVGFEColorMatrixElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEComponentTransferElement.cpp b/WebCore/svg/SVGFEComponentTransferElement.cpp
index 691d5cd..f1df08c 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.cpp
+++ b/WebCore/svg/SVGFEComponentTransferElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEComponentTransferElement.h b/WebCore/svg/SVGFEComponentTransferElement.h
index 21c95d2..46d6d9d 100644
--- a/WebCore/svg/SVGFEComponentTransferElement.h
+++ b/WebCore/svg/SVGFEComponentTransferElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFECompositeElement.cpp b/WebCore/svg/SVGFECompositeElement.cpp
index 6eec6ea..a2dd05a 100644
--- a/WebCore/svg/SVGFECompositeElement.cpp
+++ b/WebCore/svg/SVGFECompositeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFECompositeElement.h b/WebCore/svg/SVGFECompositeElement.h
index fc97169..1bb6b05 100644
--- a/WebCore/svg/SVGFECompositeElement.h
+++ b/WebCore/svg/SVGFECompositeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index edbd852..ed6e353 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -88,20 +88,18 @@ bool SVGFEDiffuseLightingElement::build(SVGResourceFilter* filterResource)
     return true;
 }
 
-LightSource* SVGFEDiffuseLightingElement::findLights() const
+PassRefPtr<LightSource> SVGFEDiffuseLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 }
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.h b/WebCore/svg/SVGFEDiffuseLightingElement.h
index fcb5eee..ed117a4 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.h
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.h
@@ -49,7 +49,7 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEDiffuseLightingElement, SVGNames::feDiffuseLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
 
-        LightSource* findLights() const;
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEDistantLightElement.cpp b/WebCore/svg/SVGFEDistantLightElement.cpp
index 35c487b..8322a3a 100644
--- a/WebCore/svg/SVGFEDistantLightElement.cpp
+++ b/WebCore/svg/SVGFEDistantLightElement.cpp
@@ -34,9 +34,9 @@ SVGFEDistantLightElement::~SVGFEDistantLightElement()
 {
 }
 
-LightSource* SVGFEDistantLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEDistantLightElement::lightSource() const
 {
-    return new DistantLightSource(azimuth(), elevation());
+    return DistantLightSource::create(azimuth(), elevation());
 }
 
 }
diff --git a/WebCore/svg/SVGFEDistantLightElement.h b/WebCore/svg/SVGFEDistantLightElement.h
index 95f45c8..3d0c039 100644
--- a/WebCore/svg/SVGFEDistantLightElement.h
+++ b/WebCore/svg/SVGFEDistantLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEDistantLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEDistantLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEFloodElement.cpp b/WebCore/svg/SVGFEFloodElement.cpp
index 3d80799..d69c240 100644
--- a/WebCore/svg/SVGFEFloodElement.cpp
+++ b/WebCore/svg/SVGFEFloodElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFloodElement.h b/WebCore/svg/SVGFEFloodElement.h
index e83fc94..b8b49e7 100644
--- a/WebCore/svg/SVGFEFloodElement.h
+++ b/WebCore/svg/SVGFEFloodElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncAElement.cpp b/WebCore/svg/SVGFEFuncAElement.cpp
index 41118fe..a02b0e5 100644
--- a/WebCore/svg/SVGFEFuncAElement.cpp
+++ b/WebCore/svg/SVGFEFuncAElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncAElement.h b/WebCore/svg/SVGFEFuncAElement.h
index 8ec6b1c..55a3c9d 100644
--- a/WebCore/svg/SVGFEFuncAElement.h
+++ b/WebCore/svg/SVGFEFuncAElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncBElement.cpp b/WebCore/svg/SVGFEFuncBElement.cpp
index 190b23a..2bf939b 100644
--- a/WebCore/svg/SVGFEFuncBElement.cpp
+++ b/WebCore/svg/SVGFEFuncBElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncBElement.h b/WebCore/svg/SVGFEFuncBElement.h
index 5d86f87..177ed26 100644
--- a/WebCore/svg/SVGFEFuncBElement.h
+++ b/WebCore/svg/SVGFEFuncBElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncGElement.cpp b/WebCore/svg/SVGFEFuncGElement.cpp
index d5e5625..e0d60f4 100644
--- a/WebCore/svg/SVGFEFuncGElement.cpp
+++ b/WebCore/svg/SVGFEFuncGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncGElement.h b/WebCore/svg/SVGFEFuncGElement.h
index 9f5d3d7..4eeafa0 100644
--- a/WebCore/svg/SVGFEFuncGElement.h
+++ b/WebCore/svg/SVGFEFuncGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncRElement.cpp b/WebCore/svg/SVGFEFuncRElement.cpp
index e3d7ee4..e8e6b99 100644
--- a/WebCore/svg/SVGFEFuncRElement.cpp
+++ b/WebCore/svg/SVGFEFuncRElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEFuncRElement.h b/WebCore/svg/SVGFEFuncRElement.h
index 0a0d115..196cfa3 100644
--- a/WebCore/svg/SVGFEFuncRElement.h
+++ b/WebCore/svg/SVGFEFuncRElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.cpp b/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 4cddb5a..b2970b3 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.h b/WebCore/svg/SVGFEGaussianBlurElement.h
index c9bb613..9a5c058 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 269d6b2..52531ee 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index 92947a1..705eeaa 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -36,7 +36,7 @@ namespace WebCore {
         SVGFELightElement(const QualifiedName&, Document*);
         virtual ~SVGFELightElement();
         
-        virtual LightSource* lightSource() const = 0;
+        virtual PassRefPtr<LightSource> lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
 
     private:
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index 8f4eed9..6c703ca 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEMergeElement.h b/WebCore/svg/SVGFEMergeElement.h
index e63ed04..f84ddce 100644
--- a/WebCore/svg/SVGFEMergeElement.h
+++ b/WebCore/svg/SVGFEMergeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEMergeNodeElement.cpp b/WebCore/svg/SVGFEMergeNodeElement.cpp
index ae08706..4161de8 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEOffsetElement.cpp b/WebCore/svg/SVGFEOffsetElement.cpp
index 945a9da..95cbc8d 100644
--- a/WebCore/svg/SVGFEOffsetElement.cpp
+++ b/WebCore/svg/SVGFEOffsetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEOffsetElement.h b/WebCore/svg/SVGFEOffsetElement.h
index 1471abe..ae07ed8 100644
--- a/WebCore/svg/SVGFEOffsetElement.h
+++ b/WebCore/svg/SVGFEOffsetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFEPointLightElement.cpp b/WebCore/svg/SVGFEPointLightElement.cpp
index 088f878..36ed2e9 100644
--- a/WebCore/svg/SVGFEPointLightElement.cpp
+++ b/WebCore/svg/SVGFEPointLightElement.cpp
@@ -34,10 +34,10 @@ SVGFEPointLightElement::~SVGFEPointLightElement()
 {
 }
 
-LightSource* SVGFEPointLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFEPointLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
-    return new PointLightSource(pos);
+    return PointLightSource::create(pos);
 }
 
 }
diff --git a/WebCore/svg/SVGFEPointLightElement.h b/WebCore/svg/SVGFEPointLightElement.h
index b39fffa..9b1f997 100644
--- a/WebCore/svg/SVGFEPointLightElement.h
+++ b/WebCore/svg/SVGFEPointLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFEPointLightElement(const QualifiedName&, Document*);
         virtual ~SVGFEPointLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFESpecularLightingElement.cpp b/WebCore/svg/SVGFESpecularLightingElement.cpp
index 7afa4cc..90e9cb3 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.cpp
+++ b/WebCore/svg/SVGFESpecularLightingElement.cpp
@@ -70,20 +70,18 @@ void SVGFESpecularLightingElement::parseMappedAttribute(MappedAttribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-LightSource* SVGFESpecularLightingElement::findLights() const
+PassRefPtr<LightSource> SVGFESpecularLightingElement::findLights() const
 {
-    LightSource* light = 0;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feDistantLightTag) ||
             n->hasTagName(SVGNames::fePointLightTag) ||
             n->hasTagName(SVGNames::feSpotLightTag)) {
             SVGFELightElement* lightNode = static_cast<SVGFELightElement*>(n); 
-            light = lightNode->lightSource();
-            break;
+            return lightNode->lightSource();
         }
     }
 
-    return light;
+    return 0;
 }
 
 bool SVGFESpecularLightingElement::build(SVGResourceFilter* filterResource)
diff --git a/WebCore/svg/SVGFESpecularLightingElement.h b/WebCore/svg/SVGFESpecularLightingElement.h
index 8ef490a..b3771fe 100644
--- a/WebCore/svg/SVGFESpecularLightingElement.h
+++ b/WebCore/svg/SVGFESpecularLightingElement.h
@@ -48,8 +48,8 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGNames::surfaceScaleAttrString, float, SurfaceScale, surfaceScale)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFESpecularLightingElement, SVGNames::feSpecularLightingTagString, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
-        
-        LightSource* findLights() const;
+
+        PassRefPtr<LightSource> findLights() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFESpotLightElement.cpp b/WebCore/svg/SVGFESpotLightElement.cpp
index 980a3bb..01fe54e 100644
--- a/WebCore/svg/SVGFESpotLightElement.cpp
+++ b/WebCore/svg/SVGFESpotLightElement.cpp
@@ -34,7 +34,7 @@ SVGFESpotLightElement::~SVGFESpotLightElement()
 {
 }
 
-LightSource* SVGFESpotLightElement::lightSource() const
+PassRefPtr<LightSource> SVGFESpotLightElement::lightSource() const
 {
     FloatPoint3D pos(x(), y(), z());
 
@@ -44,7 +44,7 @@ LightSource* SVGFESpotLightElement::lightSource() const
                            pointsAtZ() - pos.z());
 
     direction.normalize();
-    return new SpotLightSource(pos, direction, specularExponent(), limitingConeAngle());
+    return SpotLightSource::create(pos, direction, specularExponent(), limitingConeAngle());
 }
 
 }
diff --git a/WebCore/svg/SVGFESpotLightElement.h b/WebCore/svg/SVGFESpotLightElement.h
index 440c664..d54e232 100644
--- a/WebCore/svg/SVGFESpotLightElement.h
+++ b/WebCore/svg/SVGFESpotLightElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
         SVGFESpotLightElement(const QualifiedName&, Document*);
         virtual ~SVGFESpotLightElement();
 
-        virtual LightSource* lightSource() const;
+        virtual PassRefPtr<LightSource> lightSource() const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFETileElement.cpp b/WebCore/svg/SVGFETileElement.cpp
index 14af25f..8894d4b 100644
--- a/WebCore/svg/SVGFETileElement.cpp
+++ b/WebCore/svg/SVGFETileElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETileElement.h b/WebCore/svg/SVGFETileElement.h
index b4fc0c5..142a797 100644
--- a/WebCore/svg/SVGFETileElement.h
+++ b/WebCore/svg/SVGFETileElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETurbulenceElement.cpp b/WebCore/svg/SVGFETurbulenceElement.cpp
index b296e00..57114a3 100644
--- a/WebCore/svg/SVGFETurbulenceElement.cpp
+++ b/WebCore/svg/SVGFETurbulenceElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFETurbulenceElement.h b/WebCore/svg/SVGFETurbulenceElement.h
index 3c95da8..f024f57 100644
--- a/WebCore/svg/SVGFETurbulenceElement.h
+++ b/WebCore/svg/SVGFETurbulenceElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index db46179..bb14448 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -28,12 +26,14 @@
 #include "SVGFilterElement.h"
 
 #include "Attr.h"
-#include "SVGFilterBuilder.h"
+#include "FloatSize.h"
 #include "MappedAttribute.h"
 #include "PlatformString.h"
+#include "SVGFilterBuilder.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
+#include "SVGParserUtilities.h"
 #include "SVGResourceFilter.h"
 #include "SVGUnitTypes.h"
 
@@ -91,7 +91,13 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
         setWidthBaseValue(SVGLength(LengthModeWidth, value));
     else if (attr->name() == SVGNames::heightAttr)
         setHeightBaseValue(SVGLength(LengthModeHeight, value));
-    else {
+    else if (attr->name() == SVGNames::filterResAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setFilterResXBaseValue(x);
+            setFilterResYBaseValue(y);
+        }
+    } else {
         if (SVGURIReference::parseMappedAttribute(attr))
             return;
         if (SVGLangSpace::parseMappedAttribute(attr))
@@ -132,6 +138,11 @@ void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
     m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    if (hasAttribute(SVGNames::filterResAttr)) {
+        m_filter->setHasFilterResolution(true);
+        m_filter->setFilterResolution(FloatSize(filterResX(), filterResY()));
+    }
+
     // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 67c8bff..08559b4 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -97,7 +97,7 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
                                width().value(this),
                                height().value(this));
 
-    filterEffect->setSubRegion(effectBBox);
+    filterEffect->setEffectBoundaries(effectBBox);
 }
 
 }
diff --git a/WebCore/svg/SVGFontData.h b/WebCore/svg/SVGFontData.h
index 4df3db2..3f17e3e 100644
--- a/WebCore/svg/SVGFontData.h
+++ b/WebCore/svg/SVGFontData.h
@@ -26,7 +26,7 @@
 
 namespace WebCore {
 
-class SVGFontData {
+class SVGFontData : public Noncopyable {
 public:
     SVGFontData(SVGFontFaceElement*);
     virtual ~SVGFontData();
diff --git a/WebCore/svg/SVGGElement.cpp b/WebCore/svg/SVGGElement.cpp
index 241f264..ef46af4 100644
--- a/WebCore/svg/SVGGElement.cpp
+++ b/WebCore/svg/SVGGElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 93e2cb4..b4fe21d 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGHKernElement.idl b/WebCore/svg/SVGHKernElement.idl
index 1971aef..7706578 100644
--- a/WebCore/svg/SVGHKernElement.idl
+++ b/WebCore/svg/SVGHKernElement.idl
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLangSpace.cpp b/WebCore/svg/SVGLangSpace.cpp
index d49e09a..f0d6997 100644
--- a/WebCore/svg/SVGLangSpace.cpp
+++ b/WebCore/svg/SVGLangSpace.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLangSpace.h b/WebCore/svg/SVGLangSpace.h
index df8606e..1613998 100644
--- a/WebCore/svg/SVGLangSpace.h
+++ b/WebCore/svg/SVGLangSpace.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.cpp b/WebCore/svg/SVGLength.cpp
index ca3bac3..2884507 100644
--- a/WebCore/svg/SVGLength.cpp
+++ b/WebCore/svg/SVGLength.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2007 Apple Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.h b/WebCore/svg/SVGLength.h
index 7846b4a..a14bc68 100644
--- a/WebCore/svg/SVGLength.h
+++ b/WebCore/svg/SVGLength.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLength.idl b/WebCore/svg/SVGLength.idl
index 20748b1..3938a2c 100644
--- a/WebCore/svg/SVGLength.idl
+++ b/WebCore/svg/SVGLength.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLengthList.cpp b/WebCore/svg/SVGLengthList.cpp
index 20b61d6..367befb 100644
--- a/WebCore/svg/SVGLengthList.cpp
+++ b/WebCore/svg/SVGLengthList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLengthList.h b/WebCore/svg/SVGLengthList.h
index e83fee8..00fc3f8 100644
--- a/WebCore/svg/SVGLengthList.h
+++ b/WebCore/svg/SVGLengthList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index 4f7b7e5..a359698 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGLinearGradientElement.h b/WebCore/svg/SVGLinearGradientElement.h
index 0e1efd4..492c366 100644
--- a/WebCore/svg/SVGLinearGradientElement.h
+++ b/WebCore/svg/SVGLinearGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGList.h b/WebCore/svg/SVGList.h
index c04c200..8fb3bc1 100644
--- a/WebCore/svg/SVGList.h
+++ b/WebCore/svg/SVGList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -41,6 +39,10 @@ namespace WebCore {
         {
             return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::nullItem();
         }
+        static bool isNull(const Item& it)
+        {
+            return SVGListTraits<UsesDefaultInitializer<Item>::value, Item>::isNull(it);
+        }
     };
 
     template<typename Item>
@@ -58,6 +60,10 @@ namespace WebCore {
 
         Item initialize(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
             clear(ec);
             return appendItem(newItem, ec);
         }
@@ -94,8 +100,13 @@ namespace WebCore {
             return m_vector[index];
         }
 
-        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
+        Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             if (index < m_vector.size()) {
                 m_vector.insert(index, newItem);
             } else {
@@ -110,6 +121,11 @@ namespace WebCore {
                 ec = INDEX_SIZE_ERR;
                 return TypeOperations::nullItem();
             }
+    
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
 
             m_vector[index] = newItem;
             return newItem;
@@ -127,8 +143,13 @@ namespace WebCore {
             return item;
         }
 
-        Item appendItem(Item newItem, ExceptionCode&)
+        Item appendItem(Item newItem, ExceptionCode& ec)
         {
+            if (TypeOperations::isNull(newItem)) {
+                ec = TYPE_MISMATCH_ERR;
+                return TypeOperations::nullItem();
+            }
+
             m_vector.append(newItem);
             return newItem;
         }
diff --git a/WebCore/svg/SVGListTraits.h b/WebCore/svg/SVGListTraits.h
index d96bc67..f58b9b9 100644
--- a/WebCore/svg/SVGListTraits.h
+++ b/WebCore/svg/SVGListTraits.h
@@ -2,8 +2,6 @@
     Copyright (C) 2006 Nikolas Zimmermann <wildfox@kde.org>
                   2006 Apple Computer Inc.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,24 +23,48 @@
 
 #if ENABLE(SVG)
 
+#include <wtf/RefPtr.h>
+
 namespace WebCore {
 
     template<typename Item> struct UsesDefaultInitializer { static const bool value = true; };
     template<> struct UsesDefaultInitializer<double>      { static const bool value = false; };
+    template<> struct UsesDefaultInitializer<float>       { static const bool value = false; };
 
     template<bool usesDefaultInitializer, typename Item>
     struct SVGListTraits { };
 
+    template<typename ItemPtr>
+    struct SVGListTraits<true, ItemPtr*> {
+        static ItemPtr* nullItem() { return 0; }
+        static bool isNull(ItemPtr* it) { return !it; }
+    };
+    
+    template<typename ItemPtr>
+    struct SVGListTraits<true, RefPtr<ItemPtr> > {
+        static RefPtr<ItemPtr> nullItem() { return 0; }
+        static bool isNull(const RefPtr<ItemPtr>& it) { return !it; }
+    };
+    
     template<typename Item>
     struct SVGListTraits<true, Item> {
-        static Item nullItem() { return Item(); } 
+        static Item nullItem() { return Item(); }
+        static bool isNull(Item it) { return !it; }
     };
 
     template<>
     struct SVGListTraits<false, double> {
         static double nullItem() { return 0.0; }
+        static bool isNull(double) { return false; }
     };
 
+    template<>
+    struct SVGListTraits<false, float> {
+        static float nullItem() { return 0; }
+        static bool isNull(float) { return false; }
+    };
+
+
 } // namespace WebCore
 
 #endif // SVG_SUPPORT
diff --git a/WebCore/svg/SVGLocatable.h b/WebCore/svg/SVGLocatable.h
index ccb9072..180dae5 100644
--- a/WebCore/svg/SVGLocatable.h
+++ b/WebCore/svg/SVGLocatable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 127f6f4..e131d34 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -2,8 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
                   2005 Alexander Kellett <lypanov@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -158,11 +157,14 @@ PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targe
         return 0;
 
     FloatPoint maskContextLocation = maskDestRect.location();
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskDestRect.move(targetRect.x(), targetRect.y());
-
-    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
-        maskContextLocation.move(targetRect.x(), targetRect.y());
+        if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+            maskContextLocation.move(targetRect.x(), targetRect.y());
+    } else {
+        if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+            maskContextLocation.move(-targetRect.x(), -targetRect.y());
+    }
 
     GraphicsContext* maskImageContext = maskImage->context();
     ASSERT(maskImageContext);
diff --git a/WebCore/svg/SVGMatrix.idl b/WebCore/svg/SVGMatrix.idl
index cb8c08b..d064aa9 100644
--- a/WebCore/svg/SVGMatrix.idl
+++ b/WebCore/svg/SVGMatrix.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -34,7 +32,7 @@ module svg {
         attribute double e;
         attribute double f;
 
-        [Immutable] SVGMatrix multiply(in SVGMatrix secondMatrix);
+        [Custom] SVGMatrix multiply(in SVGMatrix secondMatrix);
         [Custom] SVGMatrix inverse()
             raises(SVGException);
         [Immutable] SVGMatrix translate(in float x, in float y);
diff --git a/WebCore/svg/SVGMetadataElement.cpp b/WebCore/svg/SVGMetadataElement.cpp
index a18f73a..2cefc7d 100644
--- a/WebCore/svg/SVGMetadataElement.cpp
+++ b/WebCore/svg/SVGMetadataElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMetadataElement.h b/WebCore/svg/SVGMetadataElement.h
index 63d0aae..afa6a8e 100644
--- a/WebCore/svg/SVGMetadataElement.h
+++ b/WebCore/svg/SVGMetadataElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGMetadataElement.idl b/WebCore/svg/SVGMetadataElement.idl
index ce65b5e..9434f4d 100644
--- a/WebCore/svg/SVGMetadataElement.idl
+++ b/WebCore/svg/SVGMetadataElement.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumber.idl b/WebCore/svg/SVGNumber.idl
index 7e4c8bd..7e1a117 100644
--- a/WebCore/svg/SVGNumber.idl
+++ b/WebCore/svg/SVGNumber.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumberList.cpp b/WebCore/svg/SVGNumberList.cpp
index 4e904f4..c73e397 100644
--- a/WebCore/svg/SVGNumberList.cpp
+++ b/WebCore/svg/SVGNumberList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGNumberList.h b/WebCore/svg/SVGNumberList.h
index 6cd43ff..29de27e 100644
--- a/WebCore/svg/SVGNumberList.h
+++ b/WebCore/svg/SVGNumberList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPaint.cpp b/WebCore/svg/SVGPaint.cpp
index 45abe69..3b39b91 100644
--- a/WebCore/svg/SVGPaint.cpp
+++ b/WebCore/svg/SVGPaint.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathElement.cpp b/WebCore/svg/SVGPathElement.cpp
index 7079929..d53fbb2 100644
--- a/WebCore/svg/SVGPathElement.cpp
+++ b/WebCore/svg/SVGPathElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -71,9 +69,9 @@ FloatPoint SVGPathElement::getPointAtLength(float length)
     return toPathData().pointAtLength(length, ok);
 }
 
-unsigned long SVGPathElement::getPathSegAtLength(float length)
+unsigned long SVGPathElement::getPathSegAtLength(float length, ExceptionCode& ec)
 {
-    return pathSegList()->getPathSegAtLength(length);
+    return pathSegList()->getPathSegAtLength(length, ec);
 }
 
 PassRefPtr<SVGPathSegClosePath> SVGPathElement::createSVGPathSegClosePath()
diff --git a/WebCore/svg/SVGPathElement.h b/WebCore/svg/SVGPathElement.h
index 7ea010b..266bfdd 100644
--- a/WebCore/svg/SVGPathElement.h
+++ b/WebCore/svg/SVGPathElement.h
@@ -62,7 +62,7 @@ namespace WebCore {
         virtual bool isValid() const { return SVGTests::isValid(); }
         float getTotalLength();
         FloatPoint getPointAtLength(float distance);
-        unsigned long getPathSegAtLength(float distance);
+        unsigned long getPathSegAtLength(float distance, ExceptionCode&);
 
         static PassRefPtr<SVGPathSegClosePath> createSVGPathSegClosePath();
         static PassRefPtr<SVGPathSegMovetoAbs> createSVGPathSegMovetoAbs(float x, float y);
diff --git a/WebCore/svg/SVGPathElement.idl b/WebCore/svg/SVGPathElement.idl
index d66df1d..9a389c8 100644
--- a/WebCore/svg/SVGPathElement.idl
+++ b/WebCore/svg/SVGPathElement.idl
@@ -37,7 +37,8 @@ module svg {
 
         float getTotalLength();
         SVGPoint getPointAtLength(in float distance);
-        unsigned long getPathSegAtLength(in float distance);
+        unsigned long getPathSegAtLength(in float distance)
+            raises(DOMException, SVGException);
 
         SVGPathSegClosePath createSVGPathSegClosePath();
 
diff --git a/WebCore/svg/SVGPathSeg.h b/WebCore/svg/SVGPathSeg.h
index 84de92f..b88806c 100644
--- a/WebCore/svg/SVGPathSeg.h
+++ b/WebCore/svg/SVGPathSeg.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegArc.cpp b/WebCore/svg/SVGPathSegArc.cpp
index a54f057..5fb0243 100644
--- a/WebCore/svg/SVGPathSegArc.cpp
+++ b/WebCore/svg/SVGPathSegArc.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegArc.h b/WebCore/svg/SVGPathSegArc.h
index 8611e8a..e1cbeb1 100644
--- a/WebCore/svg/SVGPathSegArc.h
+++ b/WebCore/svg/SVGPathSegArc.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegClosePath.cpp b/WebCore/svg/SVGPathSegClosePath.cpp
index 04b711c..1f58096 100644
--- a/WebCore/svg/SVGPathSegClosePath.cpp
+++ b/WebCore/svg/SVGPathSegClosePath.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegClosePath.h b/WebCore/svg/SVGPathSegClosePath.h
index 190af9e..0e29bb3 100644
--- a/WebCore/svg/SVGPathSegClosePath.h
+++ b/WebCore/svg/SVGPathSegClosePath.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubic.cpp b/WebCore/svg/SVGPathSegCurvetoCubic.cpp
index 14359de..6b87f55 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubic.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoCubic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubic.h b/WebCore/svg/SVGPathSegCurvetoCubic.h
index 68e3311..125b3a3 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubic.h
+++ b/WebCore/svg/SVGPathSegCurvetoCubic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
index 26babdb..97b256b 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
index 816ba0f..db71dac 100644
--- a/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
+++ b/WebCore/svg/SVGPathSegCurvetoCubicSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp b/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
index 8594fde..f3de513 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoQuadratic.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadratic.h b/WebCore/svg/SVGPathSegCurvetoQuadratic.h
index 1625f13..eb8b0d5 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadratic.h
+++ b/WebCore/svg/SVGPathSegCurvetoQuadratic.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
index 3377709..a64cbb6 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
+++ b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
index 3017689..00eeec7 100644
--- a/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
+++ b/WebCore/svg/SVGPathSegCurvetoQuadraticSmooth.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLineto.cpp b/WebCore/svg/SVGPathSegLineto.cpp
index ac3a8bd..9ad300e 100644
--- a/WebCore/svg/SVGPathSegLineto.cpp
+++ b/WebCore/svg/SVGPathSegLineto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLineto.h b/WebCore/svg/SVGPathSegLineto.h
index 1818ad2..500d5e4 100644
--- a/WebCore/svg/SVGPathSegLineto.h
+++ b/WebCore/svg/SVGPathSegLineto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoHorizontal.cpp b/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
index 3de2cc7..f217919 100644
--- a/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
+++ b/WebCore/svg/SVGPathSegLinetoHorizontal.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoHorizontal.h b/WebCore/svg/SVGPathSegLinetoHorizontal.h
index 84965a5..87d6475 100644
--- a/WebCore/svg/SVGPathSegLinetoHorizontal.h
+++ b/WebCore/svg/SVGPathSegLinetoHorizontal.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoVertical.cpp b/WebCore/svg/SVGPathSegLinetoVertical.cpp
index 4f667ee..341ab02 100644
--- a/WebCore/svg/SVGPathSegLinetoVertical.cpp
+++ b/WebCore/svg/SVGPathSegLinetoVertical.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegLinetoVertical.h b/WebCore/svg/SVGPathSegLinetoVertical.h
index 8d4ba29..844f2f2 100644
--- a/WebCore/svg/SVGPathSegLinetoVertical.h
+++ b/WebCore/svg/SVGPathSegLinetoVertical.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegList.cpp b/WebCore/svg/SVGPathSegList.cpp
index 8d6fdef..11cad14 100644
--- a/WebCore/svg/SVGPathSegList.cpp
+++ b/WebCore/svg/SVGPathSegList.cpp
@@ -51,15 +51,16 @@ SVGPathSegList::~SVGPathSegList()
 {
 }
 
-unsigned SVGPathSegList::getPathSegAtLength(double)
+unsigned SVGPathSegList::getPathSegAtLength(double, ExceptionCode& ec)
 {
     // FIXME : to be useful this will need to support non-normalized SVGPathSegLists
-    ExceptionCode ec = 0;
     int len = numberOfItems();
     // FIXME: Eventually this will likely move to a "path applier"-like model, until then PathTraversalState is less useful as we could just use locals
     PathTraversalState traversalState(PathTraversalState::TraversalSegmentAtLength);
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return 0;
         float segmentLength = 0;
         switch (segment->pathSegType()) {
         case SVGPathSeg::PATHSEG_MOVETO_ABS:
@@ -104,10 +105,12 @@ Path SVGPathSegList::toPathData()
 {
     // FIXME : This should also support non-normalized PathSegLists
     Path pathData;
-    ExceptionCode ec = 0;
     int len = numberOfItems();
+    ExceptionCode ec = 0;
     for (int i = 0; i < len; ++i) {
         SVGPathSeg* segment = getItem(i, ec).get();
+        if (ec)
+            return Path();
         switch (segment->pathSegType()) {
             case SVGPathSeg::PATHSEG_MOVETO_ABS:
             {
@@ -182,10 +185,14 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
     if (!itemCount || itemCount != toList->numberOfItems())
         return 0;
     RefPtr<SVGPathSegList> result = create(fromList->associatedAttributeName());
-    ExceptionCode ec;
+    ExceptionCode ec = 0;
     for (unsigned n = 0; n < itemCount; ++n) {
         SVGPathSeg* from = fromList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         SVGPathSeg* to = toList->getItem(n, ec).get();
+        if (ec)
+            return 0;
         if (from->pathSegType() == SVGPathSeg::PATHSEG_UNKNOWN || from->pathSegType() != to->pathSegType())
             return 0;
         RefPtr<SVGPathSeg> segment = 0;
@@ -251,6 +258,8 @@ PassRefPtr<SVGPathSegList> SVGPathSegList::createAnimated(const SVGPathSegList*
             ASSERT_NOT_REACHED();
         }
         result->appendItem(segment, ec);
+        if (ec)
+            return 0;
     }
     return result.release();
 }
diff --git a/WebCore/svg/SVGPathSegList.h b/WebCore/svg/SVGPathSegList.h
index d9325ce..d2999f0 100644
--- a/WebCore/svg/SVGPathSegList.h
+++ b/WebCore/svg/SVGPathSegList.h
@@ -36,7 +36,7 @@ namespace WebCore {
         static PassRefPtr<SVGPathSegList> create(const QualifiedName& attributeName) { return adoptRef(new SVGPathSegList(attributeName)); }
         virtual ~SVGPathSegList();
 
-        unsigned getPathSegAtLength(double);
+        unsigned getPathSegAtLength(double, ExceptionCode&);
         Path toPathData();
         
         static PassRefPtr<SVGPathSegList> createAnimated(const SVGPathSegList* fromList, const SVGPathSegList* toList, float progress);
diff --git a/WebCore/svg/SVGPathSegMoveto.cpp b/WebCore/svg/SVGPathSegMoveto.cpp
index fc67b29..1144779 100644
--- a/WebCore/svg/SVGPathSegMoveto.cpp
+++ b/WebCore/svg/SVGPathSegMoveto.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPathSegMoveto.h b/WebCore/svg/SVGPathSegMoveto.h
index 726b819..5d30633 100644
--- a/WebCore/svg/SVGPathSegMoveto.h
+++ b/WebCore/svg/SVGPathSegMoveto.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index 34b7db4..a10c2c2 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPoint.idl b/WebCore/svg/SVGPoint.idl
index 1a0d227..1bf96f8 100644
--- a/WebCore/svg/SVGPoint.idl
+++ b/WebCore/svg/SVGPoint.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPointList.cpp b/WebCore/svg/SVGPointList.cpp
index c5a6dd2..02a67ed 100644
--- a/WebCore/svg/SVGPointList.cpp
+++ b/WebCore/svg/SVGPointList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPointList.h b/WebCore/svg/SVGPointList.h
index d443e2d..cc12366 100644
--- a/WebCore/svg/SVGPointList.h
+++ b/WebCore/svg/SVGPointList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index 62e53a3..61725b5 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolygonElement.cpp b/WebCore/svg/SVGPolygonElement.cpp
index 95513e4..a4a62af 100644
--- a/WebCore/svg/SVGPolygonElement.cpp
+++ b/WebCore/svg/SVGPolygonElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolygonElement.h b/WebCore/svg/SVGPolygonElement.h
index 7afb553..fa6eef6 100644
--- a/WebCore/svg/SVGPolygonElement.h
+++ b/WebCore/svg/SVGPolygonElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolylineElement.cpp b/WebCore/svg/SVGPolylineElement.cpp
index 9ea136e..899c072 100644
--- a/WebCore/svg/SVGPolylineElement.cpp
+++ b/WebCore/svg/SVGPolylineElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPolylineElement.h b/WebCore/svg/SVGPolylineElement.h
index d43dbbe..e070c9f 100644
--- a/WebCore/svg/SVGPolylineElement.h
+++ b/WebCore/svg/SVGPolylineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGPreserveAspectRatio.cpp b/WebCore/svg/SVGPreserveAspectRatio.cpp
index 5793976..e6452c3 100644
--- a/WebCore/svg/SVGPreserveAspectRatio.cpp
+++ b/WebCore/svg/SVGPreserveAspectRatio.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -180,7 +178,7 @@ TransformationMatrix SVGPreserveAspectRatio::getCTM(double logicX, double logicY
     if (align() == SVG_PRESERVEASPECTRATIO_NONE) {
         temp.scaleNonUniform(physWidth / logicWidth, physHeight / logicHeight);
         temp.translate(-logicX, -logicY);
-    } else if (vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET) || vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE)) {
+    } else if ((vpar < svgar && (meetOrSlice() == SVG_MEETORSLICE_MEET)) || (vpar >= svgar && (meetOrSlice() == SVG_MEETORSLICE_SLICE))) {
         temp.scaleNonUniform(physHeight / logicHeight, physHeight / logicHeight);
 
         if (align() == SVG_PRESERVEASPECTRATIO_XMINYMIN || align() == SVG_PRESERVEASPECTRATIO_XMINYMID || align() == SVG_PRESERVEASPECTRATIO_XMINYMAX)
diff --git a/WebCore/svg/SVGPreserveAspectRatio.h b/WebCore/svg/SVGPreserveAspectRatio.h
index a0100ff..18a89dd 100644
--- a/WebCore/svg/SVGPreserveAspectRatio.h
+++ b/WebCore/svg/SVGPreserveAspectRatio.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index a9b5cff..270de6f 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -105,23 +105,37 @@ void SVGRadialGradientElement::buildGradient() const
         radius = attributes.r().value(this);
     }
 
-    float adjustedFocusX = focalPoint.x();
-    float adjustedFocusY = focalPoint.y();
-
-    float fdx = focalPoint.x() - centerPoint.x();
-    float fdy = focalPoint.y() - centerPoint.y();
+    FloatPoint adjustedFocalPoint = focalPoint;
+    float dfx = focalPoint.x() - centerPoint.x();
+    float dfy = focalPoint.y() - centerPoint.y();
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
-        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
-        adjustedFocusX = cosf(angle) * radius;
-        adjustedFocusY = sinf(angle) * radius;
+    if (sqrt(dfx * dfx + dfy * dfy) >= radius) {
+        float angle = atan2f(dfx, dfy);
+
+        // The maximum deviation of 0.2% is needed on Cairo, since Cairo
+        // is working with fixed point numbers.
+#if PLATFORM(CAIRO)
+        if (focalPoint.x() < centerPoint.x())
+            dfx = cosf(angle) * radius + 0.002f;
+        else
+            dfx = cosf(angle) * radius - 0.002f;
+        if (focalPoint.y() < centerPoint.y())
+            dfy = sinf(angle) * radius + 0.002f;
+        else
+            dfy = sinf(angle) * radius - 0.002f;
+#else
+        dfx = cosf(angle) * radius;
+        dfy = sinf(angle) * radius;
+#endif
+
+        adjustedFocalPoint = FloatPoint(dfx + centerPoint.x(), dfy + centerPoint.y());
     }
 
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint(adjustedFocusX, adjustedFocusY),
+        adjustedFocalPoint,
         0.f, // SVG does not support a "focus radius"
         centerPoint,
         radius);
diff --git a/WebCore/svg/SVGRadialGradientElement.h b/WebCore/svg/SVGRadialGradientElement.h
index 6813e65..61f56f5 100644
--- a/WebCore/svg/SVGRadialGradientElement.h
+++ b/WebCore/svg/SVGRadialGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRect.idl b/WebCore/svg/SVGRect.idl
index 7fdce65..0278030 100644
--- a/WebCore/svg/SVGRect.idl
+++ b/WebCore/svg/SVGRect.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index 966976a..f9b04c8 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGRenderingIntent.h b/WebCore/svg/SVGRenderingIntent.h
index 699f228..f4bfa6a 100644
--- a/WebCore/svg/SVGRenderingIntent.h
+++ b/WebCore/svg/SVGRenderingIntent.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSVGElement.idl b/WebCore/svg/SVGSVGElement.idl
index b188894..46a17b0 100644
--- a/WebCore/svg/SVGSVGElement.idl
+++ b/WebCore/svg/SVGSVGElement.idl
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index c2f4a6e..7be72dc 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSetElement.cpp b/WebCore/svg/SVGSetElement.cpp
index 5800580..a6e81b3 100644
--- a/WebCore/svg/SVGSetElement.cpp
+++ b/WebCore/svg/SVGSetElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSetElement.h b/WebCore/svg/SVGSetElement.h
index fda6919..7d0eced 100644
--- a/WebCore/svg/SVGSetElement.h
+++ b/WebCore/svg/SVGSetElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStopElement.cpp b/WebCore/svg/SVGStopElement.cpp
index 51582d7..0549031 100644
--- a/WebCore/svg/SVGStopElement.cpp
+++ b/WebCore/svg/SVGStopElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStringList.cpp b/WebCore/svg/SVGStringList.cpp
index 9a23a4a..70bfad8 100644
--- a/WebCore/svg/SVGStringList.cpp
+++ b/WebCore/svg/SVGStringList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStringList.h b/WebCore/svg/SVGStringList.h
index 1cbe9d2..2fca6bc 100644
--- a/WebCore/svg/SVGStringList.h
+++ b/WebCore/svg/SVGStringList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStylable.cpp b/WebCore/svg/SVGStylable.cpp
index 5d063c3..c72843a 100644
--- a/WebCore/svg/SVGStylable.cpp
+++ b/WebCore/svg/SVGStylable.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStylable.h b/WebCore/svg/SVGStylable.h
index ade5c2f..7e13d35 100644
--- a/WebCore/svg/SVGStylable.h
+++ b/WebCore/svg/SVGStylable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyleElement.cpp b/WebCore/svg/SVGStyleElement.cpp
index 31f5920..0a2195a 100644
--- a/WebCore/svg/SVGStyleElement.cpp
+++ b/WebCore/svg/SVGStyleElement.cpp
@@ -4,8 +4,6 @@
     Copyright (C) 2006 Apple Computer, Inc.
     Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyleElement.h b/WebCore/svg/SVGStyleElement.h
index 3853fb3..de37f5d 100644
--- a/WebCore/svg/SVGStyleElement.h
+++ b/WebCore/svg/SVGStyleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledElement.h b/WebCore/svg/SVGStyledElement.h
index e21db97..9cc21c5 100644
--- a/WebCore/svg/SVGStyledElement.h
+++ b/WebCore/svg/SVGStyledElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledLocatableElement.cpp b/WebCore/svg/SVGStyledLocatableElement.cpp
index 39ecb7d..a48082c 100644
--- a/WebCore/svg/SVGStyledLocatableElement.cpp
+++ b/WebCore/svg/SVGStyledLocatableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledLocatableElement.h b/WebCore/svg/SVGStyledLocatableElement.h
index 41a034d..3902c73 100644
--- a/WebCore/svg/SVGStyledLocatableElement.h
+++ b/WebCore/svg/SVGStyledLocatableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledTransformableElement.cpp b/WebCore/svg/SVGStyledTransformableElement.cpp
index b7cf979..4e97c83 100644
--- a/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGStyledTransformableElement.h b/WebCore/svg/SVGStyledTransformableElement.h
index cf5713e..3145e6f 100644
--- a/WebCore/svg/SVGStyledTransformableElement.h
+++ b/WebCore/svg/SVGStyledTransformableElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSwitchElement.cpp b/WebCore/svg/SVGSwitchElement.cpp
index a07b2a7..6d0f5d1 100644
--- a/WebCore/svg/SVGSwitchElement.cpp
+++ b/WebCore/svg/SVGSwitchElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGSymbolElement.cpp b/WebCore/svg/SVGSymbolElement.cpp
index 4155b0c..6f3a644 100644
--- a/WebCore/svg/SVGSymbolElement.cpp
+++ b/WebCore/svg/SVGSymbolElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTRefElement.cpp b/WebCore/svg/SVGTRefElement.cpp
index 5b8640a..1f32e90 100644
--- a/WebCore/svg/SVGTRefElement.cpp
+++ b/WebCore/svg/SVGTRefElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTSpanElement.cpp b/WebCore/svg/SVGTSpanElement.cpp
index eadae1e..12bf377 100644
--- a/WebCore/svg/SVGTSpanElement.cpp
+++ b/WebCore/svg/SVGTSpanElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTSpanElement.h b/WebCore/svg/SVGTSpanElement.h
index 7a29e96..17445d3 100644
--- a/WebCore/svg/SVGTSpanElement.h
+++ b/WebCore/svg/SVGTSpanElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTests.h b/WebCore/svg/SVGTests.h
index 2d82cb4..a2abddf 100644
--- a/WebCore/svg/SVGTests.h
+++ b/WebCore/svg/SVGTests.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextElement.cpp b/WebCore/svg/SVGTextElement.cpp
index b8c7331..c1481cf 100644
--- a/WebCore/svg/SVGTextElement.cpp
+++ b/WebCore/svg/SVGTextElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextElement.h b/WebCore/svg/SVGTextElement.h
index a5cb382..400aa47 100644
--- a/WebCore/svg/SVGTextElement.h
+++ b/WebCore/svg/SVGTextElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index ebbb628..8a01ad9 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPositioningElement.cpp b/WebCore/svg/SVGTextPositioningElement.cpp
index 32d9dc0..fd7c8aa 100644
--- a/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/WebCore/svg/SVGTextPositioningElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTextPositioningElement.h b/WebCore/svg/SVGTextPositioningElement.h
index 3e01dab..2b07d09 100644
--- a/WebCore/svg/SVGTextPositioningElement.h
+++ b/WebCore/svg/SVGTextPositioningElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTitleElement.cpp b/WebCore/svg/SVGTitleElement.cpp
index 3e23a1b..5afde8d 100644
--- a/WebCore/svg/SVGTitleElement.cpp
+++ b/WebCore/svg/SVGTitleElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTitleElement.h b/WebCore/svg/SVGTitleElement.h
index e053a42..340f725 100644
--- a/WebCore/svg/SVGTitleElement.h
+++ b/WebCore/svg/SVGTitleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.cpp b/WebCore/svg/SVGTransform.cpp
index 17d9b8f..9fe770c 100644
--- a/WebCore/svg/SVGTransform.cpp
+++ b/WebCore/svg/SVGTransform.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.h b/WebCore/svg/SVGTransform.h
index 0a5e410..1e15468 100644
--- a/WebCore/svg/SVGTransform.h
+++ b/WebCore/svg/SVGTransform.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransform.idl b/WebCore/svg/SVGTransform.idl
index 3163cd6..0fd3a1e 100644
--- a/WebCore/svg/SVGTransform.idl
+++ b/WebCore/svg/SVGTransform.idl
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformList.cpp b/WebCore/svg/SVGTransformList.cpp
index 648f1e9..f4f0965 100644
--- a/WebCore/svg/SVGTransformList.cpp
+++ b/WebCore/svg/SVGTransformList.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformList.h b/WebCore/svg/SVGTransformList.h
index d095fe4..9aea524 100644
--- a/WebCore/svg/SVGTransformList.h
+++ b/WebCore/svg/SVGTransformList.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGTransformable.h b/WebCore/svg/SVGTransformable.h
index da31c75..1e87b78 100644
--- a/WebCore/svg/SVGTransformable.h
+++ b/WebCore/svg/SVGTransformable.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGURIReference.h b/WebCore/svg/SVGURIReference.h
index 812fb59..7f91b72 100644
--- a/WebCore/svg/SVGURIReference.h
+++ b/WebCore/svg/SVGURIReference.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGUnitTypes.h b/WebCore/svg/SVGUnitTypes.h
index 6be737f..b639f29 100644
--- a/WebCore/svg/SVGUnitTypes.h
+++ b/WebCore/svg/SVGUnitTypes.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 42517bd..a566992 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -3,8 +3,6 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -446,6 +444,9 @@ Path SVGUseElement::toClipPath() const
     if (!m_shadowTreeRootElement)
         const_cast<SVGUseElement*>(this)->buildPendingResource();
 
+    if (!m_shadowTreeRootElement)
+        return Path();
+
     Node* n = m_shadowTreeRootElement->firstChild();
     if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
         if (!isDirectReference(n))
@@ -772,7 +773,7 @@ void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* targe
             EventListenerMap& map = d->eventListenerMap;
             EventListenerMap::iterator end = map.end();
             for (EventListenerMap::iterator it = map.begin(); it != end; ++it) {
-                EventListenerVector& entry = it->second;
+                EventListenerVector& entry = *it->second;
                 for (size_t i = 0; i < entry.size(); ++i) {
                     // Event listeners created from markup have already been transfered to the shadow tree during cloning.
                     if (entry[i].listener->wasCreatedFromMarkup())
diff --git a/WebCore/svg/SVGViewElement.cpp b/WebCore/svg/SVGViewElement.cpp
index af1d1fe..0fe6a90 100644
--- a/WebCore/svg/SVGViewElement.cpp
+++ b/WebCore/svg/SVGViewElement.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGViewSpec.h b/WebCore/svg/SVGViewSpec.h
index 090b7ae..5f963af 100644
--- a/WebCore/svg/SVGViewSpec.h
+++ b/WebCore/svg/SVGViewSpec.h
@@ -33,7 +33,8 @@ namespace WebCore {
     class SVGTransformList;
 
     class SVGViewSpec : public SVGFitToViewBox,
-                        public SVGZoomAndPan {
+                        public SVGZoomAndPan,
+                        public Noncopyable {
     public:
         SVGViewSpec(const SVGSVGElement*);
         virtual ~SVGViewSpec();
diff --git a/WebCore/svg/SVGZoomAndPan.cpp b/WebCore/svg/SVGZoomAndPan.cpp
index c5eafb2..b1ea995 100644
--- a/WebCore/svg/SVGZoomAndPan.cpp
+++ b/WebCore/svg/SVGZoomAndPan.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGZoomAndPan.h b/WebCore/svg/SVGZoomAndPan.h
index d7be342..c11f8e2 100644
--- a/WebCore/svg/SVGZoomAndPan.h
+++ b/WebCore/svg/SVGZoomAndPan.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/SVGZoomEvent.cpp b/WebCore/svg/SVGZoomEvent.cpp
index 2d5a870..92609b1 100644
--- a/WebCore/svg/SVGZoomEvent.cpp
+++ b/WebCore/svg/SVGZoomEvent.cpp
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
diff --git a/WebCore/svg/animation/SMILTimeContainer.cpp b/WebCore/svg/animation/SMILTimeContainer.cpp
index a37e481..f0b479d 100644
--- a/WebCore/svg/animation/SMILTimeContainer.cpp
+++ b/WebCore/svg/animation/SMILTimeContainer.cpp
@@ -46,6 +46,7 @@ SMILTimeContainer::SMILTimeContainer(SVGSVGElement* owner)
     : m_beginTime(0)
     , m_pauseTime(0)
     , m_accumulatedPauseTime(0)
+    , m_nextManualSampleTime(0)
     , m_documentOrderIndexesDirty(false)
     , m_timer(this, &SMILTimeContainer::timerFired)
     , m_ownerSVGElement(owner)
@@ -207,14 +208,45 @@ String SMILTimeContainer::baseValueFor(ElementAttributePair key)
     m_savedBaseValues.add(key, baseValue);
     return baseValue;
 }
-      
+
+void SMILTimeContainer::sampleAnimationAtTime(const String& elementId, double newTime)
+{
+    ASSERT(m_beginTime);
+    ASSERT(!isPaused());
+
+    // Fast-forward to the time DRT wants to sample
+    m_timer.stop();
+    m_nextSamplingTarget = elementId;
+    m_nextManualSampleTime = newTime;
+
+    updateAnimations(elapsed());
+}
+
 void SMILTimeContainer::updateAnimations(SMILTime elapsed)
 {
     SMILTime earliersFireTime = SMILTime::unresolved();
 
     Vector<SVGSMILElement*> toAnimate;
     copyToVector(m_scheduledAnimations, toAnimate);
-    
+
+    if (m_nextManualSampleTime) {
+        SMILTime samplingDiff;
+        for (unsigned n = 0; n < toAnimate.size(); ++n) {
+            SVGSMILElement* animation = toAnimate[n];
+            ASSERT(animation->timeContainer() == this);
+
+            SVGElement* targetElement = animation->targetElement();
+            if (!targetElement || targetElement->getIDAttribute() != m_nextSamplingTarget)
+                continue;
+
+            samplingDiff = animation->intervalBegin();
+            break;
+        }
+
+        elapsed = SMILTime(m_nextManualSampleTime) + samplingDiff;
+        m_nextManualSampleTime = 0;
+    }
+
     // Sort according to priority. Elements with later begin time have higher priority.
     // In case of a tie, document order decides. 
     // FIXME: This should also consider timing relationships between the elements. Dependents
diff --git a/WebCore/svg/animation/SMILTimeContainer.h b/WebCore/svg/animation/SMILTimeContainer.h
index 5cef507..a6a61c0 100644
--- a/WebCore/svg/animation/SMILTimeContainer.h
+++ b/WebCore/svg/animation/SMILTimeContainer.h
@@ -60,6 +60,9 @@ namespace WebCore {
         
         void setDocumentOrderIndexesDirty() { m_documentOrderIndexesDirty = true; }
 
+        // Move to a specific time. Only used for DRT testing purposes.
+        void sampleAnimationAtTime(const String& elementId, double seconds);
+
     private:
         SMILTimeContainer(SVGSVGElement* owner);
         
@@ -76,7 +79,9 @@ namespace WebCore {
         double m_beginTime;
         double m_pauseTime;
         double m_accumulatedPauseTime;
-        
+        double m_nextManualSampleTime;
+        String m_nextSamplingTarget;
+
         bool m_documentOrderIndexesDirty;
         
         Timer<SMILTimeContainer> m_timer;
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 0a506f8..c4be11e 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -173,7 +173,7 @@ bool SVGImage::hasRelativeHeight() const
     return rootElement->height().unitType() == LengthTypePercentage;
 }
 
-void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+void SVGImage::draw(GraphicsContext* context, const FloatRect& dstRect, const FloatRect& srcRect, ColorSpace, CompositeOperator compositeOp)
 {
     if (!m_page)
         return;
diff --git a/WebCore/svg/graphics/SVGImage.h b/WebCore/svg/graphics/SVGImage.h
index 2cea91a..10f39ba 100644
--- a/WebCore/svg/graphics/SVGImage.h
+++ b/WebCore/svg/graphics/SVGImage.h
@@ -64,7 +64,7 @@ namespace WebCore {
         virtual NativeImagePtr frameAtIndex(size_t) { return 0; }
         
         SVGImage(ImageObserver*);
-        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, CompositeOperator);
+        virtual void draw(GraphicsContext*, const FloatRect& fromRect, const FloatRect& toRect, ColorSpace styleColorSpace, CompositeOperator);
         
         virtual NativeImagePtr nativeImageForCurrentFrame();
         
diff --git a/WebCore/svg/graphics/SVGPaintServerGradient.cpp b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
index 4a8e9e0..74e3c22 100644
--- a/WebCore/svg/graphics/SVGPaintServerGradient.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerGradient.cpp
@@ -233,7 +233,7 @@ bool SVGPaintServerGradient::setup(GraphicsContext*& context, const RenderObject
         // lines or rectangles without width or height.
         if (bbox.width() == 0 || bbox.height() == 0) {
             Color color(0, 0, 0);
-            context->setStrokeColor(color);
+            context->setStrokeColor(color, object->style()->colorSpace());
             return true;
         }
         matrix.translate(bbox.x(), bbox.y());
diff --git a/WebCore/svg/graphics/SVGPaintServerPattern.cpp b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
index e825a0b..289c40c 100644
--- a/WebCore/svg/graphics/SVGPaintServerPattern.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerPattern.cpp
@@ -131,7 +131,7 @@ bool SVGPaintServerPattern::setup(GraphicsContext*& context, const RenderObject*
             tileImageContext->translate(0, patternBoundaries().height());
             for (int j = numX; j > 0; j--) {
                 tileImageContext->translate(patternBoundaries().width(), 0);
-                tileImageContext->drawImage(tile()->image(), tileRect, tileRect);
+                tileImageContext->drawImage(tile()->image(), object->style()->colorSpace(), tileRect, tileRect);
             }
             tileImageContext->translate(-patternBoundaries().width() * numX, 0);
         }
diff --git a/WebCore/svg/graphics/SVGPaintServerSolid.cpp b/WebCore/svg/graphics/SVGPaintServerSolid.cpp
index b333042..72baad2 100644
--- a/WebCore/svg/graphics/SVGPaintServerSolid.cpp
+++ b/WebCore/svg/graphics/SVGPaintServerSolid.cpp
@@ -64,10 +64,11 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
 {
     RenderStyle* style = object ? object->style() : 0;
     const SVGRenderStyle* svgStyle = style ? style->svgStyle() : 0;
+    ColorSpace colorSpace = style ? style->colorSpace() : DeviceColorSpace;
 
     if ((type & ApplyToFillTargetType) && (!style || svgStyle->hasFill())) {
         context->setAlpha(style ? svgStyle->fillOpacity() : 1);
-        context->setFillColor(color().rgb());
+        context->setFillColor(color().rgb(), colorSpace);
         context->setFillRule(style ? svgStyle->fillRule() : RULE_NONZERO);
 
         if (isPaintingText)
@@ -76,7 +77,7 @@ bool SVGPaintServerSolid::setup(GraphicsContext*& context, const RenderObject* o
 
     if ((type & ApplyToStrokeTargetType) && (!style || svgStyle->hasStroke())) {
         context->setAlpha(style ? svgStyle->strokeOpacity() : 1);
-        context->setStrokeColor(color().rgb());
+        context->setStrokeColor(color().rgb(), colorSpace);
 
         if (style)
             applyStrokeStyleToContext(context, style, object);
diff --git a/WebCore/svg/graphics/SVGResource.cpp b/WebCore/svg/graphics/SVGResource.cpp
index 049edc7..514b70d 100644
--- a/WebCore/svg/graphics/SVGResource.cpp
+++ b/WebCore/svg/graphics/SVGResource.cpp
@@ -39,7 +39,7 @@ SVGResource::SVGResource()
 {
 }
 
-struct ResourceSet { 
+struct ResourceSet : Noncopyable {
     ResourceSet() 
     {
         for (int i = 0; i < _ResourceTypeCount; i++)
diff --git a/WebCore/svg/graphics/SVGResourceFilter.cpp b/WebCore/svg/graphics/SVGResourceFilter.cpp
index 973743c..fcf0e40 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -35,6 +35,10 @@
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
+static const float kMaxFilterSize = 5000.0f;
+
+using std::min;
+
 namespace WebCore {
 
 SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
@@ -42,6 +46,9 @@ SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
     , m_ownerElement(ownerElement)
     , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
+    , m_filterRes(false)
+    , m_scaleX(1.f)
+    , m_scaleY(1.f)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
@@ -52,27 +59,72 @@ SVGResourceFilter::~SVGResourceFilter()
 {
 }
 
+static inline bool shouldProcessFilter(SVGResourceFilter* filter)
+{
+    return (!filter->scaleX() || !filter->scaleY() || !filter->filterBoundingBox().width()
+            || !filter->filterBoundingBox().height());
+}
+
 void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
     effectAttributes->setStandardAttributes(this, effect.get());
     builder()->add(effectAttributes->result(), effect);
 }
 
+bool SVGResourceFilter::fitsInMaximumImageSize(const FloatSize& size)
+{
+    bool matchesFilterSize = true;
+    if (size.width() > kMaxFilterSize) {
+        m_scaleX *= kMaxFilterSize / size.width();
+        matchesFilterSize = false;
+    }
+    if (size.height() > kMaxFilterSize) {
+        m_scaleY *= kMaxFilterSize / size.height();
+        matchesFilterSize = false;
+    }
+
+    return matchesFilterSize;
+}
+
 void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
     FloatRect targetRect = object->objectBoundingBox();
     m_ownerElement->buildFilter(targetRect);
 
+    if (shouldProcessFilter(this))
+        return;
+
     // clip sourceImage to filterRegion
     FloatRect clippedSourceRect = targetRect;
     clippedSourceRect.intersect(m_filterBBox);
 
+    // scale filter size to filterRes
+    FloatRect tempSourceRect = clippedSourceRect;
+    if (m_filterRes) {
+        m_scaleX = m_filterResSize.width() / m_filterBBox.width();
+        m_scaleY = m_filterResSize.height() / m_filterBBox.height();
+    }
+
+    // scale to big sourceImage size to kMaxFilterSize
+    tempSourceRect.scale(m_scaleX, m_scaleY);
+    fitsInMaximumImageSize(tempSourceRect.size());
+
     // prepare Filters
     m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
+    m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
-    if (lastEffect)
+    if (lastEffect) {
         lastEffect->calculateEffectRect(m_filter.get());
+        // at least one FilterEffect has a too big image size,
+        // recalculate the effect sizes with new scale factors
+        if (!fitsInMaximumImageSize(m_filter->maxImageSize())) {
+            m_filter->setFilterResolution(FloatSize(m_scaleX, m_scaleY));
+            lastEffect->calculateEffectRect(m_filter.get());
+        }
+    }
+
+    clippedSourceRect.scale(m_scaleX, m_scaleY);
 
     // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
     // The size of the SourceGraphic is clipped to the size of the filterRegion.
@@ -83,6 +135,7 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
         return;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
+    sourceGraphicContext->scale(FloatSize(m_scaleX, m_scaleY));
     sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
     sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
@@ -91,8 +144,11 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
     context = sourceGraphicContext;
 }
 
-void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject*)
+void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObject* object)
 {
+    if (shouldProcessFilter(this))
+        return;
+
     if (!m_savedContext)
         return;
 
@@ -113,7 +169,10 @@ void SVGResourceFilter::applyFilter(GraphicsContext*& context, const RenderObjec
 #if !PLATFORM(CG)
             resultImage->transformColorSpace(LinearRGB, DeviceRGB);
 #endif
-            context->drawImage(resultImage->image(), lastEffect->subRegion());
+            ColorSpace colorSpace = DeviceColorSpace;
+            if (object)
+                colorSpace = object->style()->colorSpace();
+            context->drawImage(resultImage->image(), colorSpace, lastEffect->subRegion());
         }
     }
 
diff --git a/WebCore/svg/graphics/SVGResourceFilter.h b/WebCore/svg/graphics/SVGResourceFilter.h
index 86b11fe..ffd926d 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/WebCore/svg/graphics/SVGResourceFilter.h
@@ -53,6 +53,9 @@ public:
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
+    void setFilterResolution(const FloatSize& filterResSize) { m_filterResSize = filterResSize; }
+    void setHasFilterResolution(bool filterRes) { m_filterRes = filterRes; }
+
     bool filterBoundingBoxMode() const { return m_filterBBoxMode; }
     void setFilterBoundingBoxMode(bool bboxMode) { m_filterBBoxMode = bboxMode; }
 
@@ -62,12 +65,17 @@ public:
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
+    float scaleX() const { return m_scaleX; }
+    float scaleY() const { return m_scaleY; }
+
     FloatRect filterBoundingBox() { return m_filterBBox; }
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
     void prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
+    bool fitsInMaximumImageSize(const FloatSize&);
+
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
@@ -81,9 +89,13 @@ private:
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
+    bool m_filterRes : 1;
+    float m_scaleX;
+    float m_scaleY;
 
     FloatRect m_filterRect;
     FloatRect m_filterBBox;
+    FloatSize m_filterResSize;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
diff --git a/WebCore/svg/graphics/filters/SVGDistantLightSource.h b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
index 07ac16c..db9b59d 100644
--- a/WebCore/svg/graphics/filters/SVGDistantLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGDistantLightSource.h
@@ -30,11 +30,10 @@ namespace WebCore {
 
     class DistantLightSource : public LightSource {
     public:
-        DistantLightSource(float azimuth, float elevation)
-            : LightSource(LS_DISTANT)
-            , m_azimuth(azimuth)
-            , m_elevation(elevation)
-        { }
+        static PassRefPtr<DistantLightSource> create(float azimuth, float elevation)
+        {
+            return adoptRef(new DistantLightSource(azimuth, elevation));
+        }
 
         float azimuth() const { return m_azimuth; }
         float elevation() const { return m_elevation; }
@@ -42,6 +41,13 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        DistantLightSource(float azimuth, float elevation)
+            : LightSource(LS_DISTANT)
+            , m_azimuth(azimuth)
+            , m_elevation(elevation)
+        {
+        }
+
         float m_azimuth;
         float m_elevation;
     };
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
index c536478..93921df 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.cpp
@@ -30,7 +30,7 @@
 namespace WebCore {
 
 FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingColor, const float& surfaceScale,
-    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& diffuseConstant, const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -44,7 +44,7 @@ FEDiffuseLighting::FEDiffuseLighting(FilterEffect* in , const Color& lightingCol
 
 PassRefPtr<FEDiffuseLighting> FEDiffuseLighting::create(FilterEffect* in , const Color& lightingColor,
     const float& surfaceScale, const float& diffuseConstant, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FEDiffuseLighting(in, lightingColor, surfaceScale, diffuseConstant, kernelUnitLengthX, kernelUnitLengthY, lightSource));
 }
@@ -108,7 +108,7 @@ const LightSource* FEDiffuseLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FEDiffuseLighting::setLightSource(LightSource* lightSource)
+void FEDiffuseLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {    
     m_lightSource = lightSource;
 }
diff --git a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
index 71f8e22..bf7f28e 100644
--- a/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFEDiffuseLighting.h
@@ -34,7 +34,7 @@ namespace WebCore {
     class FEDiffuseLighting : public FilterEffect {
     public:
         static PassRefPtr<FEDiffuseLighting> create(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FEDiffuseLighting();
 
         Color lightingColor() const;
@@ -53,7 +53,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -62,7 +62,7 @@ namespace WebCore {
         
     private:
         FEDiffuseLighting(FilterEffect*, const Color&, const float&, const float&,
-                const float&, const float&, LightSource*);
+                const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
index abb57ee..a22bc94 100644
--- a/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEDisplacementMap.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,12 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEDisplacementMap.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
@@ -75,8 +80,53 @@ void FEDisplacementMap::setScale(float scale)
     m_scale = scale;
 }
 
-void FEDisplacementMap::apply(Filter*)
+void FEDisplacementMap::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_xChannelSelector == CHANNEL_UNKNOWN || m_yChannelSelector == CHANNEL_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getUnmultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+
+    float scaleX = m_scale / 255.f * filter->filterResolution().width();
+    float scaleY = m_scale / 255.f * filter->filterResolution().height();
+    float scaleAdjustmentX = (0.5f - 0.5f * m_scale) * filter->filterResolution().width();
+    float scaleAdjustmentY = (0.5f - 0.5f * m_scale) * filter->filterResolution().height();
+    int stride = imageRect.width() * 4;
+    for (int y = 0; y < imageRect.height(); ++y) {
+        int line = y * stride;
+        for (int x = 0; x < imageRect.width(); ++x) {
+            int dstIndex = line + x * 4;
+            int srcX = x + static_cast<int>(scaleX * srcPixelArrayB->get(dstIndex + m_xChannelSelector - 1) + scaleAdjustmentX);
+            int srcY = y + static_cast<int>(scaleY * srcPixelArrayB->get(dstIndex + m_yChannelSelector - 1) + scaleAdjustmentY);
+            for (unsigned channel = 0; channel < 4; ++channel) {
+                if (srcX < 0 || srcX >= imageRect.width() || srcY < 0 || srcY >= imageRect.height())
+                    imageData->data()->set(dstIndex + channel, static_cast<unsigned char>(0));
+                else {
+                    unsigned char pixelValue = srcPixelArrayA->get(srcY * stride + srcX * 4 + channel);
+                    imageData->data()->set(dstIndex + channel, pixelValue);
+                }
+            }
+
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEDisplacementMap::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 668209f..648bf54 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -70,7 +70,7 @@ void FEFlood::apply(Filter*)
         return;
 
     Color color = colorWithOverrideAlpha(floodColor().rgb(), floodOpacity());
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()), color);
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()), color, DeviceColorSpace);
 }
 
 void FEFlood::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEMerge.cpp b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
index acf3c45..3f9ad38 100644
--- a/WebCore/svg/graphics/filters/SVGFEMerge.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMerge.cpp
@@ -78,8 +78,8 @@ void FEMerge::apply(Filter* filter)
         return;
 
     for (unsigned i = 0; i < m_mergeInputs.size(); i++) {
-        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->subRegion());
-        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), destRect);
+        FloatRect destRect = calculateDrawingRect(m_mergeInputs[i]->scaledSubRegion());
+        filterContext->drawImage(m_mergeInputs[i]->resultImage()->image(), DeviceColorSpace, destRect);
     }
 }
 
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index f7fc5d8..20d109a 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,8 +24,16 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEMorphology.h"
-#include "SVGRenderTreeAsText.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "ImageData.h"
+#include "SVGRenderTreeAsText.h"
+
+#include <wtf/Vector.h>
+
+using std::min;
+using std::max;
 
 namespace WebCore {
 
@@ -72,8 +81,73 @@ void FEMorphology::setRadiusY(float radiusY)
     m_radiusY = radiusY;
 }
 
-void FEMorphology::apply(Filter*)
+void FEMorphology::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+    
+    if (!getEffectContext())
+        return;
+
+    if (!m_radiusX || !m_radiusY)
+        return;
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->scaledSubRegion());
+    RefPtr<CanvasPixelArray> srcPixelArray(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect)->data());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    int radiusX = static_cast<int>(m_radiusX * filter->filterResolution().width());
+    int radiusY = static_cast<int>(m_radiusY * filter->filterResolution().height());
+    int effectWidth = effectDrawingRect.width() * 4;
+    
+    // Limit the radius size to effect width
+    radiusX = min(effectDrawingRect.width() - 1, radiusX);
+    
+    Vector<unsigned char> extrema;
+    for (int y = 0; y < effectDrawingRect.height(); ++y) {
+        int startY = max(0, y - radiusY);
+        int endY = min(effectDrawingRect.height() - 1, y + radiusY);
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            // Fill the kernel
+            extrema.clear();
+            for (int j = 0; j <= radiusX; ++j) {
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + 4 * j + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + 4 * j + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                extrema.append(columnExtrema);
+            }
+            
+            // Kernel is filled, get extrema of next column 
+            for (int x = 0; x < effectDrawingRect.width(); ++x) {
+                unsigned endX = min(x + radiusX, effectDrawingRect.width() - 1);
+                unsigned char columnExtrema = srcPixelArray->get(startY * effectWidth + endX * 4 + channel);
+                for (int i = startY; i <= endY; ++i) {
+                    unsigned char pixel = srcPixelArray->get(i * effectWidth + endX * 4 + channel);
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && pixel <= columnExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && pixel >= columnExtrema))
+                        columnExtrema = pixel;
+                }
+                if (x - radiusX >= 0)
+                    extrema.remove(0);
+                if (x + radiusX <= effectDrawingRect.width())
+                    extrema.append(columnExtrema);
+                unsigned char entireExtrema = extrema[0];
+                for (unsigned kernelIndex = 0; kernelIndex < extrema.size(); ++kernelIndex) {
+                    if ((m_type == FEMORPHOLOGY_OPERATOR_ERODE && extrema[kernelIndex] <= entireExtrema) ||
+                        (m_type == FEMORPHOLOGY_OPERATOR_DILATE && extrema[kernelIndex] >= entireExtrema))
+                        entireExtrema = extrema[kernelIndex];
+                }
+                imageData->data()->set(y * effectWidth + 4 * x + channel, entireExtrema);
+            }
+        }
+    }
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEMorphology::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEOffset.cpp b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
index ce9ee3d..9fd50ed 100644
--- a/WebCore/svg/graphics/filters/SVGFEOffset.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEOffset.cpp
@@ -74,17 +74,22 @@ void FEOffset::apply(Filter* filter)
     if (!filterContext)
         return;
 
+    FloatRect sourceImageRect = filter->sourceImageRect();
+    sourceImageRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+
     if (filter->effectBoundingBoxMode()) {
-        setDx(dx() * filter->sourceImageRect().width());
-        setDy(dy() * filter->sourceImageRect().height());
+        m_dx *= sourceImageRect.width();
+        m_dy *= sourceImageRect.height();
     }
+    m_dx *= filter->filterResolution().width();
+    m_dy *= filter->filterResolution().height();
 
-    FloatRect dstRect = FloatRect(dx() + m_in->subRegion().x() - subRegion().x(),
-                                  dy() + m_in->subRegion().y() - subRegion().y(),
-                                  m_in->subRegion().width(),
-                                  m_in->subRegion().height());
+    FloatRect dstRect = FloatRect(m_dx + m_in->scaledSubRegion().x() - scaledSubRegion().x(),
+                                  m_dy + m_in->scaledSubRegion().y() - scaledSubRegion().y(),
+                                  m_in->scaledSubRegion().width(),
+                                  m_in->scaledSubRegion().height());
 
-    filterContext->drawImage(m_in->resultImage()->image(), dstRect);
+    filterContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, dstRect);
 }
 
 void FEOffset::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
index eb0c280..0b43aba 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.cpp
@@ -30,7 +30,7 @@ namespace WebCore {
 
 FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingColor, const float& surfaceScale,
     const float& specularConstant, const float& specularExponent, const float& kernelUnitLengthX,
-    const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
     : FilterEffect()
     , m_in(in)
     , m_lightingColor(lightingColor)
@@ -45,7 +45,7 @@ FESpecularLighting::FESpecularLighting(FilterEffect* in, const Color& lightingCo
 
 PassRefPtr<FESpecularLighting> FESpecularLighting::create(FilterEffect* in, const Color& lightingColor,
     const float& surfaceScale, const float& specularConstant, const float& specularExponent,
-    const float& kernelUnitLengthX, const float& kernelUnitLengthY, LightSource* lightSource)
+    const float& kernelUnitLengthX, const float& kernelUnitLengthY, PassRefPtr<LightSource> lightSource)
 {
     return adoptRef(new FESpecularLighting(in, lightingColor, surfaceScale, specularConstant, specularExponent,
         kernelUnitLengthX, kernelUnitLengthY, lightSource));
@@ -120,7 +120,7 @@ const LightSource* FESpecularLighting::lightSource() const
     return m_lightSource.get();
 }
 
-void FESpecularLighting::setLightSource(LightSource* lightSource)
+void FESpecularLighting::setLightSource(PassRefPtr<LightSource> lightSource)
 {
     m_lightSource = lightSource;
 }
diff --git a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
index dec5163..f4947fd 100644
--- a/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
+++ b/WebCore/svg/graphics/filters/SVGFESpecularLighting.h
@@ -33,7 +33,7 @@ namespace WebCore {
     class FESpecularLighting : public FilterEffect {
     public:
         static PassRefPtr<FESpecularLighting> create(FilterEffect*, const Color&, const float&, const float&,
-            const float&, const float&, const float&, LightSource*);
+            const float&, const float&, const float&, PassRefPtr<LightSource>);
         virtual ~FESpecularLighting();
 
         Color lightingColor() const;
@@ -55,7 +55,7 @@ namespace WebCore {
         void setKernelUnitLengthY(float);
 
         const LightSource* lightSource() const;
-        void setLightSource(LightSource*);
+        void setLightSource(PassRefPtr<LightSource>);
 
         virtual FloatRect uniteEffectRect(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
@@ -64,7 +64,7 @@ namespace WebCore {
 
     private:
         FESpecularLighting(FilterEffect*, const Color&, const float&, const float&, const float&,
-            const float&, const float&, LightSource*);
+            const float&, const float&, PassRefPtr<LightSource>);
 
         RefPtr<FilterEffect> m_in;
         Color m_lightingColor;
diff --git a/WebCore/svg/graphics/filters/SVGFETile.cpp b/WebCore/svg/graphics/filters/SVGFETile.cpp
index 3071501..e97f68f 100644
--- a/WebCore/svg/graphics/filters/SVGFETile.cpp
+++ b/WebCore/svg/graphics/filters/SVGFETile.cpp
@@ -58,24 +58,27 @@ void FETile::apply(Filter* filter)
     if (!filterContext)
         return;
 
-    IntRect tileRect = enclosingIntRect(m_in->subRegion());
+    IntRect tileRect = enclosingIntRect(m_in->scaledSubRegion());
 
     // Source input needs more attention. It has the size of the filterRegion but gives the
     // size of the cutted sourceImage back. This is part of the specification and optimization.
-    if (m_in->isSourceInput())
-        tileRect = enclosingIntRect(filter->filterRegion());
+    if (m_in->isSourceInput()) {
+        FloatRect filterRegion = filter->filterRegion();
+        filterRegion.scale(filter->filterResolution().width(), filter->filterResolution().height());
+        tileRect = enclosingIntRect(filterRegion);
+    }
 
     OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size());
     GraphicsContext* tileImageContext = tileImage->context();
-    tileImageContext->drawImage(m_in->resultImage()->image(), IntPoint());
+    tileImageContext->drawImage(m_in->resultImage()->image(), DeviceColorSpace, IntPoint());
     RefPtr<Pattern> pattern = Pattern::create(tileImage->image(), true, true);
 
     TransformationMatrix matrix;
-    matrix.translate(m_in->subRegion().x() - subRegion().x(), m_in->subRegion().y() - subRegion().y());
+    matrix.translate(m_in->scaledSubRegion().x() - scaledSubRegion().x(), m_in->scaledSubRegion().y() - scaledSubRegion().y());
     pattern.get()->setPatternSpaceTransform(matrix);
 
     filterContext->setFillPattern(pattern);
-    filterContext->fillRect(FloatRect(FloatPoint(), subRegion().size()));
+    filterContext->fillRect(FloatRect(FloatPoint(), scaledSubRegion().size()));
 }
 
 void FETile::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFilter.cpp b/WebCore/svg/graphics/filters/SVGFilter.cpp
index 6bfcf39..4ec4e6e 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -34,7 +34,7 @@ SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool
 
 void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
-    FloatRect subRegionBBox = effect->subRegion();
+    FloatRect subRegionBBox = effect->effectBoundaries();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
     FloatRect newSubRegion = subRegionBBox;
 
@@ -70,6 +70,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     newSubRegion.intersect(m_filterRect);
 
     effect->setSubRegion(newSubRegion);
+    newSubRegion.scale(filterResolution().width(), filterResolution().height());
+    effect->setScaledSubRegion(newSubRegion);
+    m_maxImageSize = m_maxImageSize.expandedTo(newSubRegion.size()); 
 }
 
 PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
diff --git a/WebCore/svg/graphics/filters/SVGFilter.h b/WebCore/svg/graphics/filters/SVGFilter.h
index f23d1ea..c4714c6 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/WebCore/svg/graphics/filters/SVGFilter.h
@@ -24,6 +24,7 @@
 #include "Filter.h"
 #include "FilterEffect.h"
 #include "FloatRect.h"
+#include "FloatSize.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,15 +36,18 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
-        bool effectBoundingBoxMode() { return m_effectBBoxMode; }
+        virtual bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
 
-        FloatRect filterRegion() { return m_filterRect; }
-        FloatRect sourceImageRect() { return m_itemBox; }
-        void calculateEffectSubRegion(FilterEffect*);
+        virtual FloatRect filterRegion() const { return m_filterRect; }
+        virtual FloatRect sourceImageRect() const { return m_itemBox; }
+
+        virtual FloatSize maxImageSize() const { return m_maxImageSize; }
+        virtual void calculateEffectSubRegion(FilterEffect*);
 
     private:
         SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
+        FloatSize m_maxImageSize;
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
diff --git a/WebCore/svg/graphics/filters/SVGLightSource.h b/WebCore/svg/graphics/filters/SVGLightSource.h
index 22b43c8..6f0075c 100644
--- a/WebCore/svg/graphics/filters/SVGLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGLightSource.h
@@ -24,6 +24,7 @@
 #define SVGLightSource_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/WebCore/svg/graphics/filters/SVGPointLightSource.h b/WebCore/svg/graphics/filters/SVGPointLightSource.h
index 772e278..1e966cc 100644
--- a/WebCore/svg/graphics/filters/SVGPointLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGPointLightSource.h
@@ -31,16 +31,22 @@ namespace WebCore {
 
     class PointLightSource : public LightSource {
     public:
-        PointLightSource(const FloatPoint3D& position)
-            : LightSource(LS_POINT)
-            , m_position(position)
-        { }
+        static PassRefPtr<PointLightSource> create(const FloatPoint3D& position)
+        {
+            return adoptRef(new PointLightSource(position));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
 
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        PointLightSource(const FloatPoint3D& position)
+            : LightSource(LS_POINT)
+            , m_position(position)
+        {
+        }
+
         FloatPoint3D m_position;
     };
 
diff --git a/WebCore/svg/graphics/filters/SVGSpotLightSource.h b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
index 9a787fb..05280d2 100644
--- a/WebCore/svg/graphics/filters/SVGSpotLightSource.h
+++ b/WebCore/svg/graphics/filters/SVGSpotLightSource.h
@@ -31,13 +31,11 @@ namespace WebCore {
 
     class SpotLightSource : public LightSource {
     public:
-        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction, float specularExponent, float limitingConeAngle)
-            : LightSource(LS_SPOT)
-            , m_position(position)
-            , m_direction(direction)
-            , m_specularExponent(specularExponent)
-            , m_limitingConeAngle(limitingConeAngle)
-        { }
+        static PassRefPtr<SpotLightSource> create(const FloatPoint3D& position, const FloatPoint3D& direction,
+                                                  float specularExponent, float limitingConeAngle)
+        {
+            return adoptRef(new SpotLightSource(position, direction, specularExponent, limitingConeAngle));
+        }
 
         const FloatPoint3D& position() const { return m_position; }
         const FloatPoint3D& direction() const { return m_direction; }
@@ -48,6 +46,16 @@ namespace WebCore {
         virtual TextStream& externalRepresentation(TextStream&) const;
 
     private:
+        SpotLightSource(const FloatPoint3D& position, const FloatPoint3D& direction,
+                        float specularExponent, float limitingConeAngle)
+            : LightSource(LS_SPOT)
+            , m_position(position)
+            , m_direction(direction)
+            , m_specularExponent(specularExponent)
+            , m_limitingConeAngle(limitingConeAngle)
+        {
+        }
+
         FloatPoint3D m_position;
         FloatPoint3D m_direction;
 
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 30a0e4c..ca1ea89 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -2,7 +2,7 @@ namespace="SVG"
 namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 exportStrings
-
+ 
 a createWithNew
 #if ENABLE_SVG_FONTS
 altGlyph createWithNew
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 32e0559..ee78174 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -43,35 +43,11 @@
 #include "Logging.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
-#include "SecurityOrigin.h"
 #include "WebSocketChannel.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
-public:
-    typedef void (WebSocket::*Method)(Event*);
-    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-    {
-        return adoptRef(new ProcessWebSocketEventTask(webSocket, event));
-    }
-    virtual void performTask(ScriptExecutionContext*)
-    {
-        ExceptionCode ec = 0;
-        m_webSocket->dispatchEvent(m_event.get(), ec);
-        ASSERT(!ec);
-    }
-
-  private:
-    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
-        : m_webSocket(webSocket)
-        , m_event(event) { }
-
-    RefPtr<WebSocket> m_webSocket;
-    RefPtr<Event> m_event;
-};
-
 static bool isValidProtocolString(const WebCore::String& protocol)
 {
     if (protocol.isNull())
@@ -80,7 +56,7 @@ static bool isValidProtocolString(const WebCore::String& protocol)
         return false;
     const UChar* characters = protocol.characters();
     for (size_t i = 0; i < protocol.length(); i++) {
-        if (characters[i] < 0x21 || characters[i] > 0x7E)
+        if (characters[i] < 0x20 || characters[i] > 0x7E)
             return false;
     }
     return true;
@@ -110,7 +86,7 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
 
 WebSocket::~WebSocket()
 {
-    if (m_channel.get())
+    if (m_channel)
         m_channel->disconnect();
 }
 
@@ -126,18 +102,29 @@ void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode&
     m_protocol = protocol;
 
     if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
-        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
+        LOG(Network, "Wrong url scheme for WebSocket %s", url.string().utf8().data());
+        m_state = CLOSED;
+        ec = SYNTAX_ERR;
+        return;
+    }
+    if (m_url.hasFragmentIdentifier()) {
+        LOG(Network, "URL has fragment component %s", url.string().utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
     if (!isValidProtocolString(m_protocol)) {
-        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
+        LOG(Network, "Wrong protocol for WebSocket %s", m_protocol.utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+    if (!portAllowed(url)) {
+        LOG(Network, "WebSocket port %d blocked", url.port());
+        m_state = CLOSED;
+        ec = SECURITY_ERR;
+        return;
+    }
 
     m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
     m_channel->connect();
@@ -196,7 +183,7 @@ void WebSocket::didConnect()
         return;
     }
     m_state = OPEN;
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().openEvent, false, false)));
+    dispatchEvent(Event::create(eventNames().openEvent, false, false));
 }
 
 void WebSocket::didReceiveMessage(const String& msg)
@@ -207,15 +194,14 @@ void WebSocket::didReceiveMessage(const String& msg)
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
     evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
+    dispatchEvent(evt);
 }
 
 void WebSocket::didClose()
 {
     LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    if (scriptExecutionContext())
-        scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
+    dispatchEvent(Event::create(eventNames().closeEvent, false, false));
 }
 
 EventTargetData* WebSocket::eventTargetData()
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
index be388b4..a222b4d 100644
--- a/WebCore/websockets/WebSocketChannel.cpp
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -69,7 +69,7 @@ WebSocketChannel::~WebSocketChannel()
 void WebSocketChannel::connect()
 {
     LOG(Network, "WebSocketChannel %p connect", this);
-    ASSERT(!m_handle.get());
+    ASSERT(!m_handle);
     m_handshake.reset();
     ref();
     m_handle = SocketStreamHandle::create(m_handshake.url(), this);
@@ -82,7 +82,7 @@ bool WebSocketChannel::send(const String& msg)
     buf.append('\0');  // frame type
     buf.append(msg.utf8().data(), msg.utf8().length());
     buf.append('\xff');  // frame end
-    if (!m_handle.get()) {
+    if (!m_handle) {
         m_unhandledBufferSize += buf.size();
         return false;
     }
@@ -92,7 +92,7 @@ bool WebSocketChannel::send(const String& msg)
 unsigned long WebSocketChannel::bufferedAmount() const
 {
     LOG(Network, "WebSocketChannel %p bufferedAmount", this);
-    if (!m_handle.get())
+    if (!m_handle)
         return m_unhandledBufferSize;
     return m_handle->bufferedAmount();
 }
@@ -100,7 +100,7 @@ unsigned long WebSocketChannel::bufferedAmount() const
 void WebSocketChannel::close()
 {
     LOG(Network, "WebSocketChannel %p close", this);
-    if (m_handle.get())
+    if (m_handle)
         m_handle->close();  // will call didClose()
 }
 
@@ -108,22 +108,14 @@ void WebSocketChannel::disconnect()
 {
     LOG(Network, "WebSocketChannel %p disconnect", this);
     m_client = 0;
-    if (m_handle.get())
+    if (m_handle)
         m_handle->close();
 }
 
-void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
-{
-}
-
-void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
-{
-}
-
 void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didOpen", this);
-    ASSERT(handle == m_handle.get());
+    ASSERT(handle == m_handle);
     const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
         LOG(Network, "Error in sending handshake message.");
@@ -134,8 +126,8 @@ void WebSocketChannel::didOpen(SocketStreamHandle* handle)
 void WebSocketChannel::didClose(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didClose", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
-    if (m_handle.get()) {
+    ASSERT(handle == m_handle || !m_handle);
+    if (m_handle) {
         m_unhandledBufferSize = handle->bufferedAmount();
         WebSocketChannelClient* client = m_client;
         m_client = 0;
@@ -149,7 +141,7 @@ void WebSocketChannel::didClose(SocketStreamHandle* handle)
 void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
 {
     LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
-    ASSERT(handle == m_handle.get());
+    ASSERT(handle == m_handle);
     if (!appendToBuffer(data, len)) {
         handle->close();
         return;
@@ -167,8 +159,10 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
             if (!m_handshake.serverSetCookie().isEmpty()) {
                 if (m_context->isDocument()) {
                     Document* document = static_cast<Document*>(m_context);
-                    if (cookiesEnabled(document))
-                        document->setCookie(m_handshake.serverSetCookie());
+                    if (cookiesEnabled(document)) {
+                        ExceptionCode ec; // Exception (for sandboxed documents) ignored.
+                        document->setCookie(m_handshake.serverSetCookie(), ec);
+                    }
                 }
             }
             // FIXME: handle set-cookie2.
@@ -193,19 +187,23 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
         unsigned char frameByte = static_cast<unsigned char>(*p++);
         if ((frameByte & 0x80) == 0x80) {
             int length = 0;
-            while (p < end && (*p & 0x80) == 0x80) {
+            while (p < end) {
                 if (length > std::numeric_limits<int>::max() / 128) {
                     LOG(Network, "frame length overflow %d", length);
                     handle->close();
                     return;
                 }
-                length = length * 128 + (*p & 0x7f);
+                char msgByte = *p;
+                length = length * 128 + (msgByte & 0x7f);
                 ++p;
+                if (!(msgByte & 0x80))
+                    break;
             }
             if (p + length < end) {
                 p += length;
                 nextFrame = p;
-            }
+            } else
+                break;
         } else {
             const char* msgStart = p;
             while (p < end && *p != '\xff')
@@ -224,10 +222,18 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
 void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
 {
     LOG(Network, "WebSocketChannel %p didFail", this);
-    ASSERT(handle == m_handle.get() || !m_handle.get());
+    ASSERT(handle == m_handle || !m_handle);
     handle->close();
 }
 
+void WebSocketChannel::didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
+void WebSocketChannel::didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&)
+{
+}
+
 bool WebSocketChannel::appendToBuffer(const char* data, int len)
 {
     char* newBuffer = 0;
diff --git a/WebCore/websockets/WebSocketChannel.h b/WebCore/websockets/WebSocketChannel.h
index ad38163..14b1e8c 100644
--- a/WebCore/websockets/WebSocketChannel.h
+++ b/WebCore/websockets/WebSocketChannel.h
@@ -50,21 +50,18 @@ namespace WebCore {
         static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return adoptRef(new WebSocketChannel(context, client, url, protocol)); }
         virtual ~WebSocketChannel();
 
-        virtual void connect();
+        void connect();
+        bool send(const String& msg);
+        unsigned long bufferedAmount() const;
+        void close();
+        void disconnect(); // Will suppress didClose().
 
-        virtual bool send(const String& msg);
-        virtual unsigned long bufferedAmount() const;
-
-        virtual void close();
-
-        virtual void disconnect();
-
-        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
-        virtual void willSendData(SocketStreamHandle*, const char*, int);
         virtual void didOpen(SocketStreamHandle*);
         virtual void didClose(SocketStreamHandle*);
         virtual void didReceiveData(SocketStreamHandle*, const char*, int);
         virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&);
 
     private:
         WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
index 691fa1c..d1da443 100644
--- a/WebCore/websockets/WebSocketHandshake.cpp
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -74,6 +74,13 @@ static String extractResponseCode(const char* header, int len)
     return String(space1 + 1, space2 - space1 - 1);
 }
 
+static String resourceName(const KURL& url)
+{
+    if (url.query().isNull())
+        return url.path();
+    return url.path() + "?" + url.query();
+}
+
 WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
     : m_url(url)
     , m_clientProtocol(protocol)
@@ -139,7 +146,7 @@ String WebSocketHandshake::clientLocation() const
             builder.append(String::number(m_url.port()));
         }
     }
-    builder.append(m_url.path());
+    builder.append(resourceName(m_url));
     return builder.toString();
 }
 
@@ -148,11 +155,7 @@ CString WebSocketHandshake::clientHandshakeMessage() const
     StringBuilder builder;
 
     builder.append("GET ");
-    builder.append(m_url.path());
-    if (!m_url.query().isEmpty()) {
-        builder.append("?");
-        builder.append(m_url.query());
-    }
+    builder.append(resourceName(m_url));
     builder.append(" HTTP/1.1\r\n");
     builder.append("Upgrade: WebSocket\r\n");
     builder.append("Connection: Upgrade\r\n");
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index 074c371..8bd6fad 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -140,8 +140,8 @@ void WMLAElement::defaultEventHandler(Event* event)
         }
  
         if (!event->defaultPrevented() && document()->frame()) {
-            KURL url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
-            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true);
+            String url = document()->completeURL(deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)));
+            document()->frame()->loader()->urlSelected(url, target(), event, false, false, true, SendReferrer);
         }
 
         event->setDefaultHandled();
diff --git a/WebCore/wml/WMLInputElement.cpp b/WebCore/wml/WMLInputElement.cpp
index b027bf0..eb31502 100644
--- a/WebCore/wml/WMLInputElement.cpp
+++ b/WebCore/wml/WMLInputElement.cpp
@@ -280,13 +280,13 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && toRenderTextControl(r)->isEdited()) {
-            dispatchEvent(eventNames().changeEvent, true, false);
+        if (r && toRenderTextControl(r)->wasChangedSinceLastChangeEvent()) {
+            dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
             if (r)
-                toRenderTextControl(r)->setEdited(false);
+                toRenderTextControl(r)->setChangedSinceLastChangeEvent(false);
         }
 
         evt->setDefaultHandled();
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.cpp b/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 8b1a480..655b90e 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -73,8 +73,8 @@ public:
     bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
-    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+    virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String&);
 
     // WorkerReportingProxy
     virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -128,7 +128,7 @@ bool SharedWorkerProxy::matches(const String& name, PassRefPtr<SecurityOrigin> o
     return name == m_name;
 }
 
-void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void SharedWorkerProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     MutexLocker lock(m_workerDocumentsLock);
 
@@ -144,7 +144,7 @@ void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task
     document->postTask(task);
 }
 
-void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (isClosing())
         return;
@@ -221,9 +221,9 @@ void SharedWorkerProxy::close()
 
 class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
+    static PassOwnPtr<SharedWorkerConnectTask> create(PassOwnPtr<MessagePortChannel> channel)
     {
-        return adoptRef(new SharedWorkerConnectTask(channel));
+        return new SharedWorkerConnectTask(channel);
     }
 
 private:
diff --git a/WebCore/workers/GenericWorkerTask.h b/WebCore/workers/GenericWorkerTask.h
index d6a9994..27694c4 100644
--- a/WebCore/workers/GenericWorkerTask.h
+++ b/WebCore/workers/GenericWorkerTask.h
@@ -70,9 +70,9 @@ namespace WebCore {
         typedef GenericWorkerTask1<P1, MP1> GenericWorkerTask;
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1));
+            return new GenericWorkerTask(method, parameter1);
         }
 
     private:
@@ -100,9 +100,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P1>::ParamType Param1;
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2));
+            return new GenericWorkerTask(method, parameter1, parameter2);
         }
 
     private:
@@ -133,9 +133,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P2>::ParamType Param2;
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3);
         }
 
     private:
@@ -169,9 +169,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P3>::ParamType Param3;
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4);
         }
 
     private:
@@ -208,9 +208,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P4>::ParamType Param4;
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5);
         }
 
     private:
@@ -250,9 +250,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P5>::ParamType Param5;
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6);
         }
 
     private:
@@ -295,9 +295,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P6>::ParamType Param6;
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
 
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7);
         }
 
     private:
@@ -343,9 +343,9 @@ namespace WebCore {
         typedef typename GenericWorkerTaskTraits<P7>::ParamType Param7;
         typedef typename GenericWorkerTaskTraits<P8>::ParamType Param8;
         
-        static PassRefPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
+        static PassOwnPtr<GenericWorkerTask> create(Method method, Param1 parameter1, Param2 parameter2, Param3 parameter3, Param4 parameter4, Param5 parameter5, Param6 parameter6, Param7 parameter7, Param8 parameter8)
         {
-            return adoptRef(new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8));
+            return new GenericWorkerTask(method, parameter1, parameter2, parameter3, parameter4, parameter5, parameter6, parameter7, parameter8);
         }
         
     private:
@@ -380,7 +380,7 @@ namespace WebCore {
     };
 
     template<typename P1, typename MP1>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1),
         const P1& parameter1)
     {
@@ -390,7 +390,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2),
         const P1& parameter1, const P2& parameter2)
     {
@@ -400,7 +400,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3),
         const P1& parameter1, const P2& parameter2, const P3& parameter3)
     {
@@ -411,7 +411,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4)
     {
@@ -423,7 +423,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5)
     {
@@ -436,7 +436,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6)
     {
@@ -449,7 +449,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
         void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7),
         const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7)
     {
@@ -464,7 +464,7 @@ namespace WebCore {
     }
 
     template<typename P1, typename MP1, typename P2, typename MP2, typename P3, typename MP3, typename P4, typename MP4, typename P5, typename MP5, typename P6, typename MP6, typename P7, typename MP7, typename P8, typename MP8>
-    PassRefPtr<ScriptExecutionContext::Task> createCallbackTask(
+    PassOwnPtr<ScriptExecutionContext::Task> createCallbackTask(
                                                                 void (*method)(ScriptExecutionContext*, MP1, MP2, MP3, MP4, MP5, MP6, MP7, MP8),
                                                                 const P1& parameter1, const P2& parameter2, const P3& parameter3, const P4& parameter4, const P5& parameter5, const P6& parameter6, const P7& parameter7, const P8& parameter8)
     {
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 9a88309..e823278 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -162,7 +162,7 @@ void WorkerContext::scriptImported(unsigned long, const String&)
     notImplemented();
 }
 
-void WorkerContext::postTask(PassRefPtr<Task> task)
+void WorkerContext::postTask(PassOwnPtr<Task> task)
 {
     thread()->runLoop().postTask(task);
 }
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index 9725cf7..f37d42c 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -74,7 +74,7 @@ namespace WebCore {
         virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         virtual void scriptImported(unsigned long identifier, const String& sourceString);
 
-        virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
+        virtual void postTask(PassOwnPtr<Task>); // Executes the task on context's thread asynchronously.
 
         // WorkerGlobalScope
         WorkerContext* self() { return this; }
diff --git a/WebCore/workers/WorkerLoaderProxy.h b/WebCore/workers/WorkerLoaderProxy.h
index ac7cda1..fe1bf51 100644
--- a/WebCore/workers/WorkerLoaderProxy.h
+++ b/WebCore/workers/WorkerLoaderProxy.h
@@ -34,7 +34,7 @@
 #if ENABLE(WORKERS)
 
 #include "ScriptExecutionContext.h"
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -50,11 +50,11 @@ namespace WebCore {
         virtual ~WorkerLoaderProxy() { }
 
         // Posts a task to the thread which runs the loading code (normally, the main thread).
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) = 0;
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>) = 0;
 
         // Posts callbacks from loading code to the WorkerContext. The 'mode' is used to differentiate
         // specific synchronous loading requests so they can be 'nested', per spec.
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerMessagingProxy.cpp b/WebCore/workers/WorkerMessagingProxy.cpp
index 0b66694..2e1dfe0 100644
--- a/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/WebCore/workers/WorkerMessagingProxy.cpp
@@ -46,9 +46,9 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    static PassOwnPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channels));
+        return new MessageWorkerContextTask(message, channels);
     }
 
 private:
@@ -74,9 +74,9 @@ private:
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
+        return new MessageWorkerTask(message, channels, messagingProxy);
     }
 
 private:
@@ -105,9 +105,9 @@ private:
 
 class WorkerExceptionTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerExceptionTask> create(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy));
+        return new WorkerExceptionTask(errorMessage, lineNumber, sourceURL, messagingProxy);
     }
 
 private:
@@ -141,9 +141,9 @@ private:
 
 class WorkerContextDestroyedTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerContextDestroyedTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerContextDestroyedTask(messagingProxy));
+        return new WorkerContextDestroyedTask(messagingProxy);
     }
 
 private:
@@ -162,9 +162,9 @@ private:
 
 class WorkerTerminateTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    static PassOwnPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new WorkerTerminateTask(messagingProxy));
+        return new WorkerTerminateTask(messagingProxy);
     }
 
 private:
@@ -183,9 +183,9 @@ private:
 
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
+    static PassOwnPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
     {
-        return adoptRef(new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity));
+        return new WorkerThreadActivityReportTask(messagingProxy, confirmingMessage, hasPendingActivity);
     }
 
 private:
@@ -257,7 +257,7 @@ void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScrip
         m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
-void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     if (m_askedToTerminate)
         return;
@@ -266,7 +266,7 @@ void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecu
     m_workerThread->runLoop().postTaskForMode(task, mode);
 }
 
-void WorkerMessagingProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerMessagingProxy::postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     // FIXME: In case of nested workers, this should go directly to the root Document context.
     ASSERT(m_scriptExecutionContext->isDocument());
@@ -304,7 +304,7 @@ void WorkerMessagingProxy::workerThreadCreated(PassRefPtr<DedicatedWorkerThread>
         m_workerThreadHadPendingActivity = true; // Worker initialization means a pending activity.
 
         for (unsigned i = 0; i < taskCount; ++i)
-            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i]);
+            m_workerThread->runLoop().postTask(m_queuedEarlyTasks[i].release());
         m_queuedEarlyTasks.clear();
     }
 }
diff --git a/WebCore/workers/WorkerMessagingProxy.h b/WebCore/workers/WorkerMessagingProxy.h
index 754102a..90b87f4 100644
--- a/WebCore/workers/WorkerMessagingProxy.h
+++ b/WebCore/workers/WorkerMessagingProxy.h
@@ -71,8 +71,8 @@ namespace WebCore {
         // Implementation of WorkerLoaderProxy.
         // These methods are called on different threads to schedule loading
         // requests and to send callbacks back to WorkerContext.
-        virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
-        virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        virtual void postTaskToLoader(PassOwnPtr<ScriptExecutionContext::Task>);
+        virtual void postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         void workerThreadCreated(PassRefPtr<DedicatedWorkerThread>);
 
@@ -100,7 +100,7 @@ namespace WebCore {
 
         bool m_askedToTerminate;
 
-        Vector<RefPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
+        Vector<OwnPtr<ScriptExecutionContext::Task> > m_queuedEarlyTasks; // Tasks are queued here until there's a thread object created.
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerRunLoop.cpp b/WebCore/workers/WorkerRunLoop.cpp
index 39b21c6..445fa65 100644
--- a/WebCore/workers/WorkerRunLoop.cpp
+++ b/WebCore/workers/WorkerRunLoop.cpp
@@ -64,27 +64,6 @@ private:
     double m_nextFireTime;
 };
 
-class WorkerRunLoop::Task : public RefCounted<Task> {
-public:
-    static PassRefPtr<Task> create(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-    {
-        return adoptRef(new Task(task, mode));
-    }
-
-    const String& mode() const { return m_mode; }
-    void performTask(ScriptExecutionContext* context) { m_task->performTask(context); }
-
-private:
-    Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
-        : m_task(task)
-        , m_mode(mode.crossThreadString())
-    {
-    }
-
-    RefPtr<ScriptExecutionContext::Task> m_task;
-    String m_mode;
-};
-
 class ModePredicate {
 public:
     ModePredicate(const String& mode)
@@ -98,7 +77,7 @@ public:
         return m_defaultMode;
     }
 
-    bool operator()(PassRefPtr<WorkerRunLoop::Task> task) const
+    bool operator()(WorkerRunLoop::Task* task) const
     {
         return m_defaultMode || m_mode == task->mode();
     }
@@ -169,9 +148,9 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     ASSERT(context->thread());
     ASSERT(context->thread()->threadID() == currentThread());
 
-    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<RefPtr<Task> >::infiniteTime();
-    RefPtr<Task> task;
-    MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
+    double absoluteTime = (predicate.isDefaultMode() && m_sharedTimer->isActive()) ? m_sharedTimer->fireTime() : MessageQueue<Task>::infiniteTime();
+    MessageQueueWaitResult result;
+    OwnPtr<WorkerRunLoop::Task> task = m_messageQueue.waitForMessageFilteredWithTimeout(result, predicate, absoluteTime);
 
     // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
     if (context->isClosing())
@@ -198,16 +177,33 @@ void WorkerRunLoop::terminate()
     m_messageQueue.kill();
 }
 
-void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
+void WorkerRunLoop::postTask(PassOwnPtr<ScriptExecutionContext::Task> task)
 {
     postTaskForMode(task, defaultMode());
 }
 
-void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+void WorkerRunLoop::postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
     m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
+PassOwnPtr<WorkerRunLoop::Task> WorkerRunLoop::Task::create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    return new Task(task, mode);
+}
+
+void WorkerRunLoop::Task::performTask(ScriptExecutionContext* context)
+{
+    m_task->performTask(context);
+}
+
+WorkerRunLoop::Task::Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
+    : m_task(task)
+    , m_mode(mode.crossThreadString())
+{
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/WorkerRunLoop.h b/WebCore/workers/WorkerRunLoop.h
index 5f74f01..9d4edfd 100644
--- a/WebCore/workers/WorkerRunLoop.h
+++ b/WebCore/workers/WorkerRunLoop.h
@@ -36,7 +36,7 @@
 #include "ScriptExecutionContext.h"
 #include <wtf/MessageQueue.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -58,18 +58,32 @@ namespace WebCore {
         void terminate();
         bool terminated() { return m_messageQueue.killed(); }
 
-        void postTask(PassRefPtr<ScriptExecutionContext::Task>);
-        void postTaskForMode(PassRefPtr<ScriptExecutionContext::Task>, const String& mode);
+        void postTask(PassOwnPtr<ScriptExecutionContext::Task>);
+        void postTaskForMode(PassOwnPtr<ScriptExecutionContext::Task>, const String& mode);
 
         unsigned long createUniqueId() { return ++m_uniqueId; }
 
         static String defaultMode();
-        class Task;
+
+        class Task : public Noncopyable {
+        public:
+            static PassOwnPtr<Task> create(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+            ~Task() { }
+            const String& mode() const { return m_mode; }
+            void performTask(ScriptExecutionContext* context);
+
+        private:
+            Task(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode);
+        
+            OwnPtr<ScriptExecutionContext::Task> m_task;
+            String m_mode;
+        };
+
     private:
         friend class RunLoopSetup;
         MessageQueueWaitResult runInMode(WorkerContext*, const ModePredicate&);
 
-        MessageQueue<RefPtr<Task> > m_messageQueue;
+        MessageQueue<Task> m_messageQueue;
         OwnPtr<WorkerSharedTimer> m_sharedTimer;
         int m_nestedCount;
         unsigned long m_uniqueId;
diff --git a/WebCore/wscript b/WebCore/wscript
index 3719b84..1ad8e90 100644
--- a/WebCore/wscript
+++ b/WebCore/wscript
@@ -30,30 +30,41 @@ from settings import *
 webcore_sources = {}
 
 if build_port == "wx":
-    webcore_sources['plugins'] = [  'plugins/PluginDataNone.cpp',
-                                    'plugins/PluginViewNone.cpp'
-                                  ]
-    
     if building_on_win32:
-        webcore_dirs.append('platform/wx/wxcode/win')
+        webcore_dirs.extend(['platform/wx/wxcode/win', 'plugins/win'])
         webcore_sources['wx-win'] = [
                # wxTimer on Windows has a bug that causes it to eat crashes in callbacks
                # so we need to use the Win port's implementation until the wx bug fix is
                # widely available (it was fixed in 2.8.10).
                'platform/win/SharedTimerWin.cpp',
+               # Use the Windows plugin architecture
                'page/win/PageWin.cpp',
+               'plugins/win/PluginDataWin.cpp',
+               'plugins/win/PluginDatabaseWin.cpp',
+               'plugins/win/PluginMessageThrottlerWin.cpp',
                'plugins/win/PluginPackageWin.cpp',
+               'plugins/win/PluginViewWin.cpp',
         ]
     elif sys.platform.startswith('darwin'):
+        webcore_dirs.append('plugins/mac')
         webcore_dirs.append('platform/wx/wxcode/mac/carbon')
+        webcore_dirs.append('platform/mac')
         webcore_sources['wx-mac'] = [
+               'platform/mac/WebCoreNSStringExtras.mm',
                'platform/mac/PurgeableBufferMac.cpp',
+               'plugins/wx/PluginDataWx.cpp',
+               'plugins/mac/PluginPackageMac.cpp',
+               'plugins/mac/PluginViewMac.cpp'
         ]
-        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
     else:
+        webcore_sources['wx-gtk'] = [
+               'plugins/PluginDataNone.cpp',
+               'plugins/PluginViewNone.cpp',
+               'plugins/PluginPackageNone.cpp'
+        ]
         webcore_dirs.append('platform/wx/wxcode/gtk')
-        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
         
+import TaskGen
 from TaskGen import taskgen, feature, after
 import Task, ccroot
 
@@ -81,7 +92,9 @@ def configure(conf):
 
 def build(bld):
     import Options
-
+    if sys.platform.startswith('darwin'):
+        TaskGen.task_gen.mappings['.mm'] = TaskGen.task_gen.mappings['.cxx']
+    
     wk_includes = ['.', '..', 'DerivedSources',
                 wk_root, 
                 os.path.join(wk_root, 'JavaScriptCore'),
@@ -92,8 +105,14 @@ def build(bld):
         ]
 
     features = [build_port]
+    exclude_patterns = ['*None.cpp', '*CFNet.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*']
     if build_port == 'wx':
         features.append('curl')
+        
+    if sys.platform.startswith('darwin'):
+        features.append('cf')
+    else:
+        exclude_patterns.append('*CF.cpp')
 
     full_dirs = get_dirs_for_features(webcore_dir, features=features, dirs=webcore_dirs)
 
@@ -123,8 +142,9 @@ def build(bld):
         )
         
     excludes = []
+    
     if build_port == 'wx':
-        excludes = get_excludes(webcore_dir, ['*None.cpp', '*CF.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*'])
+        excludes = get_excludes(webcore_dir, exclude_patterns)
         excludes.extend(['UserStyleSheetLoader.cpp', 'RenderMediaControls.cpp'])
 
 
@@ -145,5 +165,8 @@ def build(bld):
         excludes.append('JSInspectorController.cpp')
         if building_on_win32:
             excludes.append('SharedTimerWx.cpp')
+            
+        excludes.append('AuthenticationCF.cpp')
+        excludes.append('LoaderRunLoopCF.cpp')
         
     webcore.find_sources_in_dirs(full_dirs, excludes = excludes, exts=['.c', '.cpp'])
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 87a6540..f1a7969 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -59,7 +59,7 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
 #endif
 
-struct XMLHttpRequestStaticData {
+struct XMLHttpRequestStaticData : Noncopyable {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
     String m_secHeaderPrefix;
@@ -253,27 +253,30 @@ void XMLHttpRequest::callReadyStateChangeListener()
 
 #if ENABLE(INSPECTOR)
     InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
-    if (timelineAgent)
+    bool callTimelineAgentOnReadyStateChange = timelineAgent && hasEventListeners(eventNames().readystatechangeEvent);
+    if (callTimelineAgentOnReadyStateChange)
         timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
 #endif
 
     dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
 #if ENABLE(INSPECTOR)
-    if (timelineAgent)
+    if (callTimelineAgentOnReadyStateChange && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
         timelineAgent->didChangeXHRReadyState();
 #endif
 
     if (m_state == DONE && !m_error) {
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
+        bool callTimelineAgentOnLoad = timelineAgent && hasEventListeners(eventNames().loadEvent);
+        if (callTimelineAgentOnLoad)
             timelineAgent->willLoadXHR(m_url.string());
 #endif
 
         dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
 
 #if ENABLE(INSPECTOR)
-        if (timelineAgent)
+        if (callTimelineAgentOnLoad && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
             timelineAgent->didLoadXHR();
 #endif
     }
@@ -629,8 +632,9 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*scriptExecutionContext()->globalData(), this))
-        JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
+    JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
+    if (hasCachedDOMObjectWrapper(globalData, this))
+        globalData->heap.reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index c7e0192..69019a5 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
 class Document;
 class File;
-struct ResourceRequest;
+class ResourceRequest;
 class TextResourceDecoder;
 class ThreadableLoader;
 
diff --git a/WebCore/xml/XPathExpressionNode.h b/WebCore/xml/XPathExpressionNode.h
index 74b134e..38070b9 100644
--- a/WebCore/xml/XPathExpressionNode.h
+++ b/WebCore/xml/XPathExpressionNode.h
@@ -39,7 +39,7 @@ namespace WebCore {
 
     namespace XPath {
         
-        struct EvaluationContext {
+        struct EvaluationContext : FastAllocBase {
             RefPtr<Node> node;
             unsigned long size;
             unsigned long position;
diff --git a/WebCore/xml/XPathNodeSet.h b/WebCore/xml/XPathNodeSet.h
index 1130488..d5c47be 100644
--- a/WebCore/xml/XPathNodeSet.h
+++ b/WebCore/xml/XPathNodeSet.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
     namespace XPath {
 
-        class NodeSet {
+        class NodeSet : public FastAllocBase {
         public:
             NodeSet() : m_isSorted(true), m_subtreesAreDisjoint(false) { }
             
diff --git a/WebCore/xml/XPathStep.cpp b/WebCore/xml/XPathStep.cpp
index 411b616..e5f2048 100644
--- a/WebCore/xml/XPathStep.cpp
+++ b/WebCore/xml/XPathStep.cpp
@@ -193,9 +193,13 @@ static inline bool nodeMatchesBasicTest(Node* node, Step::Axis axis, const Step:
             if (name == starAtom)
                 return namespaceURI.isEmpty() || namespaceURI == node->namespaceURI();
 
-            if (node->isHTMLElement() && node->document()->isHTMLDocument()) {
-                // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
-                return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+            if (node->document()->isHTMLDocument()) {
+                if (node->isHTMLElement()) {
+                    // Paths without namespaces should match HTML elements in HTML documents despite those having an XHTML namespace. Names are compared case-insensitively.
+                    return equalIgnoringCase(static_cast<Element*>(node)->localName(), name) && (namespaceURI.isNull() || namespaceURI == node->namespaceURI());
+                }
+                // An expression without any prefix shouldn't match no-namespace nodes (because HTML5 says so).
+                return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI() && !namespaceURI.isNull();
             }
             return static_cast<Element*>(node)->hasLocalName(name) && namespaceURI == node->namespaceURI();
         }
diff --git a/WebCore/xml/XPathStep.h b/WebCore/xml/XPathStep.h
index 11612e9..ec022b3 100644
--- a/WebCore/xml/XPathStep.h
+++ b/WebCore/xml/XPathStep.h
@@ -49,7 +49,7 @@ namespace WebCore {
                 SelfAxis
             };
             
-            class NodeTest {
+            class NodeTest : public FastAllocBase {
             public:
                 enum Kind {
                     TextNodeTest, CommentNodeTest, ProcessingInstructionNodeTest, AnyNodeTest, NameTest